devbox
Gausst松鼠会
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

k8s系列(二)之k8s高可用集群环境搭建_description: serviceclusteripblock represents a si

作者：Gausst松鼠会 | 2024-03-26 08:09:44

赞

踩

description: serviceclusteripblock represents a single allowed clusterip

一、集群图解：关于系统环境及docker的安装使用请参考k8s系列(一)之基础环境安装配置、dockerfile配置及使用_非生物语言学家的博客-CSDN博客

二、k8s基础组件安装

1、基础工具安装

[root@anonymous ~]# yum install -y yum-utils device-mapper-persistent-data lvm2 wget net-tools nfs-utils lrzsz gcc gcc-c++ make cmake libxml2-devel openssl-devel curl curl-devel unzip sudo ntp libaio-devel wget vim ncurses-devel autoconf automake zlib-devel python-devel epel-release openssh-server socat ipvsadm conntrack ntpdate telnet

2、基于 chrony 配置服务器时间跟网络时间同步

  1. [root@anonymous ~]# yum -y install chrony
  2. [root@anonymous ~]# systemctl enable chronyd --now
  3. [root@anonymous ~]# vim /etc/chrony.conf
  4.  
  5. 删除：
  6. server 0.centos.pool.ntp.org iburst
  7. server 1.centos.pool.ntp.org iburst
  8. server 2.centos.pool.ntp.org iburst
  9. server 3.centos.pool.ntp.org iburst
  10. 在原来的位置，插入国内 NTP 服务器地址
  11. server ntp1.aliyun.com iburst
  12. server ntp2.aliyun.com iburst
  13. server ntp1.tencent.com iburst
  14. server ntp2.tencent.com iburst
  15.  
  16.  
  17. [root@anonymous ~]# systemctl restart chronyd

3、关闭防火墙和swap分区

  1. [root@anonymous ~]# systemctl stop firewalld ; systemctl disable firewalld
  2. # 永久关闭SELINUX 需要重启主机才会生效
  3. [root@anonymous ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
  4. # 临时关闭SELINUX 
  5. [root@anonymous ~]# setenforce 0
  6.  
  7. #临时关闭swap
  8. [root@anonymous ~]# swapoff -a
  9. #永久关闭：注释 swap 挂载  /dev/mapper/centos-swap swap
  10. [root@anonymous ~]# vim /etc/fstab
  11.  
  12.

4、修改内核参数

  1. [root@anonymous ~]# modprobe br_netfilter
  2. [root@anonymous ~]# lsmod | grep br_netfilter
  3.  
  4. [root@anonymous ~]# cat > /etc/sysctl.d/k8s.conf <<EOF
  5. net.bridge.bridge-nf-call-ip6tables = 1
  6. net.bridge.bridge-nf-call-iptables = 1
  7. net.ipv4.ip_forward = 1
  8. EOF
  9.  
  10. [root@anonymous ~]# sysctl -p /etc/sysctl.d/k8s.conf

5、配置阿里云 repo 源

  1. # docker的：
  2. [root@anonymous ~]# yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
  3. # k8s的:
  4. [root@anonymous ~]# tee /etc/yum.repos.d/kubernetes.repo <<-'EOF'
  5. [kubernetes]
  6. name=Kubernetes
  7. baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
  8. enabled=1
  9. gpgcheck=0
  10. EOF

6、安装docker和k8s组件

  1. #安装k8s
  2. [root@anonymous ~]# yum install docker-ce -y
  3. [root@anonymous ~]# systemctl start docker && systemctl enable docker.service
  4.  
  5. [root@anonymous ~]# tee /etc/docker/daemon.json << 'EOF'
  6. {
  7.  "registry-mirrors":["https://vh3bm52y.mirror.aliyuncs.com","https://registry.docker-cn.com","https://docker.mirrors.ustc.edu.cn","https://dockerhub.azk8s.cn","http://hub-mirror.c.163.com"],
  8.   "exec-opts": ["native.cgroupdriver=systemd"]
  9. } 
  10. EOF
  11.  
  12. [root@anonymous ~]# systemctl daemon-reload
  13. [root@anonymous ~]# systemctl restart docker
  14. [root@anonymous ~]# systemctl enable docker
  15. [root@anonymous ~]# systemctl status docker
  16.  
  17. # 安装k8s组件
  18. [root@anonymous ~]# yum install -y kubelet-1.23.1 kubeadm-1.23.1 kubectl-1.23.1
  19. [root@anonymous ~]# systemctl enable kubelet
  20.  
  21. # kubelet ：运行在集群所有节点上，用于启动 Pod 和容器等对象的工具
  22. # kubeadm ：用于初始化集群，启动集群的命令工具
  23. # kubectl :用于和集群通信的命令行，通过 kubectl 可以部署和管理应用，查看各种资源，创建、删除和更新各种组件

7、关机状态下虚拟机生成模板，然后连续clone 4台虚拟机供高可用集群搭建

三、高可用k8s集群搭建(各节点间相互调用的高可用k8s都实现了，这里的高可用是指控制节点(主节点)实现负载均衡,一部分主节点宕机不影响对整个k8s的控制)

1、控制节点基础配置(同时操作ip为7、8、9、11的主机)

1.1、网卡配置我的是ifcfg-eth0可根据实际网络情况配置自己的网络ip

  1. [root@192 network-scripts]# vim /etc/sysconfig/network-scripts/ifcfg-eth0
  2.  
  3. # 配置参考 x根据实际主机ip补齐
  4. BOOTPROTO=static
  5. IPADDR=192.168.1.X
  6. NETMASK=255.255.255.0
  7. GATEWAY=192.168.1.1
  8. DNS1=192.168.1.1

 1.2、配置主机名和主机解析，注意xxx-nodexx主机名是根据实际主机指定的

  1. [root@anonymous ~]# hostnamectl set-hostname xxx-nodexx && bash
  2. [root@worker-node11 ~]# vim /etc/hosts
  3.  
  4. # 新增的主机解析配置
  5.  
  6. 192.168.1.7 controller-node7
  7. 192.168.1.8 controller-node8
  8. 192.168.1.9 worker-node9
  9. 192.168.1.11 worker-node11

1.3、配置主机之间无密码登录

  1. # 一路回车，不输入密码
  2. [root@controller-node7 ~]# ssh-keygen
  3. # 把本地的 ssh 公钥文件安装到远程主机对应的账户，yes 输入远程机密码
  4. [root@controller-node7 ~]# ssh-copy-id worker-node9
  5. [root@controller-node7 ~]# ssh-copy-id worker-node11
  6. [root@controller-node7 ~]# ssh-copy-id controller-node8

2、控制节点(ip为7和8的主机)高可用配置

2.1、Nginx+keepalived的安装

[root@controller-node7 ~]# yum install nginx keepalived nginx-mod-stream -y

2.2、Nginx配置（替换/etc/nginx/nginx.conf文件）

  1. user nginx;
  2. worker_processes auto;
  3. error_log /var/log/nginx/error.log;
  4. pid /run/nginx.pid;
  5. include /usr/share/nginx/modules/*.conf;
  6. events {
  7.     worker_connections 1024;
  8. }
  9. # 四层负载均衡，为两台Master apiserver组件提供负载均衡
  10. stream {
  11.     log_format  main  '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';
  12.     access_log  /var/log/nginx/k8s-access.log  main;
  13.     upstream k8s-apiserver {
  14.        # controller-node7 APISERVER IP:PORT
  15.        server 192.168.1.7:6443 weight=5 max_fails=3 fail_timeout=30s;
  16.        # controller-node8 APISERVER IP:PORT
  17.        server 192.168.1.8:6443 weight=5 max_fails=3 fail_timeout=30s;
  18.  
  19.     }
  20.  
  21.     server {
  22.        listen 16443; # 由于nginx与master节点复用，这个监听端口不能是6443，否则会冲突
  23.        proxy_pass k8s-apiserver;
  24.     }
  25. }
  26.  
  27. http {
  28.     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
  29.                       '$status $body_bytes_sent "$http_referer" '
  30.                       '"$http_user_agent" "$http_x_forwarded_for"';
  31.     access_log  /var/log/nginx/access.log  main;
  32.     sendfile            on;
  33.     tcp_nopush          on;
  34.     tcp_nodelay         on;
  35.     keepalive_timeout   65;
  36.     types_hash_max_size 2048;
  37.     include             /etc/nginx/mime.types;
  38.     default_type        application/octet-stream;
  39.     server {
  40.         listen       80 default_server;
  41.         server_name  _;
  42.  
  43.         location / {
  44.         }
  45.     }
  46. }
  47.

2.3、KeepAlived配置（替换/etc/keepalived/keepalived.conf）

  1. global_defs {
  2.    notification_email {
  3.      acassen@firewall.loc
  4.      failover@firewall.loc
  5.      sysadmin@firewall.loc
  6.    }
  7.    notification_email_from Alexandre.Cassen@firewall.loc
  8.    smtp_server 127.0.0.1
  9.    smtp_connect_timeout 30
  10.    router_id NGINX_MASTER
  11. }
  12.  
  13. vrrp_script check_nginx {
  14.     script "/etc/keepalived/check_nginx.sh"
  15. }
  16.  
  17. vrrp_instance VI_1 {
  18.     state MASTER
  19.     interface ens0       # 修改为实际网卡名
  20.     virtual_router_id 8  # VRRP 路由 ID实例，每个实例是唯一的
  21.     priority 100         # 优先级，备服务器设置 90
  22.     advert_int 1         # 指定VRRP 心跳包通告间隔时间，默认1秒
  23.     authentication {
  24.         auth_type PASS
  25.         auth_pass 1111
  26.     }
  27.     # 虚拟IP
  28.     virtual_ipaddress {
  29.         192.168.1.10/24
  30.     }
  31.     track_script {
  32.         check_nginx
  33.     }
  34. }

2.4、check_nginx.sh参考注意加执行权限

  1. #!/bin/bash
  2. #1、判断Nginx是否存活
  3. counter=`ps -C nginx --no-header | wc -l`
  4. if [ $counter -eq 0 ]; then
  5.     #2、如果不存活则尝试启动Nginx
  6.     service nginx start
  7.     sleep 2
  8.     #3、等待2秒后再次获取一次Nginx状态
  9.     counter=`ps -C nginx --no-header | wc -l`
  10.     #4、再次进行判断，如Nginx还不存活则停止Keepalived，让地址进行漂移
  11.     if [ $counter -eq 0 ]; then
  12.         service  keepalived stop
  13.     fi
  14. fi
  15.

2.5、启动Nginx和Keepalive

  1. [root@controller-node7 ~]# chmod +x /etc/keepalived/check_nginx.sh
  2. [root@controller-node7 ~]# systemctl daemon-reload
  3. [root@controller-node7 ~]# systemctl enable nginx keepalived
  4. [root@controller-node7 ~]# systemctl start nginx
  5. [root@controller-node7 ~]# systemctl start keepalived

四、节点依次加入集群

1、节点初始化(ip为7的主机上操作)

1.1、创建kubeadm-config.yaml 文件

  1. [root@controller-node7 ~]# vim kubeadm-config.yaml
  2.  
  3. # yaml配置参考
  4. apiVersion: kubeadm.k8s.io/v1beta2
  5. kind: ClusterConfiguration
  6. kubernetesVersion: v1.23.1
  7. controlPlaneEndpoint: 192.168.1.10:16443
  8. imageRepository: registry.aliyuncs.com/google_containers
  9. apiServer:
  10.  certSANs:
  11.  - 192.168.1.11
  12.  - 192.168.1.10
  13.  - 192.168.1.9
  14.  - 192.168.1.8
  15.  - 192.168.1.7
  16. networking:
  17.   podSubnet: 10.244.0.0/16
  18.   serviceSubnet: 10.10.0.0/16
  19. ---
  20. apiVersion: kubeproxy.config.k8s.io/v1alpha1
  21. kind:  KubeProxyConfiguration
  22. mode: ipvs

1.2、使用 kubeadm 初始化 k8s 集群

[root@controller-node7 ~]# kubeadm init --config kubeadm-config.yaml --ignore-preflight-errors=SystemVerification

1.3、配置 kubectl 的配置文件，保存一个证书，这样 kubectl 命令可以使用这个证书对 k8s 集群进行管理

  1. [root@controller-node7 ~]#  mkdir -p $HOME/.kube
  2. [root@controller-node7 ~]#  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  3. [root@controller-node7 ~]#  sudo chown $(id -u):$(id -g) $HOME/.kube/config
  4. [root@controller-node7 ~]#  kubectl get nodes

2、主节点加入集群

  1. # 创建证书存放目录
  2. [root@controller-node8 ~]# cd /root && mkdir -p /etc/kubernetes/pki/etcd &&mkdir -p ~/.kube/
  3. # 拷贝证书
  4. [root@controller-node7 ~]# scp /etc/kubernetes/pki/ca.crt controller-node8:/etc/kubernetes/pki/
  5. [root@controller-node7 ~]# scp /etc/kubernetes/pki/ca.key controller-node8:/etc/kubernetes/pki/
  6. [root@controller-node7 ~]# scp /etc/kubernetes/pki/sa.key controller-node8:/etc/kubernetes/pki/
  7. [root@controller-node7 ~]# scp /etc/kubernetes/pki/sa.pub controller-node8:/etc/kubernetes/pki/
  8. [root@controller-node7 ~]# scp /etc/kubernetes/pki/front-proxy-ca.crt controller-node8:/etc/kubernetes/pki/
  9. [root@controller-node7 ~]# scp /etc/kubernetes/pki/front-proxy-ca.key controller-node8:/etc/kubernetes/pki/
  10. [root@controller-node7 ~]# scp /etc/kubernetes/pki/etcd/ca.crt controller-node8:/etc/kubernetes/pki/etcd/
  11. [root@controller-node7 ~]# scp /etc/kubernetes/pki/etcd/ca.key controller-node8:/etc/kubernetes/pki/etcd/
  12. # 查看加入信息
  13. [root@controller-node7 ~]# kubeadm token create --print-join-command
  14. # xxx根据上条命令查看到的信息进行替换
  15. [root@controller-node8 ~]# kubeadm join 192.168.1.10:16443  --token xxx --discovery-token-ca-cert-hash sha256:xxx --control-plane --ignore-preflight-errors=SystemVerification
  16. # 查看节点信息
  17. [root@controller-node7 ~]# kubectl get nodes

3、从节点加入集群

  1. [root@worker-node9 ~]# kubectl label node worker-node9 node-role.kubernetes.io/worker=worker
  2. [root@worker-node9 ~]# kubeadm join 192.168.1.10:16443  --token xxx --discovery-token-ca-cert-hash sha256:xxx --control-plane --ignore-preflight-errors=SystemVerification
  3. [root@worker-node11 ~]# kubectl label node worker-node11 node-role.kubernetes.io/worker=worker
  4. [root@worker-node11 ~]# kubeadm join 192.168.1.10:16443  --token xxx --discovery-token-ca-cert-hash sha256:xxx --control-plane --ignore-preflight-errors=SystemVerification

4、安装 kubernetes 网络组件-Calico

  1. # 安装
  2. [root@controller-node7 ~]# kubectl apply -f calico.yaml
  3. # 查看是否为runing安装启动成功
  4. [root@controller-node7 ~]# kubectl get pod --all-namespaces

五、k8s网络简单测试

1、测试在 k8s 创建 pod 是否可以正常访问网络，看是否能ping通百度

  1. [root@worker-node9 ~]# docker pull busybox:1.28
  2. [root@worker-node9 ~]# kubectl run busybox --image busybox:1.28 --restart=Never --rm -it busybox -- sh
  3. / # ping www.baidu.com

2、测试 dns 是否正常

  1. [root@worker-node9 ~]# kubectl run busybox --image busybox:1.28 --restart=Never --rm -it busybox -- sh
  2. / # nslookup kubernetes.default.svc.cluster.local

六、备注：calico.yaml文件参考在线下载地址：https://docs.projectcalico.org/manifests/calico.yaml

  1. ---
  2. # Source: calico/templates/calico-config.yaml
  3. # This ConfigMap is used to configure a self-hosted Calico installation.
  4. kind: ConfigMap
  5. apiVersion: v1
  6. metadata:
  7.   name: calico-config
  8.   namespace: kube-system
  9. data:
  10.   # Typha is disabled.
  11.   typha_service_name: "none"
  12.   # Configure the backend to use.
  13.   calico_backend: "bird"
  14.  
  15.   # Configure the MTU to use for workload interfaces and tunnels.
  16.   # By default, MTU is auto-detected, and explicitly setting this field should not be required.
  17.   # You can override auto-detection by providing a non-zero value.
  18.   veth_mtu: "0"
  19.  
  20.   # The CNI network configuration to install on each node. The special
  21.   # values in this config will be automatically populated.
  22.   cni_network_config: |-
  23.     {
  24.       "name": "k8s-pod-network",
  25.       "cniVersion": "0.3.1",
  26.       "plugins": [
  27.         {
  28.           "type": "calico",
  29.           "log_level": "info",
  30.           "log_file_path": "/var/log/calico/cni/cni.log",
  31.           "datastore_type": "kubernetes",
  32.           "nodename": "__KUBERNETES_NODE_NAME__",
  33.           "mtu": __CNI_MTU__,
  34.           "ipam": {
  35.               "type": "calico-ipam"
  36.           },
  37.           "policy": {
  38.               "type": "k8s"
  39.           },
  40.           "kubernetes": {
  41.               "kubeconfig": "__KUBECONFIG_FILEPATH__"
  42.           }
  43.         },
  44.         {
  45.           "type": "portmap",
  46.           "snat": true,
  47.           "capabilities": {"portMappings": true}
  48.         },
  49.         {
  50.           "type": "bandwidth",
  51.           "capabilities": {"bandwidth": true}
  52.         }
  53.       ]
  54.     }
  55.  
  56. ---
  57. # Source: calico/templates/kdd-crds.yaml
  58.  
  59. apiVersion: apiextensions.k8s.io/v1
  60. kind: CustomResourceDefinition
  61. metadata:
  62.   name: bgpconfigurations.crd.projectcalico.org
  63. spec:
  64.   group: crd.projectcalico.org
  65.   names:
  66.     kind: BGPConfiguration
  67.     listKind: BGPConfigurationList
  68.     plural: bgpconfigurations
  69.     singular: bgpconfiguration
  70.   scope: Cluster
  71.   versions:
  72.   - name: v1
  73.     schema:
  74.       openAPIV3Schema:
  75.         description: BGPConfiguration contains the configuration for any BGP routing.
  76.         properties:
  77.           apiVersion:
  78.             description: 'APIVersion defines the versioned schema of this representation
  79.               of an object. Servers should convert recognized schemas to the latest
  80.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  81.             type: string
  82.           kind:
  83.             description: 'Kind is a string value representing the REST resource this
  84.               object represents. Servers may infer this from the endpoint the client
  85.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  86.             type: string
  87.           metadata:
  88.             type: object
  89.           spec:
  90.             description: BGPConfigurationSpec contains the values of the BGP configuration.
  91.             properties:
  92.               asNumber:
  93.                 description: 'ASNumber is the default AS number used by a node. [Default:
  94.                   64512]'
  95.                 format: int32
  96.                 type: integer
  97.               communities:
  98.                 description: Communities is a list of BGP community values and their
  99.                   arbitrary names for tagging routes.
  100.                 items:
  101.                   description: Community contains standard or large community value
  102.                     and its name.
  103.                   properties:
  104.                     name:
  105.                       description: Name given to community value.
  106.                       type: string
  107.                     value:
  108.                       description: Value must be of format `aa:nn` or `aa:nn:mm`.
  109.                         For standard community use `aa:nn` format, where `aa` and
  110.                         `nn` are 16 bit number. For large community use `aa:nn:mm`
  111.                         format, where `aa`, `nn` and `mm` are 32 bit number. Where,
  112.                         `aa` is an AS Number, `nn` and `mm` are per-AS identifier.
  113.                       pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$
  114.                       type: string
  115.                   type: object
  116.                 type: array
  117.               listenPort:
  118.                 description: ListenPort is the port where BGP protocol should listen.
  119.                   Defaults to 179
  120.                 maximum: 65535
  121.                 minimum: 1
  122.                 type: integer
  123.               logSeverityScreen:
  124.                 description: 'LogSeverityScreen is the log severity above which logs
  125.                   are sent to the stdout. [Default: INFO]'
  126.                 type: string
  127.               nodeToNodeMeshEnabled:
  128.                 description: 'NodeToNodeMeshEnabled sets whether full node to node
  129.                   BGP mesh is enabled. [Default: true]'
  130.                 type: boolean
  131.               prefixAdvertisements:
  132.                 description: PrefixAdvertisements contains per-prefix advertisement
  133.                   configuration.
  134.                 items:
  135.                   description: PrefixAdvertisement configures advertisement properties
  136.                     for the specified CIDR.
  137.                   properties:
  138.                     cidr:
  139.                       description: CIDR for which properties should be advertised.
  140.                       type: string
  141.                     communities:
  142.                       description: Communities can be list of either community names
  143.                         already defined in `Specs.Communities` or community value
  144.                         of format `aa:nn` or `aa:nn:mm`. For standard community use
  145.                         `aa:nn` format, where `aa` and `nn` are 16 bit number. For
  146.                         large community use `aa:nn:mm` format, where `aa`, `nn` and
  147.                         `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and
  148.                         `mm` are per-AS identifier.
  149.                       items:
  150.                         type: string
  151.                       type: array
  152.                   type: object
  153.                 type: array
  154.               serviceClusterIPs:
  155.                 description: ServiceClusterIPs are the CIDR blocks from which service
  156.                   cluster IPs are allocated. If specified, Calico will advertise these
  157.                   blocks, as well as any cluster IPs within them.
  158.                 items:
  159.                   description: ServiceClusterIPBlock represents a single allowed ClusterIP
  160.                     CIDR block.
  161.                   properties:
  162.                     cidr:
  163.                       type: string
  164.                   type: object
  165.                 type: array
  166.               serviceExternalIPs:
  167.                 description: ServiceExternalIPs are the CIDR blocks for Kubernetes
  168.                   Service External IPs. Kubernetes Service ExternalIPs will only be
  169.                   advertised if they are within one of these blocks.
  170.                 items:
  171.                   description: ServiceExternalIPBlock represents a single allowed
  172.                     External IP CIDR block.
  173.                   properties:
  174.                     cidr:
  175.                       type: string
  176.                   type: object
  177.                 type: array
  178.               serviceLoadBalancerIPs:
  179.                 description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes
  180.                   Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress
  181.                   IPs will only be advertised if they are within one of these blocks.
  182.                 items:
  183.                   description: ServiceLoadBalancerIPBlock represents a single allowed
  184.                     LoadBalancer IP CIDR block.
  185.                   properties:
  186.                     cidr:
  187.                       type: string
  188.                   type: object
  189.                 type: array
  190.             type: object
  191.         type: object
  192.     served: true
  193.     storage: true
  194. status:
  195.   acceptedNames:
  196.     kind: ""
  197.     plural: ""
  198.   conditions: []
  199.   storedVersions: []
  200.  
  201. ---
  202. apiVersion: apiextensions.k8s.io/v1
  203. kind: CustomResourceDefinition
  204. metadata:
  205.   name: bgppeers.crd.projectcalico.org
  206. spec:
  207.   group: crd.projectcalico.org
  208.   names:
  209.     kind: BGPPeer
  210.     listKind: BGPPeerList
  211.     plural: bgppeers
  212.     singular: bgppeer
  213.   scope: Cluster
  214.   versions:
  215.   - name: v1
  216.     schema:
  217.       openAPIV3Schema:
  218.         properties:
  219.           apiVersion:
  220.             description: 'APIVersion defines the versioned schema of this representation
  221.               of an object. Servers should convert recognized schemas to the latest
  222.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  223.             type: string
  224.           kind:
  225.             description: 'Kind is a string value representing the REST resource this
  226.               object represents. Servers may infer this from the endpoint the client
  227.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  228.             type: string
  229.           metadata:
  230.             type: object
  231.           spec:
  232.             description: BGPPeerSpec contains the specification for a BGPPeer resource.
  233.             properties:
  234.               asNumber:
  235.                 description: The AS Number of the peer.
  236.                 format: int32
  237.                 type: integer
  238.               keepOriginalNextHop:
  239.                 description: Option to keep the original nexthop field when routes
  240.                   are sent to a BGP Peer. Setting "true" configures the selected BGP
  241.                   Peers node to use the "next hop keep;" instead of "next hop self;"(default)
  242.                   in the specific branch of the Node on "bird.cfg".
  243.                 type: boolean
  244.               node:
  245.                 description: The node name identifying the Calico node instance that
  246.                   is targeted by this peer. If this is not set, and no nodeSelector
  247.                   is specified, then this BGP peer selects all nodes in the cluster.
  248.                 type: string
  249.               nodeSelector:
  250.                 description: Selector for the nodes that should have this peering.  When
  251.                   this is set, the Node field must be empty.
  252.                 type: string
  253.               password:
  254.                 description: Optional BGP password for the peerings generated by this
  255.                   BGPPeer resource.
  256.                 properties:
  257.                   secretKeyRef:
  258.                     description: Selects a key of a secret in the node pod's namespace.
  259.                     properties:
  260.                       key:
  261.                         description: The key of the secret to select from.  Must be
  262.                           a valid secret key.
  263.                         type: string
  264.                       name:
  265.                         description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  266.                           TODO: Add other useful fields. apiVersion, kind, uid?'
  267.                         type: string
  268.                       optional:
  269.                         description: Specify whether the Secret or its key must be
  270.                           defined
  271.                         type: boolean
  272.                     required:
  273.                     - key
  274.                     type: object
  275.                 type: object
  276.               peerIP:
  277.                 description: The IP address of the peer followed by an optional port
  278.                   number to peer with. If port number is given, format should be `[<IPv6>]:port`
  279.                   or `<IPv4>:<port>` for IPv4. If optional port number is not set,
  280.                   and this peer IP and ASNumber belongs to a calico/node with ListenPort
  281.                   set in BGPConfiguration, then we use that port to peer.
  282.                 type: string
  283.               peerSelector:
  284.                 description: Selector for the remote nodes to peer with.  When this
  285.                   is set, the PeerIP and ASNumber fields must be empty.  For each
  286.                   peering between the local node and selected remote nodes, we configure
  287.                   an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified,
  288.                   and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified.  The
  289.                   remote AS number comes from the remote node's NodeBGPSpec.ASNumber,
  290.                   or the global default if that is not set.
  291.                 type: string
  292.               sourceAddress:
  293.                 description: Specifies whether and how to configure a source address
  294.                   for the peerings generated by this BGPPeer resource.  Default value
  295.                   "UseNodeIP" means to configure the node IP as the source address.  "None"
  296.                   means not to configure a source address.
  297.                 type: string
  298.             type: object
  299.         type: object
  300.     served: true
  301.     storage: true
  302. status:
  303.   acceptedNames:
  304.     kind: ""
  305.     plural: ""
  306.   conditions: []
  307.   storedVersions: []
  308.  
  309. ---
  310. apiVersion: apiextensions.k8s.io/v1
  311. kind: CustomResourceDefinition
  312. metadata:
  313.   name: blockaffinities.crd.projectcalico.org
  314. spec:
  315.   group: crd.projectcalico.org
  316.   names:
  317.     kind: BlockAffinity
  318.     listKind: BlockAffinityList
  319.     plural: blockaffinities
  320.     singular: blockaffinity
  321.   scope: Cluster
  322.   versions:
  323.   - name: v1
  324.     schema:
  325.       openAPIV3Schema:
  326.         properties:
  327.           apiVersion:
  328.             description: 'APIVersion defines the versioned schema of this representation
  329.               of an object. Servers should convert recognized schemas to the latest
  330.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  331.             type: string
  332.           kind:
  333.             description: 'Kind is a string value representing the REST resource this
  334.               object represents. Servers may infer this from the endpoint the client
  335.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  336.             type: string
  337.           metadata:
  338.             type: object
  339.           spec:
  340.             description: BlockAffinitySpec contains the specification for a BlockAffinity
  341.               resource.
  342.             properties:
  343.               cidr:
  344.                 type: string
  345.               deleted:
  346.                 description: Deleted indicates that this block affinity is being deleted.
  347.                   This field is a string for compatibility with older releases that
  348.                   mistakenly treat this field as a string.
  349.                 type: string
  350.               node:
  351.                 type: string
  352.               state:
  353.                 type: string
  354.             required:
  355.             - cidr
  356.             - deleted
  357.             - node
  358.             - state
  359.             type: object
  360.         type: object
  361.     served: true
  362.     storage: true
  363. status:
  364.   acceptedNames:
  365.     kind: ""
  366.     plural: ""
  367.   conditions: []
  368.   storedVersions: []
  369.  
  370. ---
  371. apiVersion: apiextensions.k8s.io/v1
  372. kind: CustomResourceDefinition
  373. metadata:
  374.   name: clusterinformations.crd.projectcalico.org
  375. spec:
  376.   group: crd.projectcalico.org
  377.   names:
  378.     kind: ClusterInformation
  379.     listKind: ClusterInformationList
  380.     plural: clusterinformations
  381.     singular: clusterinformation
  382.   scope: Cluster
  383.   versions:
  384.   - name: v1
  385.     schema:
  386.       openAPIV3Schema:
  387.         description: ClusterInformation contains the cluster specific information.
  388.         properties:
  389.           apiVersion:
  390.             description: 'APIVersion defines the versioned schema of this representation
  391.               of an object. Servers should convert recognized schemas to the latest
  392.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  393.             type: string
  394.           kind:
  395.             description: 'Kind is a string value representing the REST resource this
  396.               object represents. Servers may infer this from the endpoint the client
  397.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  398.             type: string
  399.           metadata:
  400.             type: object
  401.           spec:
  402.             description: ClusterInformationSpec contains the values of describing
  403.               the cluster.
  404.             properties:
  405.               calicoVersion:
  406.                 description: CalicoVersion is the version of Calico that the cluster
  407.                   is running
  408.                 type: string
  409.               clusterGUID:
  410.                 description: ClusterGUID is the GUID of the cluster
  411.                 type: string
  412.               clusterType:
  413.                 description: ClusterType describes the type of the cluster
  414.                 type: string
  415.               datastoreReady:
  416.                 description: DatastoreReady is used during significant datastore migrations
  417.                   to signal to components such as Felix that it should wait before
  418.                   accessing the datastore.
  419.                 type: boolean
  420.               variant:
  421.                 description: Variant declares which variant of Calico should be active.
  422.                 type: string
  423.             type: object
  424.         type: object
  425.     served: true
  426.     storage: true
  427. status:
  428.   acceptedNames:
  429.     kind: ""
  430.     plural: ""
  431.   conditions: []
  432.   storedVersions: []
  433.  
  434. ---
  435. apiVersion: apiextensions.k8s.io/v1
  436. kind: CustomResourceDefinition
  437. metadata:
  438.   name: felixconfigurations.crd.projectcalico.org
  439. spec:
  440.   group: crd.projectcalico.org
  441.   names:
  442.     kind: FelixConfiguration
  443.     listKind: FelixConfigurationList
  444.     plural: felixconfigurations
  445.     singular: felixconfiguration
  446.   scope: Cluster
  447.   versions:
  448.   - name: v1
  449.     schema:
  450.       openAPIV3Schema:
  451.         description: Felix Configuration contains the configuration for Felix.
  452.         properties:
  453.           apiVersion:
  454.             description: 'APIVersion defines the versioned schema of this representation
  455.               of an object. Servers should convert recognized schemas to the latest
  456.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  457.             type: string
  458.           kind:
  459.             description: 'Kind is a string value representing the REST resource this
  460.               object represents. Servers may infer this from the endpoint the client
  461.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  462.             type: string
  463.           metadata:
  464.             type: object
  465.           spec:
  466.             description: FelixConfigurationSpec contains the values of the Felix configuration.
  467.             properties:
  468.               allowIPIPPacketsFromWorkloads:
  469.                 description: 'AllowIPIPPacketsFromWorkloads controls whether Felix
  470.                   will add a rule to drop IPIP encapsulated traffic from workloads
  471.                   [Default: false]'
  472.                 type: boolean
  473.               allowVXLANPacketsFromWorkloads:
  474.                 description: 'AllowVXLANPacketsFromWorkloads controls whether Felix
  475.                   will add a rule to drop VXLAN encapsulated traffic from workloads
  476.                   [Default: false]'
  477.                 type: boolean
  478.               awsSrcDstCheck:
  479.                 description: 'Set source-destination-check on AWS EC2 instances. Accepted
  480.                   value must be one of "DoNothing", "Enabled" or "Disabled". [Default:
  481.                   DoNothing]'
  482.                 enum:
  483.                 - DoNothing
  484.                 - Enable
  485.                 - Disable
  486.                 type: string
  487.               bpfConnectTimeLoadBalancingEnabled:
  488.                 description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode,
  489.                   controls whether Felix installs the connection-time load balancer.  The
  490.                   connect-time load balancer is required for the host to be able to
  491.                   reach Kubernetes services and it improves the performance of pod-to-service
  492.                   connections.  The only reason to disable it is for debugging purposes.  [Default:
  493.                   true]'
  494.                 type: boolean
  495.               bpfDataIfacePattern:
  496.                 description: BPFDataIfacePattern is a regular expression that controls
  497.                   which interfaces Felix should attach BPF programs to in order to
  498.                   catch traffic to/from the network.  This needs to match the interfaces
  499.                   that Calico workload traffic flows over as well as any interfaces
  500.                   that handle incoming traffic to nodeports and services from outside
  501.                   the cluster.  It should not match the workload interfaces (usually
  502.                   named cali...).
  503.                 type: string
  504.               bpfDisableUnprivileged:
  505.                 description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled
  506.                   sysctl to disable unprivileged use of BPF.  This ensures that unprivileged
  507.                   users cannot access Calico''s BPF maps and cannot insert their own
  508.                   BPF programs to interfere with Calico''s. [Default: true]'
  509.                 type: boolean
  510.               bpfEnabled:
  511.                 description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
  512.                   [Default: false]'
  513.                 type: boolean
  514.               bpfExternalServiceMode:
  515.                 description: 'BPFExternalServiceMode in BPF mode, controls how connections
  516.                   from outside the cluster to services (node ports and cluster IPs)
  517.                   are forwarded to remote workloads.  If set to "Tunnel" then both
  518.                   request and response traffic is tunneled to the remote node.  If
  519.                   set to "DSR", the request traffic is tunneled but the response traffic
  520.                   is sent directly from the remote node.  In "DSR" mode, the remote
  521.                   node appears to use the IP of the ingress node; this requires a
  522.                   permissive L2 network.  [Default: Tunnel]'
  523.                 type: string
  524.               bpfKubeProxyEndpointSlicesEnabled:
  525.                 description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
  526.                   whether Felix's embedded kube-proxy accepts EndpointSlices or not.
  527.                 type: boolean
  528.               bpfKubeProxyIptablesCleanupEnabled:
  529.                 description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF
  530.                   mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s
  531.                   iptables chains.  Should only be enabled if kube-proxy is not running.  [Default:
  532.                   true]'
  533.                 type: boolean
  534.               bpfKubeProxyMinSyncPeriod:
  535.                 description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the
  536.                   minimum time between updates to the dataplane for Felix''s embedded
  537.                   kube-proxy.  Lower values give reduced set-up latency.  Higher values
  538.                   reduce Felix CPU usage by batching up more work.  [Default: 1s]'
  539.                 type: string
  540.               bpfLogLevel:
  541.                 description: 'BPFLogLevel controls the log level of the BPF programs
  542.                   when in BPF dataplane mode.  One of "Off", "Info", or "Debug".  The
  543.                   logs are emitted to the BPF trace pipe, accessible with the command
  544.                   `tc exec bpf debug`. [Default: Off].'
  545.                 type: string
  546.               chainInsertMode:
  547.                 description: 'ChainInsertMode controls whether Felix hooks the kernel''s
  548.                   top-level iptables chains by inserting a rule at the top of the
  549.                   chain or by appending a rule at the bottom. insert is the safe default
  550.                   since it prevents Calico''s rules from being bypassed. If you switch
  551.                   to append mode, be sure that the other rules in the chains signal
  552.                   acceptance by falling through to the Calico rules, otherwise the
  553.                   Calico policy will be bypassed. [Default: insert]'
  554.                 type: string
  555.               dataplaneDriver:
  556.                 type: string
  557.               debugDisableLogDropping:
  558.                 type: boolean
  559.               debugMemoryProfilePath:
  560.                 type: string
  561.               debugSimulateCalcGraphHangAfter:
  562.                 type: string
  563.               debugSimulateDataplaneHangAfter:
  564.                 type: string
  565.               defaultEndpointToHostAction:
  566.                 description: 'DefaultEndpointToHostAction controls what happens to
  567.                   traffic that goes from a workload endpoint to the host itself (after
  568.                   the traffic hits the endpoint egress policy). By default Calico
  569.                   blocks traffic from workload endpoints to the host itself with an
  570.                   iptables "DROP" action. If you want to allow some or all traffic
  571.                   from endpoint to host, set this parameter to RETURN or ACCEPT. Use
  572.                   RETURN if you have your own rules in the iptables "INPUT" chain;
  573.                   Calico will insert its rules at the top of that chain, then "RETURN"
  574.                   packets to the "INPUT" chain once it has completed processing workload
  575.                   endpoint egress policy. Use ACCEPT to unconditionally accept packets
  576.                   from workloads after processing workload endpoint egress policy.
  577.                   [Default: Drop]'
  578.                 type: string
  579.               deviceRouteProtocol:
  580.                 description: This defines the route protocol added to programmed device
  581.                   routes, by default this will be RTPROT_BOOT when left blank.
  582.                 type: integer
  583.               deviceRouteSourceAddress:
  584.                 description: This is the source address to use on programmed device
  585.                   routes. By default the source address is left blank, leaving the
  586.                   kernel to choose the source address used.
  587.                 type: string
  588.               disableConntrackInvalidCheck:
  589.                 type: boolean
  590.               endpointReportingDelay:
  591.                 type: string
  592.               endpointReportingEnabled:
  593.                 type: boolean
  594.               externalNodesList:
  595.                 description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes
  596.                   which may source tunnel traffic and have the tunneled traffic be
  597.                   accepted at calico nodes.
  598.                 items:
  599.                   type: string
  600.                 type: array
  601.               failsafeInboundHostPorts:
  602.                 description: 'FailsafeInboundHostPorts is a comma-delimited list of
  603.                   UDP/TCP ports that Felix will allow incoming traffic to host endpoints
  604.                   on irrespective of the security policy. This is useful to avoid
  605.                   accidentally cutting off a host with incorrect configuration. Each
  606.                   port should be specified as tcp:<port-number> or udp:<port-number>.
  607.                   For back-compatibility, if the protocol is not specified, it defaults
  608.                   to "tcp". To disable all inbound host ports, use the value none.
  609.                   The default value allows ssh access and DHCP. [Default: tcp:22,
  610.                   udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
  611.                 items:
  612.                   description: ProtoPort is combination of protocol and port, both
  613.                     must be specified.
  614.                   properties:
  615.                     port:
  616.                       type: integer
  617.                     protocol:
  618.                       type: string
  619.                   required:
  620.                   - port
  621.                   - protocol
  622.                   type: object
  623.                 type: array
  624.               failsafeOutboundHostPorts:
  625.                 description: 'FailsafeOutboundHostPorts is a comma-delimited list
  626.                   of UDP/TCP ports that Felix will allow outgoing traffic from host
  627.                   endpoints to irrespective of the security policy. This is useful
  628.                   to avoid accidentally cutting off a host with incorrect configuration.
  629.                   Each port should be specified as tcp:<port-number> or udp:<port-number>.
  630.                   For back-compatibility, if the protocol is not specified, it defaults
  631.                   to "tcp". To disable all outbound host ports, use the value none.
  632.                   The default value opens etcd''s standard ports to ensure that Felix
  633.                   does not get cut off from etcd as well as allowing DHCP and DNS.
  634.                   [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667,
  635.                   udp:53, udp:67]'
  636.                 items:
  637.                   description: ProtoPort is combination of protocol and port, both
  638.                     must be specified.
  639.                   properties:
  640.                     port:
  641.                       type: integer
  642.                     protocol:
  643.                       type: string
  644.                   required:
  645.                   - port
  646.                   - protocol
  647.                   type: object
  648.                 type: array
  649.               featureDetectOverride:
  650.                 description: FeatureDetectOverride is used to override the feature
  651.                   detection. Values are specified in a comma separated list with no
  652.                   spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=".
  653.                   "true" or "false" will force the feature, empty or omitted values
  654.                   are auto-detected.
  655.                 type: string
  656.               genericXDPEnabled:
  657.                 description: 'GenericXDPEnabled enables Generic XDP so network cards
  658.                   that don''t support XDP offload or driver modes can use XDP. This
  659.                   is not recommended since it doesn''t provide better performance
  660.                   than iptables. [Default: false]'
  661.                 type: boolean
  662.               healthEnabled:
  663.                 type: boolean
  664.               healthHost:
  665.                 type: string
  666.               healthPort:
  667.                 type: integer
  668.               interfaceExclude:
  669.                 description: 'InterfaceExclude is a comma-separated list of interfaces
  670.                   that Felix should exclude when monitoring for host endpoints. The
  671.                   default value ensures that Felix ignores Kubernetes'' IPVS dummy
  672.                   interface, which is used internally by kube-proxy. If you want to
  673.                   exclude multiple interface names using a single value, the list
  674.                   supports regular expressions. For regular expressions you must wrap
  675.                   the value with ''/''. For example having values ''/^kube/,veth1''
  676.                   will exclude all interfaces that begin with ''kube'' and also the
  677.                   interface ''veth1''. [Default: kube-ipvs0]'
  678.                 type: string
  679.               interfacePrefix:
  680.                 description: 'InterfacePrefix is the interface name prefix that identifies
  681.                   workload endpoints and so distinguishes them from host endpoint
  682.                   interfaces. Note: in environments other than bare metal, the orchestrators
  683.                   configure this appropriately. For example our Kubernetes and Docker
  684.                   integrations set the ''cali'' value, and our OpenStack integration
  685.                   sets the ''tap'' value. [Default: cali]'
  686.                 type: string
  687.               interfaceRefreshInterval:
  688.                 description: InterfaceRefreshInterval is the period at which Felix
  689.                   rescans local interfaces to verify their state. The rescan can be
  690.                   disabled by setting the interval to 0.
  691.                 type: string
  692.               ipipEnabled:
  693.                 type: boolean
  694.               ipipMTU:
  695.                 description: 'IPIPMTU is the MTU to set on the tunnel device. See
  696.                   Configuring MTU [Default: 1440]'
  697.                 type: integer
  698.               ipsetsRefreshInterval:
  699.                 description: 'IpsetsRefreshInterval is the period at which Felix re-checks
  700.                   all iptables state to ensure that no other process has accidentally
  701.                   broken Calico''s rules. Set to 0 to disable iptables refresh. [Default:
  702.                   90s]'
  703.                 type: string
  704.               iptablesBackend:
  705.                 description: IptablesBackend specifies which backend of iptables will
  706.                   be used. The default is legacy.
  707.                 type: string
  708.               iptablesFilterAllowAction:
  709.                 type: string
  710.               iptablesLockFilePath:
  711.                 description: 'IptablesLockFilePath is the location of the iptables
  712.                   lock file. You may need to change this if the lock file is not in
  713.                   its standard location (for example if you have mapped it into Felix''s
  714.                   container at a different path). [Default: /run/xtables.lock]'
  715.                 type: string
  716.               iptablesLockProbeInterval:
  717.                 description: 'IptablesLockProbeInterval is the time that Felix will
  718.                   wait between attempts to acquire the iptables lock if it is not
  719.                   available. Lower values make Felix more responsive when the lock
  720.                   is contended, but use more CPU. [Default: 50ms]'
  721.                 type: string
  722.               iptablesLockTimeout:
  723.                 description: 'IptablesLockTimeout is the time that Felix will wait
  724.                   for the iptables lock, or 0, to disable. To use this feature, Felix
  725.                   must share the iptables lock file with all other processes that
  726.                   also take the lock. When running Felix inside a container, this
  727.                   requires the /run directory of the host to be mounted into the calico/node
  728.                   or calico/felix container. [Default: 0s disabled]'
  729.                 type: string
  730.               iptablesMangleAllowAction:
  731.                 type: string
  732.               iptablesMarkMask:
  733.                 description: 'IptablesMarkMask is the mask that Felix selects its
  734.                   IPTables Mark bits from. Should be a 32 bit hexadecimal number with
  735.                   at least 8 bits set, none of which clash with any other mark bits
  736.                   in use on the system. [Default: 0xff000000]'
  737.                 format: int32
  738.                 type: integer
  739.               iptablesNATOutgoingInterfaceFilter:
  740.                 type: string
  741.               iptablesPostWriteCheckInterval:
  742.                 description: 'IptablesPostWriteCheckInterval is the period after Felix
  743.                   has done a write to the dataplane that it schedules an extra read
  744.                   back in order to check the write was not clobbered by another process.
  745.                   This should only occur if another application on the system doesn''t
  746.                   respect the iptables lock. [Default: 1s]'
  747.                 type: string
  748.               iptablesRefreshInterval:
  749.                 description: 'IptablesRefreshInterval is the period at which Felix
  750.                   re-checks the IP sets in the dataplane to ensure that no other process
  751.                   has accidentally broken Calico''s rules. Set to 0 to disable IP
  752.                   sets refresh. Note: the default for this value is lower than the
  753.                   other refresh intervals as a workaround for a Linux kernel bug that
  754.                   was fixed in kernel version 4.11. If you are using v4.11 or greater
  755.                   you may want to set this to, a higher value to reduce Felix CPU
  756.                   usage. [Default: 10s]'
  757.                 type: string
  758.               ipv6Support:
  759.                 type: boolean
  760.               kubeNodePortRanges:
  761.                 description: 'KubeNodePortRanges holds list of port ranges used for
  762.                   service node ports. Only used if felix detects kube-proxy running
  763.                   in ipvs mode. Felix uses these ranges to separate host and workload
  764.                   traffic. [Default: 30000:32767].'
  765.                 items:
  766.                   anyOf:
  767.                   - type: integer
  768.                   - type: string
  769.                   pattern: ^.*
  770.                   x-kubernetes-int-or-string: true
  771.                 type: array
  772.               logFilePath:
  773.                 description: 'LogFilePath is the full path to the Felix log. Set to
  774.                   none to disable file logging. [Default: /var/log/calico/felix.log]'
  775.                 type: string
  776.               logPrefix:
  777.                 description: 'LogPrefix is the log prefix that Felix uses when rendering
  778.                   LOG rules. [Default: calico-packet]'
  779.                 type: string
  780.               logSeverityFile:
  781.                 description: 'LogSeverityFile is the log severity above which logs
  782.                   are sent to the log file. [Default: Info]'
  783.                 type: string
  784.               logSeverityScreen:
  785.                 description: 'LogSeverityScreen is the log severity above which logs
  786.                   are sent to the stdout. [Default: Info]'
  787.                 type: string
  788.               logSeveritySys:
  789.                 description: 'LogSeveritySys is the log severity above which logs
  790.                   are sent to the syslog. Set to None for no logging to syslog. [Default:
  791.                   Info]'
  792.                 type: string
  793.               maxIpsetSize:
  794.                 type: integer
  795.               metadataAddr:
  796.                 description: 'MetadataAddr is the IP address or domain name of the
  797.                   server that can answer VM queries for cloud-init metadata. In OpenStack,
  798.                   this corresponds to the machine running nova-api (or in Ubuntu,
  799.                   nova-api-metadata). A value of none (case insensitive) means that
  800.                   Felix should not set up any NAT rule for the metadata path. [Default:
  801.                   127.0.0.1]'
  802.                 type: string
  803.               metadataPort:
  804.                 description: 'MetadataPort is the port of the metadata server. This,
  805.                   combined with global.MetadataAddr (if not ''None''), is used to
  806.                   set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
  807.                   In most cases this should not need to be changed [Default: 8775].'
  808.                 type: integer
  809.               mtuIfacePattern:
  810.                 description: MTUIfacePattern is a regular expression that controls
  811.                   which interfaces Felix should scan in order to calculate the host's
  812.                   MTU. This should not match workload interfaces (usually named cali...).
  813.                 type: string
  814.               natOutgoingAddress:
  815.                 description: NATOutgoingAddress specifies an address to use when performing
  816.                   source NAT for traffic in a natOutgoing pool that is leaving the
  817.                   network. By default the address used is an address on the interface
  818.                   the traffic is leaving on (ie it uses the iptables MASQUERADE target)
  819.                 type: string
  820.               natPortRange:
  821.                 anyOf:
  822.                 - type: integer
  823.                 - type: string
  824.                 description: NATPortRange specifies the range of ports that is used
  825.                   for port mapping when doing outgoing NAT. When unset the default
  826.                   behavior of the network stack is used.
  827.                 pattern: ^.*
  828.                 x-kubernetes-int-or-string: true
  829.               netlinkTimeout:
  830.                 type: string
  831.               openstackRegion:
  832.                 description: 'OpenstackRegion is the name of the region that a particular
  833.                   Felix belongs to. In a multi-region Calico/OpenStack deployment,
  834.                   this must be configured somehow for each Felix (here in the datamodel,
  835.                   or in felix.cfg or the environment on each compute node), and must
  836.                   match the [calico] openstack_region value configured in neutron.conf
  837.                   on each node. [Default: Empty]'
  838.                 type: string
  839.               policySyncPathPrefix:
  840.                 description: 'PolicySyncPathPrefix is used to by Felix to communicate
  841.                   policy changes to external services, like Application layer policy.
  842.                   [Default: Empty]'
  843.                 type: string
  844.               prometheusGoMetricsEnabled:
  845.                 description: 'PrometheusGoMetricsEnabled disables Go runtime metrics
  846.                   collection, which the Prometheus client does by default, when set
  847.                   to false. This reduces the number of metrics reported, reducing
  848.                   Prometheus load. [Default: true]'
  849.                 type: boolean
  850.               prometheusMetricsEnabled:
  851.                 description: 'PrometheusMetricsEnabled enables the Prometheus metrics
  852.                   server in Felix if set to true. [Default: false]'
  853.                 type: boolean
  854.               prometheusMetricsHost:
  855.                 description: 'PrometheusMetricsHost is the host that the Prometheus
  856.                   metrics server should bind to. [Default: empty]'
  857.                 type: string
  858.               prometheusMetricsPort:
  859.                 description: 'PrometheusMetricsPort is the TCP port that the Prometheus
  860.                   metrics server should bind to. [Default: 9091]'
  861.                 type: integer
  862.               prometheusProcessMetricsEnabled:
  863.                 description: 'PrometheusProcessMetricsEnabled disables process metrics
  864.                   collection, which the Prometheus client does by default, when set
  865.                   to false. This reduces the number of metrics reported, reducing
  866.                   Prometheus load. [Default: true]'
  867.                 type: boolean
  868.               removeExternalRoutes:
  869.                 description: Whether or not to remove device routes that have not
  870.                   been programmed by Felix. Disabling this will allow external applications
  871.                   to also add device routes. This is enabled by default which means
  872.                   we will remove externally added routes.
  873.                 type: boolean
  874.               reportingInterval:
  875.                 description: 'ReportingInterval is the interval at which Felix reports
  876.                   its status into the datastore or 0 to disable. Must be non-zero
  877.                   in OpenStack deployments. [Default: 30s]'
  878.                 type: string
  879.               reportingTTL:
  880.                 description: 'ReportingTTL is the time-to-live setting for process-wide
  881.                   status reports. [Default: 90s]'
  882.                 type: string
  883.               routeRefreshInterval:
  884.                 description: 'RouteRefreshInterval is the period at which Felix re-checks
  885.                   the routes in the dataplane to ensure that no other process has
  886.                   accidentally broken Calico''s rules. Set to 0 to disable route refresh.
  887.                   [Default: 90s]'
  888.                 type: string
  889.               routeSource:
  890.                 description: 'RouteSource configures where Felix gets its routing
  891.                   information. - WorkloadIPs: use workload endpoints to construct
  892.                   routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
  893.                 type: string
  894.               routeTableRange:
  895.                 description: Calico programs additional Linux route tables for various
  896.                   purposes.  RouteTableRange specifies the indices of the route tables
  897.                   that Calico should use.
  898.                 properties:
  899.                   max:
  900.                     type: integer
  901.                   min:
  902.                     type: integer
  903.                 required:
  904.                 - max
  905.                 - min
  906.                 type: object
  907.               serviceLoopPrevention:
  908.                 description: 'When service IP advertisement is enabled, prevent routing
  909.                   loops to service IPs that are not in use, by dropping or rejecting
  910.                   packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled",
  911.                   in which case such routing loops continue to be allowed. [Default:
  912.                   Drop]'
  913.                 type: string
  914.               sidecarAccelerationEnabled:
  915.                 description: 'SidecarAccelerationEnabled enables experimental sidecar
  916.                   acceleration [Default: false]'
  917.                 type: boolean
  918.               usageReportingEnabled:
  919.                 description: 'UsageReportingEnabled reports anonymous Calico version
  920.                   number and cluster size to projectcalico.org. Logs warnings returned
  921.                   by the usage server. For example, if a significant security vulnerability
  922.                   has been discovered in the version of Calico being used. [Default:
  923.                   true]'
  924.                 type: boolean
  925.               usageReportingInitialDelay:
  926.                 description: 'UsageReportingInitialDelay controls the minimum delay
  927.                   before Felix makes a report. [Default: 300s]'
  928.                 type: string
  929.               usageReportingInterval:
  930.                 description: 'UsageReportingInterval controls the interval at which
  931.                   Felix makes reports. [Default: 86400s]'
  932.                 type: string
  933.               useInternalDataplaneDriver:
  934.                 type: boolean
  935.               vxlanEnabled:
  936.                 type: boolean
  937.               vxlanMTU:
  938.                 description: 'VXLANMTU is the MTU to set on the tunnel device. See
  939.                   Configuring MTU [Default: 1440]'
  940.                 type: integer
  941.               vxlanPort:
  942.                 type: integer
  943.               vxlanVNI:
  944.                 type: integer
  945.               wireguardEnabled:
  946.                 description: 'WireguardEnabled controls whether Wireguard is enabled.
  947.                   [Default: false]'
  948.                 type: boolean
  949.               wireguardInterfaceName:
  950.                 description: 'WireguardInterfaceName specifies the name to use for
  951.                   the Wireguard interface. [Default: wg.calico]'
  952.                 type: string
  953.               wireguardListeningPort:
  954.                 description: 'WireguardListeningPort controls the listening port used
  955.                   by Wireguard. [Default: 51820]'
  956.                 type: integer
  957.               wireguardMTU:
  958.                 description: 'WireguardMTU controls the MTU on the Wireguard interface.
  959.                   See Configuring MTU [Default: 1420]'
  960.                 type: integer
  961.               wireguardRoutingRulePriority:
  962.                 description: 'WireguardRoutingRulePriority controls the priority value
  963.                   to use for the Wireguard routing rule. [Default: 99]'
  964.                 type: integer
  965.               xdpEnabled:
  966.                 description: 'XDPEnabled enables XDP acceleration for suitable untracked
  967.                   incoming deny rules. [Default: true]'
  968.                 type: boolean
  969.               xdpRefreshInterval:
  970.                 description: 'XDPRefreshInterval is the period at which Felix re-checks
  971.                   all XDP state to ensure that no other process has accidentally broken
  972.                   Calico''s BPF maps or attached programs. Set to 0 to disable XDP
  973.                   refresh. [Default: 90s]'
  974.                 type: string
  975.             type: object
  976.         type: object
  977.     served: true
  978.     storage: true
  979. status:
  980.   acceptedNames:
  981.     kind: ""
  982.     plural: ""
  983.   conditions: []
  984.   storedVersions: []
  986. ---
  987. apiVersion: apiextensions.k8s.io/v1
  988. kind: CustomResourceDefinition
  989. metadata:
  990.   name: globalnetworkpolicies.crd.projectcalico.org
  991. spec:
  992.   group: crd.projectcalico.org
  993.   names:
  994.     kind: GlobalNetworkPolicy
  995.     listKind: GlobalNetworkPolicyList
  996.     plural: globalnetworkpolicies
  997.     singular: globalnetworkpolicy
  998.   scope: Cluster
  999.   versions:
  1000.   - name: v1
  1001.     schema:
  1002.       openAPIV3Schema:
  1003.         properties:
  1004.           apiVersion:
  1005.             description: 'APIVersion defines the versioned schema of this representation
  1006.               of an object. Servers should convert recognized schemas to the latest
  1007.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1008.             type: string
  1009.           kind:
  1010.             description: 'Kind is a string value representing the REST resource this
  1011.               object represents. Servers may infer this from the endpoint the client
  1012.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1013.             type: string
  1014.           metadata:
  1015.             type: object
  1016.           spec:
  1017.             properties:
  1018.               applyOnForward:
  1019.                 description: ApplyOnForward indicates to apply the rules in this policy
  1020.                   on forward traffic.
  1021.                 type: boolean
  1022.               doNotTrack:
  1023.                 description: DoNotTrack indicates whether packets matched by the rules
  1024.                   in this policy should go through the data plane's connection tracking,
  1025.                   such as Linux conntrack.  If True, the rules in this policy are
  1026.                   applied before any data plane connection tracking, and packets allowed
  1027.                   by this policy are marked as not to be tracked.
  1028.                 type: boolean
  1029.               egress:
  1030.                 description: The ordered set of egress rules.  Each rule contains
  1031.                   a set of packet match criteria and a corresponding action to apply.
  1032.                 items:
  1033.                   description: "A Rule encapsulates a set of match criteria and an
  1034.                     action.  Both selector-based security Policy and security Profiles
  1035.                     reference rules - separated out as a list of rules for both ingress
  1036.                     and egress packet matching. \n Each positive match criteria has
  1037.                     a negated version, prefixed with \"Not\". All the match criteria
  1038.                     within a rule must be satisfied for a packet to match. A single
  1039.                     rule can contain the positive and negative version of a match
  1040.                     and both must be satisfied for the rule to match."
  1041.                   properties:
  1042.                     action:
  1043.                       type: string
  1044.                     destination:
  1045.                       description: Destination contains the match criteria that apply
  1046.                         to destination entity.
  1047.                       properties:
  1048.                         namespaceSelector:
  1049.                           description: "NamespaceSelector is an optional field that
  1050.                             contains a selector expression. Only traffic that originates
  1051.                             from (or terminates at) endpoints within the selected
  1052.                             namespaces will be matched. When both NamespaceSelector
  1053.                             and Selector are defined on the same rule, then only workload
  1054.                             endpoints that are matched by both selectors will be selected
  1055.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1056.                             implies that the Selector is limited to selecting only
  1057.                             workload endpoints in the same namespace as the NetworkPolicy.
  1058.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1059.                             that the Selector is limited to selecting only GlobalNetworkSet
  1060.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1061.                             NamespaceSelector implies the Selector applies to workload
  1062.                             endpoints across all namespaces."
  1063.                           type: string
  1064.                         nets:
  1065.                           description: Nets is an optional field that restricts the
  1066.                             rule to only apply to traffic that originates from (or
  1067.                             terminates at) IP addresses in any of the given subnets.
  1068.                           items:
  1069.                             type: string
  1070.                           type: array
  1071.                         notNets:
  1072.                           description: NotNets is the negated version of the Nets
  1073.                             field.
  1074.                           items:
  1075.                             type: string
  1076.                           type: array
  1077.                         notPorts:
  1078.                           description: NotPorts is the negated version of the Ports
  1079.                             field. Since only some protocols have ports, if any ports
  1080.                             are specified it requires the Protocol match in the Rule
  1081.                             to be set to "TCP" or "UDP".
  1082.                           items:
  1083.                             anyOf:
  1084.                             - type: integer
  1085.                             - type: string
  1086.                             pattern: ^.*
  1087.                             x-kubernetes-int-or-string: true
  1088.                           type: array
  1089.                         notSelector:
  1090.                           description: NotSelector is the negated version of the Selector
  1091.                             field.  See Selector field for subtleties with negated
  1092.                             selectors.
  1093.                           type: string
  1094.                         ports:
  1095.                           description: "Ports is an optional field that restricts
  1096.                             the rule to only apply to traffic that has a source (destination)
  1097.                             port that matches one of these ranges/values. This value
  1098.                             is a list of integers or strings that represent ranges
  1099.                             of ports. \n Since only some protocols have ports, if
  1100.                             any ports are specified it requires the Protocol match
  1101.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1102.                           items:
  1103.                             anyOf:
  1104.                             - type: integer
  1105.                             - type: string
  1106.                             pattern: ^.*
  1107.                             x-kubernetes-int-or-string: true
  1108.                           type: array
  1109.                         selector:
  1110.                           description: "Selector is an optional field that contains
  1111.                             a selector expression (see Policy for sample syntax).
  1112.                             \ Only traffic that originates from (terminates at) endpoints
  1113.                             matching the selector will be matched. \n Note that: in
  1114.                             addition to the negated version of the Selector (see NotSelector
  1115.                             below), the selector expression syntax itself supports
  1116.                             negation.  The two types of negation are subtly different.
  1117.                             One negates the set of matched endpoints, the other negates
  1118.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1119.                             packets that are from other Calico-controlled \tendpoints
  1120.                             that do not have the label \"my_label\". \n \tNotSelector
  1121.                             = \"has(my_label)\" matches packets that are not from
  1122.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  1123.                             \n The effect is that the latter will accept packets from
  1124.                             non-Calico sources whereas the former is limited to packets
  1125.                             from Calico-controlled endpoints."
  1126.                           type: string
  1127.                         serviceAccounts:
  1128.                           description: ServiceAccounts is an optional field that restricts
  1129.                             the rule to only apply to traffic that originates from
  1130.                             (or terminates at) a pod running as a matching service
  1131.                             account.
  1132.                           properties:
  1133.                             names:
  1134.                               description: Names is an optional field that restricts
  1135.                                 the rule to only apply to traffic that originates
  1136.                                 from (or terminates at) a pod running as a service
  1137.                                 account whose name is in the list.
  1138.                               items:
  1139.                                 type: string
  1140.                               type: array
  1141.                             selector:
  1142.                               description: Selector is an optional field that restricts
  1143.                                 the rule to only apply to traffic that originates
  1144.                                 from (or terminates at) a pod running as a service
  1145.                                 account that matches the given label selector. If
  1146.                                 both Names and Selector are specified then they are
  1147.                                 AND'ed.
  1148.                               type: string
  1149.                           type: object
  1150.                       type: object
  1151.                     http:
  1152.                       description: HTTP contains match criteria that apply to HTTP
  1153.                         requests.
  1154.                       properties:
  1155.                         methods:
  1156.                           description: Methods is an optional field that restricts
  1157.                             the rule to apply only to HTTP requests that use one of
  1158.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  1159.                             methods are OR'd together.
  1160.                           items:
  1161.                             type: string
  1162.                           type: array
  1163.                         paths:
  1164.                           description: 'Paths is an optional field that restricts
  1165.                             the rule to apply to HTTP requests that use one of the
  1166.                             listed HTTP Paths. Multiple paths are OR''d together.
  1167.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  1168.                             ONLY specify either a `exact` or a `prefix` match. The
  1169.                             validator will check for it.'
  1170.                           items:
  1171.                             description: 'HTTPPath specifies an HTTP path to match.
  1172.                               It may be either of the form: exact: <path>: which matches
  1173.                               the path exactly or prefix: <path-prefix>: which matches
  1174.                               the path prefix'
  1175.                             properties:
  1176.                               exact:
  1177.                                 type: string
  1178.                               prefix:
  1179.                                 type: string
  1180.                             type: object
  1181.                           type: array
  1182.                       type: object
  1183.                     icmp:
  1184.                       description: ICMP is an optional field that restricts the rule
  1185.                         to apply to a specific type and code of ICMP traffic.  This
  1186.                         should only be specified if the Protocol field is set to "ICMP"
  1187.                         or "ICMPv6".
  1188.                       properties:
  1189.                         code:
  1190.                           description: Match on a specific ICMP code.  If specified,
  1191.                             the Type value must also be specified. This is a technical
  1192.                             limitation imposed by the kernel's iptables firewall,
  1193.                             which Calico uses to enforce the rule.
  1194.                           type: integer
  1195.                         type:
  1196.                           description: Match on a specific ICMP type.  For example
  1197.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1198.                           type: integer
  1199.                       type: object
  1200.                     ipVersion:
  1201.                       description: IPVersion is an optional field that restricts the
  1202.                         rule to only match a specific IP version.
  1203.                       type: integer
  1204.                     metadata:
  1205.                       description: Metadata contains additional information for this
  1206.                         rule
  1207.                       properties:
  1208.                         annotations:
  1209.                           additionalProperties:
  1210.                             type: string
  1211.                           description: Annotations is a set of key value pairs that
  1212.                             give extra information about the rule
  1213.                           type: object
  1214.                       type: object
  1215.                     notICMP:
  1216.                       description: NotICMP is the negated version of the ICMP field.
  1217.                       properties:
  1218.                         code:
  1219.                           description: Match on a specific ICMP code.  If specified,
  1220.                             the Type value must also be specified. This is a technical
  1221.                             limitation imposed by the kernel's iptables firewall,
  1222.                             which Calico uses to enforce the rule.
  1223.                           type: integer
  1224.                         type:
  1225.                           description: Match on a specific ICMP type.  For example
  1226.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1227.                           type: integer
  1228.                       type: object
  1229.                     notProtocol:
  1230.                       anyOf:
  1231.                       - type: integer
  1232.                       - type: string
  1233.                       description: NotProtocol is the negated version of the Protocol
  1234.                         field.
  1235.                       pattern: ^.*
  1236.                       x-kubernetes-int-or-string: true
  1237.                     protocol:
  1238.                       anyOf:
  1239.                       - type: integer
  1240.                       - type: string
  1241.                       description: "Protocol is an optional field that restricts the
  1242.                         rule to only apply to traffic of a specific IP protocol. Required
  1243.                         if any of the EntityRules contain Ports (because ports only
  1244.                         apply to certain protocols). \n Must be one of these string
  1245.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  1246.                         \"UDPLite\" or an integer in the range 1-255."
  1247.                       pattern: ^.*
  1248.                       x-kubernetes-int-or-string: true
  1249.                     source:
  1250.                       description: Source contains the match criteria that apply to
  1251.                         source entity.
  1252.                       properties:
  1253.                         namespaceSelector:
  1254.                           description: "NamespaceSelector is an optional field that
  1255.                             contains a selector expression. Only traffic that originates
  1256.                             from (or terminates at) endpoints within the selected
  1257.                             namespaces will be matched. When both NamespaceSelector
  1258.                             and Selector are defined on the same rule, then only workload
  1259.                             endpoints that are matched by both selectors will be selected
  1260.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1261.                             implies that the Selector is limited to selecting only
  1262.                             workload endpoints in the same namespace as the NetworkPolicy.
  1263.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1264.                             that the Selector is limited to selecting only GlobalNetworkSet
  1265.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1266.                             NamespaceSelector implies the Selector applies to workload
  1267.                             endpoints across all namespaces."
  1268.                           type: string
  1269.                         nets:
  1270.                           description: Nets is an optional field that restricts the
  1271.                             rule to only apply to traffic that originates from (or
  1272.                             terminates at) IP addresses in any of the given subnets.
  1273.                           items:
  1274.                             type: string
  1275.                           type: array
  1276.                         notNets:
  1277.                           description: NotNets is the negated version of the Nets
  1278.                             field.
  1279.                           items:
  1280.                             type: string
  1281.                           type: array
  1282.                         notPorts:
  1283.                           description: NotPorts is the negated version of the Ports
  1284.                             field. Since only some protocols have ports, if any ports
  1285.                             are specified it requires the Protocol match in the Rule
  1286.                             to be set to "TCP" or "UDP".
  1287.                           items:
  1288.                             anyOf:
  1289.                             - type: integer
  1290.                             - type: string
  1291.                             pattern: ^.*
  1292.                             x-kubernetes-int-or-string: true
  1293.                           type: array
  1294.                         notSelector:
  1295.                           description: NotSelector is the negated version of the Selector
  1296.                             field.  See Selector field for subtleties with negated
  1297.                             selectors.
  1298.                           type: string
  1299.                         ports:
  1300.                           description: "Ports is an optional field that restricts
  1301.                             the rule to only apply to traffic that has a source (destination)
  1302.                             port that matches one of these ranges/values. This value
  1303.                             is a list of integers or strings that represent ranges
  1304.                             of ports. \n Since only some protocols have ports, if
  1305.                             any ports are specified it requires the Protocol match
  1306.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1307.                           items:
  1308.                             anyOf:
  1309.                             - type: integer
  1310.                             - type: string
  1311.                             pattern: ^.*
  1312.                             x-kubernetes-int-or-string: true
  1313.                           type: array
  1314.                         selector:
  1315.                           description: "Selector is an optional field that contains
  1316.                             a selector expression (see Policy for sample syntax).
  1317.                             \ Only traffic that originates from (terminates at) endpoints
  1318.                             matching the selector will be matched. \n Note that: in
  1319.                             addition to the negated version of the Selector (see NotSelector
  1320.                             below), the selector expression syntax itself supports
  1321.                             negation.  The two types of negation are subtly different.
  1322.                             One negates the set of matched endpoints, the other negates
  1323.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1324.                             packets that are from other Calico-controlled \tendpoints
  1325.                             that do not have the label \"my_label\". \n \tNotSelector
  1326.                             = \"has(my_label)\" matches packets that are not from
  1327.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  1328.                             \n The effect is that the latter will accept packets from
  1329.                             non-Calico sources whereas the former is limited to packets
  1330.                             from Calico-controlled endpoints."
  1331.                           type: string
  1332.                         serviceAccounts:
  1333.                           description: ServiceAccounts is an optional field that restricts
  1334.                             the rule to only apply to traffic that originates from
  1335.                             (or terminates at) a pod running as a matching service
  1336.                             account.
  1337.                           properties:
  1338.                             names:
  1339.                               description: Names is an optional field that restricts
  1340.                                 the rule to only apply to traffic that originates
  1341.                                 from (or terminates at) a pod running as a service
  1342.                                 account whose name is in the list.
  1343.                               items:
  1344.                                 type: string
  1345.                               type: array
  1346.                             selector:
  1347.                               description: Selector is an optional field that restricts
  1348.                                 the rule to only apply to traffic that originates
  1349.                                 from (or terminates at) a pod running as a service
  1350.                                 account that matches the given label selector. If
  1351.                                 both Names and Selector are specified then they are
  1352.                                 AND'ed.
  1353.                               type: string
  1354.                           type: object
  1355.                       type: object
  1356.                   required:
  1357.                   - action
  1358.                   type: object
  1359.                 type: array
  1360.               ingress:
  1361.                 description: The ordered set of ingress rules.  Each rule contains
  1362.                   a set of packet match criteria and a corresponding action to apply.
  1363.                 items:
  1364.                   description: "A Rule encapsulates a set of match criteria and an
  1365.                     action.  Both selector-based security Policy and security Profiles
  1366.                     reference rules - separated out as a list of rules for both ingress
  1367.                     and egress packet matching. \n Each positive match criteria has
  1368.                     a negated version, prefixed with \"Not\". All the match criteria
  1369.                     within a rule must be satisfied for a packet to match. A single
  1370.                     rule can contain the positive and negative version of a match
  1371.                     and both must be satisfied for the rule to match."
  1372.                   properties:
  1373.                     action:
  1374.                       type: string
  1375.                     destination:
  1376.                       description: Destination contains the match criteria that apply
  1377.                         to destination entity.
  1378.                       properties:
  1379.                         namespaceSelector:
  1380.                           description: "NamespaceSelector is an optional field that
  1381.                             contains a selector expression. Only traffic that originates
  1382.                             from (or terminates at) endpoints within the selected
  1383.                             namespaces will be matched. When both NamespaceSelector
  1384.                             and Selector are defined on the same rule, then only workload
  1385.                             endpoints that are matched by both selectors will be selected
  1386.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1387.                             implies that the Selector is limited to selecting only
  1388.                             workload endpoints in the same namespace as the NetworkPolicy.
  1389.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1390.                             that the Selector is limited to selecting only GlobalNetworkSet
  1391.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1392.                             NamespaceSelector implies the Selector applies to workload
  1393.                             endpoints across all namespaces."
  1394.                           type: string
  1395.                         nets:
  1396.                           description: Nets is an optional field that restricts the
  1397.                             rule to only apply to traffic that originates from (or
  1398.                             terminates at) IP addresses in any of the given subnets.
  1399.                           items:
  1400.                             type: string
  1401.                           type: array
  1402.                         notNets:
  1403.                           description: NotNets is the negated version of the Nets
  1404.                             field.
  1405.                           items:
  1406.                             type: string
  1407.                           type: array
  1408.                         notPorts:
  1409.                           description: NotPorts is the negated version of the Ports
  1410.                             field. Since only some protocols have ports, if any ports
  1411.                             are specified it requires the Protocol match in the Rule
  1412.                             to be set to "TCP" or "UDP".
  1413.                           items:
  1414.                             anyOf:
  1415.                             - type: integer
  1416.                             - type: string
  1417.                             pattern: ^.*
  1418.                             x-kubernetes-int-or-string: true
  1419.                           type: array
  1420.                         notSelector:
  1421.                           description: NotSelector is the negated version of the Selector
  1422.                             field.  See Selector field for subtleties with negated
  1423.                             selectors.
  1424.                           type: string
  1425.                         ports:
  1426.                           description: "Ports is an optional field that restricts
  1427.                             the rule to only apply to traffic that has a source (destination)
  1428.                             port that matches one of these ranges/values. This value
  1429.                             is a list of integers or strings that represent ranges
  1430.                             of ports. \n Since only some protocols have ports, if
  1431.                             any ports are specified it requires the Protocol match
  1432.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1433.                           items:
  1434.                             anyOf:
  1435.                             - type: integer
  1436.                             - type: string
  1437.                             pattern: ^.*
  1438.                             x-kubernetes-int-or-string: true
  1439.                           type: array
  1440.                         selector:
  1441.                           description: "Selector is an optional field that contains
  1442.                             a selector expression (see Policy for sample syntax).
  1443.                             \ Only traffic that originates from (terminates at) endpoints
  1444.                             matching the selector will be matched. \n Note that: in
  1445.                             addition to the negated version of the Selector (see NotSelector
  1446.                             below), the selector expression syntax itself supports
  1447.                             negation.  The two types of negation are subtly different.
  1448.                             One negates the set of matched endpoints, the other negates
  1449.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1450.                             packets that are from other Calico-controlled \tendpoints
  1451.                             that do not have the label \"my_label\". \n \tNotSelector
  1452.                             = \"has(my_label)\" matches packets that are not from
  1453.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  1454.                             \n The effect is that the latter will accept packets from
  1455.                             non-Calico sources whereas the former is limited to packets
  1456.                             from Calico-controlled endpoints."
  1457.                           type: string
  1458.                         serviceAccounts:
  1459.                           description: ServiceAccounts is an optional field that restricts
  1460.                             the rule to only apply to traffic that originates from
  1461.                             (or terminates at) a pod running as a matching service
  1462.                             account.
  1463.                           properties:
  1464.                             names:
  1465.                               description: Names is an optional field that restricts
  1466.                                 the rule to only apply to traffic that originates
  1467.                                 from (or terminates at) a pod running as a service
  1468.                                 account whose name is in the list.
  1469.                               items:
  1470.                                 type: string
  1471.                               type: array
  1472.                             selector:
  1473.                               description: Selector is an optional field that restricts
  1474.                                 the rule to only apply to traffic that originates
  1475.                                 from (or terminates at) a pod running as a service
  1476.                                 account that matches the given label selector. If
  1477.                                 both Names and Selector are specified then they are
  1478.                                 AND'ed.
  1479.                               type: string
  1480.                           type: object
  1481.                       type: object
  1482.                     http:
  1483.                       description: HTTP contains match criteria that apply to HTTP
  1484.                         requests.
  1485.                       properties:
  1486.                         methods:
  1487.                           description: Methods is an optional field that restricts
  1488.                             the rule to apply only to HTTP requests that use one of
  1489.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  1490.                             methods are OR'd together.
  1491.                           items:
  1492.                             type: string
  1493.                           type: array
  1494.                         paths:
  1495.                           description: 'Paths is an optional field that restricts
  1496.                             the rule to apply to HTTP requests that use one of the
  1497.                             listed HTTP Paths. Multiple paths are OR''d together.
  1498.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  1499.                             ONLY specify either a `exact` or a `prefix` match. The
  1500.                             validator will check for it.'
  1501.                           items:
  1502.                             description: 'HTTPPath specifies an HTTP path to match.
  1503.                               It may be either of the form: exact: <path>: which matches
  1504.                               the path exactly or prefix: <path-prefix>: which matches
  1505.                               the path prefix'
  1506.                             properties:
  1507.                               exact:
  1508.                                 type: string
  1509.                               prefix:
  1510.                                 type: string
  1511.                             type: object
  1512.                           type: array
  1513.                       type: object
  1514.                     icmp:
  1515.                       description: ICMP is an optional field that restricts the rule
  1516.                         to apply to a specific type and code of ICMP traffic.  This
  1517.                         should only be specified if the Protocol field is set to "ICMP"
  1518.                         or "ICMPv6".
  1519.                       properties:
  1520.                         code:
  1521.                           description: Match on a specific ICMP code.  If specified,
  1522.                             the Type value must also be specified. This is a technical
  1523.                             limitation imposed by the kernel's iptables firewall,
  1524.                             which Calico uses to enforce the rule.
  1525.                           type: integer
  1526.                         type:
  1527.                           description: Match on a specific ICMP type.  For example
  1528.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1529.                           type: integer
  1530.                       type: object
  1531.                     ipVersion:
  1532.                       description: IPVersion is an optional field that restricts the
  1533.                         rule to only match a specific IP version.
  1534.                       type: integer
  1535.                     metadata:
  1536.                       description: Metadata contains additional information for this
  1537.                         rule
  1538.                       properties:
  1539.                         annotations:
  1540.                           additionalProperties:
  1541.                             type: string
  1542.                           description: Annotations is a set of key value pairs that
  1543.                             give extra information about the rule
  1544.                           type: object
  1545.                       type: object
  1546.                     notICMP:
  1547.                       description: NotICMP is the negated version of the ICMP field.
  1548.                       properties:
  1549.                         code:
  1550.                           description: Match on a specific ICMP code.  If specified,
  1551.                             the Type value must also be specified. This is a technical
  1552.                             limitation imposed by the kernel's iptables firewall,
  1553.                             which Calico uses to enforce the rule.
  1554.                           type: integer
  1555.                         type:
  1556.                           description: Match on a specific ICMP type.  For example
  1557.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1558.                           type: integer
  1559.                       type: object
  1560.                     notProtocol:
  1561.                       anyOf:
  1562.                       - type: integer
  1563.                       - type: string
  1564.                       description: NotProtocol is the negated version of the Protocol
  1565.                         field.
  1566.                       pattern: ^.*
  1567.                       x-kubernetes-int-or-string: true
  1568.                     protocol:
  1569.                       anyOf:
  1570.                       - type: integer
  1571.                       - type: string
  1572.                       description: "Protocol is an optional field that restricts the
  1573.                         rule to only apply to traffic of a specific IP protocol. Required
  1574.                         if any of the EntityRules contain Ports (because ports only
  1575.                         apply to certain protocols). \n Must be one of these string
  1576.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  1577.                         \"UDPLite\" or an integer in the range 1-255."
  1578.                       pattern: ^.*
  1579.                       x-kubernetes-int-or-string: true
  1580.                     source:
  1581.                       description: Source contains the match criteria that apply to
  1582.                         source entity.
  1583.                       properties:
  1584.                         namespaceSelector:
  1585.                           description: "NamespaceSelector is an optional field that
  1586.                             contains a selector expression. Only traffic that originates
  1587.                             from (or terminates at) endpoints within the selected
  1588.                             namespaces will be matched. When both NamespaceSelector
  1589.                             and Selector are defined on the same rule, then only workload
  1590.                             endpoints that are matched by both selectors will be selected
  1591.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1592.                             implies that the Selector is limited to selecting only
  1593.                             workload endpoints in the same namespace as the NetworkPolicy.
  1594.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1595.                             that the Selector is limited to selecting only GlobalNetworkSet
  1596.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1597.                             NamespaceSelector implies the Selector applies to workload
  1598.                             endpoints across all namespaces."
  1599.                           type: string
  1600.                         nets:
  1601.                           description: Nets is an optional field that restricts the
  1602.                             rule to only apply to traffic that originates from (or
  1603.                             terminates at) IP addresses in any of the given subnets.
  1604.                           items:
  1605.                             type: string
  1606.                           type: array
  1607.                         notNets:
  1608.                           description: NotNets is the negated version of the Nets
  1609.                             field.
  1610.                           items:
  1611.                             type: string
  1612.                           type: array
  1613.                         notPorts:
  1614.                           description: NotPorts is the negated version of the Ports
  1615.                             field. Since only some protocols have ports, if any ports
  1616.                             are specified it requires the Protocol match in the Rule
  1617.                             to be set to "TCP" or "UDP".
  1618.                           items:
  1619.                             anyOf:
  1620.                             - type: integer
  1621.                             - type: string
  1622.                             pattern: ^.*
  1623.                             x-kubernetes-int-or-string: true
  1624.                           type: array
  1625.                         notSelector:
  1626.                           description: NotSelector is the negated version of the Selector
  1627.                             field.  See Selector field for subtleties with negated
  1628.                             selectors.
  1629.                           type: string
  1630.                         ports:
  1631.                           description: "Ports is an optional field that restricts
  1632.                             the rule to only apply to traffic that has a source (destination)
  1633.                             port that matches one of these ranges/values. This value
  1634.                             is a list of integers or strings that represent ranges
  1635.                             of ports. \n Since only some protocols have ports, if
  1636.                             any ports are specified it requires the Protocol match
  1637.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1638.                           items:
  1639.                             anyOf:
  1640.                             - type: integer
  1641.                             - type: string
  1642.                             pattern: ^.*
  1643.                             x-kubernetes-int-or-string: true
  1644.                           type: array
  1645.                         selector:
  1646.                           description: "Selector is an optional field that contains
  1647.                             a selector expression (see Policy for sample syntax).
  1648.                             \ Only traffic that originates from (terminates at) endpoints
  1649.                             matching the selector will be matched. \n Note that: in
  1650.                             addition to the negated version of the Selector (see NotSelector
  1651.                             below), the selector expression syntax itself supports
  1652.                             negation.  The two types of negation are subtly different.
  1653.                             One negates the set of matched endpoints, the other negates
  1654.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1655.                             packets that are from other Calico-controlled \tendpoints
  1656.                             that do not have the label \"my_label\". \n \tNotSelector
  1657.                             = \"has(my_label)\" matches packets that are not from
  1658.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  1659.                             \n The effect is that the latter will accept packets from
  1660.                             non-Calico sources whereas the former is limited to packets
  1661.                             from Calico-controlled endpoints."
  1662.                           type: string
  1663.                         serviceAccounts:
  1664.                           description: ServiceAccounts is an optional field that restricts
  1665.                             the rule to only apply to traffic that originates from
  1666.                             (or terminates at) a pod running as a matching service
  1667.                             account.
  1668.                           properties:
  1669.                             names:
  1670.                               description: Names is an optional field that restricts
  1671.                                 the rule to only apply to traffic that originates
  1672.                                 from (or terminates at) a pod running as a service
  1673.                                 account whose name is in the list.
  1674.                               items:
  1675.                                 type: string
  1676.                               type: array
  1677.                             selector:
  1678.                               description: Selector is an optional field that restricts
  1679.                                 the rule to only apply to traffic that originates
  1680.                                 from (or terminates at) a pod running as a service
  1681.                                 account that matches the given label selector. If
  1682.                                 both Names and Selector are specified then they are
  1683.                                 AND'ed.
  1684.                               type: string
  1685.                           type: object
  1686.                       type: object
  1687.                   required:
  1688.                   - action
  1689.                   type: object
  1690.                 type: array
  1691.               namespaceSelector:
  1692.                 description: NamespaceSelector is an optional field for an expression
  1693.                   used to select a pod based on namespaces.
  1694.                 type: string
  1695.               order:
  1696.                 description: Order is an optional field that specifies the order in
  1697.                   which the policy is applied. Policies with higher "order" are applied
  1698.                   after those with lower order.  If the order is omitted, it may be
  1699.                   considered to be "infinite" - i.e. the policy will be applied last.  Policies
  1700.                   with identical order will be applied in alphanumerical order based
  1701.                   on the Policy "Name".
  1702.                 type: number
  1703.               preDNAT:
  1704.                 description: PreDNAT indicates to apply the rules in this policy before
  1705.                   any DNAT.
  1706.                 type: boolean
  1707.               selector:
  1708.                 description: "The selector is an expression used to pick pick out
  1709.                   the endpoints that the policy should be applied to. \n Selector
  1710.                   expressions follow this syntax: \n \tlabel == \"string_literal\"
  1711.                   \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
  1712.                   \  ->  not equal; also matches if label is not present \tlabel in
  1713.                   { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
  1714.                   one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
  1715.                   ... }  ->  true if the value of label X is not one of \"a\", \"b\",
  1716.                   \"c\" \thas(label_name)  -> True if that label is present \t! expr
  1717.                   -> negation of expr \texpr && expr  -> Short-circuit and \texpr
  1718.                   || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
  1719.                   or the empty selector -> matches all endpoints. \n Label names are
  1720.                   allowed to contain alphanumerics, -, _ and /. String literals are
  1721.                   more permissive but they do not support escape characters. \n Examples
  1722.                   (with made-up labels): \n \ttype == \"webserver\" && deployment
  1723.                   == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
  1724.                   \"dev\" \t! has(label_name)"
  1725.                 type: string
  1726.               serviceAccountSelector:
  1727.                 description: ServiceAccountSelector is an optional field for an expression
  1728.                   used to select a pod based on service accounts.
  1729.                 type: string
  1730.               types:
  1731.                 description: "Types indicates whether this policy applies to ingress,
  1732.                   or to egress, or to both.  When not explicitly specified (and so
  1733.                   the value on creation is empty or nil), Calico defaults Types according
  1734.                   to what Ingress and Egress rules are present in the policy.  The
  1735.                   default is: \n - [ PolicyTypeIngress ], if there are no Egress rules
  1736.                   (including the case where there are   also no Ingress rules) \n
  1737.                   - [ PolicyTypeEgress ], if there are Egress rules but no Ingress
  1738.                   rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are
  1739.                   both Ingress and Egress rules. \n When the policy is read back again,
  1740.                   Types will always be one of these values, never empty or nil."
  1741.                 items:
  1742.                   description: PolicyType enumerates the possible values of the PolicySpec
  1743.                     Types field.
  1744.                   type: string
  1745.                 type: array
  1746.             type: object
  1747.         type: object
  1748.     served: true
  1749.     storage: true
  1750. status:
  1751.   acceptedNames:
  1752.     kind: ""
  1753.     plural: ""
  1754.   conditions: []
  1755.   storedVersions: []
  1756.  
  1757. ---
  1758. apiVersion: apiextensions.k8s.io/v1
  1759. kind: CustomResourceDefinition
  1760. metadata:
  1761.   name: globalnetworksets.crd.projectcalico.org
  1762. spec:
  1763.   group: crd.projectcalico.org
  1764.   names:
  1765.     kind: GlobalNetworkSet
  1766.     listKind: GlobalNetworkSetList
  1767.     plural: globalnetworksets
  1768.     singular: globalnetworkset
  1769.   scope: Cluster
  1770.   versions:
  1771.   - name: v1
  1772.     schema:
  1773.       openAPIV3Schema:
  1774.         description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
  1775.           that share labels to allow rules to refer to them via selectors.  The labels
  1776.           of GlobalNetworkSet are not namespaced.
  1777.         properties:
  1778.           apiVersion:
  1779.             description: 'APIVersion defines the versioned schema of this representation
  1780.               of an object. Servers should convert recognized schemas to the latest
  1781.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1782.             type: string
  1783.           kind:
  1784.             description: 'Kind is a string value representing the REST resource this
  1785.               object represents. Servers may infer this from the endpoint the client
  1786.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1787.             type: string
  1788.           metadata:
  1789.             type: object
  1790.           spec:
  1791.             description: GlobalNetworkSetSpec contains the specification for a NetworkSet
  1792.               resource.
  1793.             properties:
  1794.               nets:
  1795.                 description: The list of IP networks that belong to this set.
  1796.                 items:
  1797.                   type: string
  1798.                 type: array
  1799.             type: object
  1800.         type: object
  1801.     served: true
  1802.     storage: true
  1803. status:
  1804.   acceptedNames:
  1805.     kind: ""
  1806.     plural: ""
  1807.   conditions: []
  1808.   storedVersions: []
  1809.  
  1810. ---
  1811. apiVersion: apiextensions.k8s.io/v1
  1812. kind: CustomResourceDefinition
  1813. metadata:
  1814.   name: hostendpoints.crd.projectcalico.org
  1815. spec:
  1816.   group: crd.projectcalico.org
  1817.   names:
  1818.     kind: HostEndpoint
  1819.     listKind: HostEndpointList
  1820.     plural: hostendpoints
  1821.     singular: hostendpoint
  1822.   scope: Cluster
  1823.   versions:
  1824.   - name: v1
  1825.     schema:
  1826.       openAPIV3Schema:
  1827.         properties:
  1828.           apiVersion:
  1829.             description: 'APIVersion defines the versioned schema of this representation
  1830.               of an object. Servers should convert recognized schemas to the latest
  1831.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1832.             type: string
  1833.           kind:
  1834.             description: 'Kind is a string value representing the REST resource this
  1835.               object represents. Servers may infer this from the endpoint the client
  1836.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1837.             type: string
  1838.           metadata:
  1839.             type: object
  1840.           spec:
  1841.             description: HostEndpointSpec contains the specification for a HostEndpoint
  1842.               resource.
  1843.             properties:
  1844.               expectedIPs:
  1845.                 description: "The expected IP addresses (IPv4 and IPv6) of the endpoint.
  1846.                   If \"InterfaceName\" is not present, Calico will look for an interface
  1847.                   matching any of the IPs in the list and apply policy to that. Note:
  1848.                   \tWhen using the selector match criteria in an ingress or egress
  1849.                   security Policy \tor Profile, Calico converts the selector into
  1850.                   a set of IP addresses. For host \tendpoints, the ExpectedIPs field
  1851.                   is used for that purpose. (If only the interface \tname is specified,
  1852.                   Calico does not learn the IPs of the interface for use in match
  1853.                   \tcriteria.)"
  1854.                 items:
  1855.                   type: string
  1856.                 type: array
  1857.               interfaceName:
  1858.                 description: "Either \"*\", or the name of a specific Linux interface
  1859.                   to apply policy to; or empty.  \"*\" indicates that this HostEndpoint
  1860.                   governs all traffic to, from or through the default network namespace
  1861.                   of the host named by the \"Node\" field; entering and leaving that
  1862.                   namespace via any interface, including those from/to non-host-networked
  1863.                   local workloads. \n If InterfaceName is not \"*\", this HostEndpoint
  1864.                   only governs traffic that enters or leaves the host through the
  1865.                   specific interface named by InterfaceName, or - when InterfaceName
  1866.                   is empty - through the specific interface that has one of the IPs
  1867.                   in ExpectedIPs. Therefore, when InterfaceName is empty, at least
  1868.                   one expected IP must be specified.  Only external interfaces (such
  1869.                   as \"eth0\") are supported here; it isn't possible for a HostEndpoint
  1870.                   to protect traffic through a specific local workload interface.
  1871.                   \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
  1872.                   initially just pre-DNAT policy.  Please check Calico documentation
  1873.                   for the latest position."
  1874.                 type: string
  1875.               node:
  1876.                 description: The node name identifying the Calico node instance.
  1877.                 type: string
  1878.               ports:
  1879.                 description: Ports contains the endpoint's named ports, which may
  1880.                   be referenced in security policy rules.
  1881.                 items:
  1882.                   properties:
  1883.                     name:
  1884.                       type: string
  1885.                     port:
  1886.                       type: integer
  1887.                     protocol:
  1888.                       anyOf:
  1889.                       - type: integer
  1890.                       - type: string
  1891.                       pattern: ^.*
  1892.                       x-kubernetes-int-or-string: true
  1893.                   required:
  1894.                   - name
  1895.                   - port
  1896.                   - protocol
  1897.                   type: object
  1898.                 type: array
  1899.               profiles:
  1900.                 description: A list of identifiers of security Profile objects that
  1901.                   apply to this endpoint. Each profile is applied in the order that
  1902.                   they appear in this list.  Profile rules are applied after the selector-based
  1903.                   security policy.
  1904.                 items:
  1905.                   type: string
  1906.                 type: array
  1907.             type: object
  1908.         type: object
  1909.     served: true
  1910.     storage: true
  1911. status:
  1912.   acceptedNames:
  1913.     kind: ""
  1914.     plural: ""
  1915.   conditions: []
  1916.   storedVersions: []
  1918. ---
  1919. apiVersion: apiextensions.k8s.io/v1
  1920. kind: CustomResourceDefinition
  1921. metadata:
  1922.   name: ipamblocks.crd.projectcalico.org
  1923. spec:
  1924.   group: crd.projectcalico.org
  1925.   names:
  1926.     kind: IPAMBlock
  1927.     listKind: IPAMBlockList
  1928.     plural: ipamblocks
  1929.     singular: ipamblock
  1930.   scope: Cluster
  1931.   versions:
  1932.   - name: v1
  1933.     schema:
  1934.       openAPIV3Schema:
  1935.         properties:
  1936.           apiVersion:
  1937.             description: 'APIVersion defines the versioned schema of this representation
  1938.               of an object. Servers should convert recognized schemas to the latest
  1939.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1940.             type: string
  1941.           kind:
  1942.             description: 'Kind is a string value representing the REST resource this
  1943.               object represents. Servers may infer this from the endpoint the client
  1944.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1945.             type: string
  1946.           metadata:
  1947.             type: object
  1948.           spec:
  1949.             description: IPAMBlockSpec contains the specification for an IPAMBlock
  1950.               resource.
  1951.             properties:
  1952.               affinity:
  1953.                 type: string
  1954.               allocations:
  1955.                 items:
  1956.                   type: integer
  1957.                   # TODO: This nullable is manually added in. We should update controller-gen
  1958.                   # to handle []*int properly itself.
  1959.                   nullable: true
  1960.                 type: array
  1961.               attributes:
  1962.                 items:
  1963.                   properties:
  1964.                     handle_id:
  1965.                       type: string
  1966.                     secondary:
  1967.                       additionalProperties:
  1968.                         type: string
  1969.                       type: object
  1970.                   type: object
  1971.                 type: array
  1972.               cidr:
  1973.                 type: string
  1974.               deleted:
  1975.                 type: boolean
  1976.               strictAffinity:
  1977.                 type: boolean
  1978.               unallocated:
  1979.                 items:
  1980.                   type: integer
  1981.                 type: array
  1982.             required:
  1983.             - allocations
  1984.             - attributes
  1985.             - cidr
  1986.             - strictAffinity
  1987.             - unallocated
  1988.             type: object
  1989.         type: object
  1990.     served: true
  1991.     storage: true
  1992. status:
  1993.   acceptedNames:
  1994.     kind: ""
  1995.     plural: ""
  1996.   conditions: []
  1997.   storedVersions: []
  1999. ---
  2000. apiVersion: apiextensions.k8s.io/v1
  2001. kind: CustomResourceDefinition
  2002. metadata:
  2003.   name: ipamconfigs.crd.projectcalico.org
  2004. spec:
  2005.   group: crd.projectcalico.org
  2006.   names:
  2007.     kind: IPAMConfig
  2008.     listKind: IPAMConfigList
  2009.     plural: ipamconfigs
  2010.     singular: ipamconfig
  2011.   scope: Cluster
  2012.   versions:
  2013.   - name: v1
  2014.     schema:
  2015.       openAPIV3Schema:
  2016.         properties:
  2017.           apiVersion:
  2018.             description: 'APIVersion defines the versioned schema of this representation
  2019.               of an object. Servers should convert recognized schemas to the latest
  2020.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2021.             type: string
  2022.           kind:
  2023.             description: 'Kind is a string value representing the REST resource this
  2024.               object represents. Servers may infer this from the endpoint the client
  2025.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2026.             type: string
  2027.           metadata:
  2028.             type: object
  2029.           spec:
  2030.             description: IPAMConfigSpec contains the specification for an IPAMConfig
  2031.               resource.
  2032.             properties:
  2033.               autoAllocateBlocks:
  2034.                 type: boolean
  2035.               maxBlocksPerHost:
  2036.                 description: MaxBlocksPerHost, if non-zero, is the max number of blocks
  2037.                   that can be affine to each host.
  2038.                 type: integer
  2039.               strictAffinity:
  2040.                 type: boolean
  2041.             required:
  2042.             - autoAllocateBlocks
  2043.             - strictAffinity
  2044.             type: object
  2045.         type: object
  2046.     served: true
  2047.     storage: true
  2048. status:
  2049.   acceptedNames:
  2050.     kind: ""
  2051.     plural: ""
  2052.   conditions: []
  2053.   storedVersions: []
  2055. ---
  2056. apiVersion: apiextensions.k8s.io/v1
  2057. kind: CustomResourceDefinition
  2058. metadata:
  2059.   name: ipamhandles.crd.projectcalico.org
  2060. spec:
  2061.   group: crd.projectcalico.org
  2062.   names:
  2063.     kind: IPAMHandle
  2064.     listKind: IPAMHandleList
  2065.     plural: ipamhandles
  2066.     singular: ipamhandle
  2067.   scope: Cluster
  2068.   versions:
  2069.   - name: v1
  2070.     schema:
  2071.       openAPIV3Schema:
  2072.         properties:
  2073.           apiVersion:
  2074.             description: 'APIVersion defines the versioned schema of this representation
  2075.               of an object. Servers should convert recognized schemas to the latest
  2076.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2077.             type: string
  2078.           kind:
  2079.             description: 'Kind is a string value representing the REST resource this
  2080.               object represents. Servers may infer this from the endpoint the client
  2081.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2082.             type: string
  2083.           metadata:
  2084.             type: object
  2085.           spec:
  2086.             description: IPAMHandleSpec contains the specification for an IPAMHandle
  2087.               resource.
  2088.             properties:
  2089.               block:
  2090.                 additionalProperties:
  2091.                   type: integer
  2092.                 type: object
  2093.               deleted:
  2094.                 type: boolean
  2095.               handleID:
  2096.                 type: string
  2097.             required:
  2098.             - block
  2099.             - handleID
  2100.             type: object
  2101.         type: object
  2102.     served: true
  2103.     storage: true
  2104. status:
  2105.   acceptedNames:
  2106.     kind: ""
  2107.     plural: ""
  2108.   conditions: []
  2109.   storedVersions: []
  2111. ---
  2112. apiVersion: apiextensions.k8s.io/v1
  2113. kind: CustomResourceDefinition
  2114. metadata:
  2115.   name: ippools.crd.projectcalico.org
  2116. spec:
  2117.   group: crd.projectcalico.org
  2118.   names:
  2119.     kind: IPPool
  2120.     listKind: IPPoolList
  2121.     plural: ippools
  2122.     singular: ippool
  2123.   scope: Cluster
  2124.   versions:
  2125.   - name: v1
  2126.     schema:
  2127.       openAPIV3Schema:
  2128.         properties:
  2129.           apiVersion:
  2130.             description: 'APIVersion defines the versioned schema of this representation
  2131.               of an object. Servers should convert recognized schemas to the latest
  2132.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2133.             type: string
  2134.           kind:
  2135.             description: 'Kind is a string value representing the REST resource this
  2136.               object represents. Servers may infer this from the endpoint the client
  2137.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2138.             type: string
  2139.           metadata:
  2140.             type: object
  2141.           spec:
  2142.             description: IPPoolSpec contains the specification for an IPPool resource.
  2143.             properties:
  2144.               blockSize:
  2145.                 description: The block size to use for IP address assignments from
  2146.                   this pool. Defaults to 26 for IPv4 and 112 for IPv6.
  2147.                 type: integer
  2148.               cidr:
  2149.                 description: The pool CIDR.
  2150.                 type: string
  2151.               disabled:
  2152.                 description: When disabled is true, Calico IPAM will not assign addresses
  2153.                   from this pool.
  2154.                 type: boolean
  2155.               ipip:
  2156.                 description: 'Deprecated: this field is only used for APIv1 backwards
  2157.                   compatibility. Setting this field is not allowed, this field is
  2158.                   for internal use only.'
  2159.                 properties:
  2160.                   enabled:
  2161.                     description: When enabled is true, ipip tunneling will be used
  2162.                       to deliver packets to destinations within this pool.
  2163.                     type: boolean
  2164.                   mode:
  2165.                     description: The IPIP mode.  This can be one of "always" or "cross-subnet".  A
  2166.                       mode of "always" will also use IPIP tunneling for routing to
  2167.                       destination IP addresses within this pool.  A mode of "cross-subnet"
  2168.                       will only use IPIP tunneling when the destination node is on
  2169.                       a different subnet to the originating node.  The default value
  2170.                       (if not specified) is "always".
  2171.                     type: string
  2172.                 type: object
  2173.               ipipMode:
  2174.                 description: Contains configuration for IPIP tunneling for this pool.
  2175.                   If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling
  2176.                   is disabled).
  2177.                 type: string
  2178.               nat-outgoing:
  2179.                 description: 'Deprecated: this field is only used for APIv1 backwards
  2180.                   compatibility. Setting this field is not allowed, this field is
  2181.                   for internal use only.'
  2182.                 type: boolean
  2183.               natOutgoing:
  2184.                 description: When nat-outgoing is true, packets sent from Calico networked
  2185.                   containers in this pool to destinations outside of this pool will
  2186.                   be masqueraded.
  2187.                 type: boolean
  2188.               nodeSelector:
  2189.                 description: Allows IPPool to allocate for a specific node by label
  2190.                   selector.
  2191.                 type: string
  2192.               vxlanMode:
  2193.                 description: Contains configuration for VXLAN tunneling for this pool.
  2194.                   If not specified, then this is defaulted to "Never" (i.e. VXLAN
  2195.                   tunneling is disabled).
  2196.                 type: string
  2197.             required:
  2198.             - cidr
  2199.             type: object
  2200.         type: object
  2201.     served: true
  2202.     storage: true
  2203. status:
  2204.   acceptedNames:
  2205.     kind: ""
  2206.     plural: ""
  2207.   conditions: []
  2208.   storedVersions: []
  2210. ---
  2211. apiVersion: apiextensions.k8s.io/v1
  2212. kind: CustomResourceDefinition
  2213. metadata:
  2214.   name: kubecontrollersconfigurations.crd.projectcalico.org
  2215. spec:
  2216.   group: crd.projectcalico.org
  2217.   names:
  2218.     kind: KubeControllersConfiguration
  2219.     listKind: KubeControllersConfigurationList
  2220.     plural: kubecontrollersconfigurations
  2221.     singular: kubecontrollersconfiguration
  2222.   scope: Cluster
  2223.   versions:
  2224.   - name: v1
  2225.     schema:
  2226.       openAPIV3Schema:
  2227.         properties:
  2228.           apiVersion:
  2229.             description: 'APIVersion defines the versioned schema of this representation
  2230.               of an object. Servers should convert recognized schemas to the latest
  2231.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2232.             type: string
  2233.           kind:
  2234.             description: 'Kind is a string value representing the REST resource this
  2235.               object represents. Servers may infer this from the endpoint the client
  2236.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2237.             type: string
  2238.           metadata:
  2239.             type: object
  2240.           spec:
  2241.             description: KubeControllersConfigurationSpec contains the values of the
  2242.               Kubernetes controllers configuration.
  2243.             properties:
  2244.               controllers:
  2245.                 description: Controllers enables and configures individual Kubernetes
  2246.                   controllers
  2247.                 properties:
  2248.                   namespace:
  2249.                     description: Namespace enables and configures the namespace controller.
  2250.                       Enabled by default, set to nil to disable.
  2251.                     properties:
  2252.                       reconcilerPeriod:
  2253.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2254.                           with the Calico datastore. [Default: 5m]'
  2255.                         type: string
  2256.                     type: object
  2257.                   node:
  2258.                     description: Node enables and configures the node controller.
  2259.                       Enabled by default, set to nil to disable.
  2260.                     properties:
  2261.                       hostEndpoint:
  2262.                         description: HostEndpoint controls syncing nodes to host endpoints.
  2263.                           Disabled by default, set to nil to disable.
  2264.                         properties:
  2265.                           autoCreate:
  2266.                             description: 'AutoCreate enables automatic creation of
  2267.                               host endpoints for every node. [Default: Disabled]'
  2268.                             type: string
  2269.                         type: object
  2270.                       reconcilerPeriod:
  2271.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2272.                           with the Calico datastore. [Default: 5m]'
  2273.                         type: string
  2274.                       syncLabels:
  2275.                         description: 'SyncLabels controls whether to copy Kubernetes
  2276.                           node labels to Calico nodes. [Default: Enabled]'
  2277.                         type: string
  2278.                     type: object
  2279.                   policy:
  2280.                     description: Policy enables and configures the policy controller.
  2281.                       Enabled by default, set to nil to disable.
  2282.                     properties:
  2283.                       reconcilerPeriod:
  2284.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2285.                           with the Calico datastore. [Default: 5m]'
  2286.                         type: string
  2287.                     type: object
  2288.                   serviceAccount:
  2289.                     description: ServiceAccount enables and configures the service
  2290.                       account controller. Enabled by default, set to nil to disable.
  2291.                     properties:
  2292.                       reconcilerPeriod:
  2293.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2294.                           with the Calico datastore. [Default: 5m]'
  2295.                         type: string
  2296.                     type: object
  2297.                   workloadEndpoint:
  2298.                     description: WorkloadEndpoint enables and configures the workload
  2299.                       endpoint controller. Enabled by default, set to nil to disable.
  2300.                     properties:
  2301.                       reconcilerPeriod:
  2302.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2303.                           with the Calico datastore. [Default: 5m]'
  2304.                         type: string
  2305.                     type: object
  2306.                 type: object
  2307.               etcdV3CompactionPeriod:
  2308.                 description: 'EtcdV3CompactionPeriod is the period between etcdv3
  2309.                   compaction requests. Set to 0 to disable. [Default: 10m]'
  2310.                 type: string
  2311.               healthChecks:
  2312.                 description: 'HealthChecks enables or disables support for health
  2313.                   checks [Default: Enabled]'
  2314.                 type: string
  2315.               logSeverityScreen:
  2316.                 description: 'LogSeverityScreen is the log severity above which logs
  2317.                   are sent to the stdout. [Default: Info]'
  2318.                 type: string
  2319.               prometheusMetricsPort:
  2320.                 description: 'PrometheusMetricsPort is the TCP port that the Prometheus
  2321.                   metrics server should bind to. Set to 0 to disable. [Default: 9094]'
  2322.                 type: integer
  2323.             required:
  2324.             - controllers
  2325.             type: object
  2326.           status:
  2327.             description: KubeControllersConfigurationStatus represents the status
  2328.               of the configuration. It's useful for admins to be able to see the actual
  2329.               config that was applied, which can be modified by environment variables
  2330.               on the kube-controllers process.
  2331.             properties:
  2332.               environmentVars:
  2333.                 additionalProperties:
  2334.                   type: string
  2335.                 description: EnvironmentVars contains the environment variables on
  2336.                   the kube-controllers that influenced the RunningConfig.
  2337.                 type: object
  2338.               runningConfig:
  2339.                 description: RunningConfig contains the effective config that is running
  2340.                   in the kube-controllers pod, after merging the API resource with
  2341.                   any environment variables.
  2342.                 properties:
  2343.                   controllers:
  2344.                     description: Controllers enables and configures individual Kubernetes
  2345.                       controllers
  2346.                     properties:
  2347.                       namespace:
  2348.                         description: Namespace enables and configures the namespace
  2349.                           controller. Enabled by default, set to nil to disable.
  2350.                         properties:
  2351.                           reconcilerPeriod:
  2352.                             description: 'ReconcilerPeriod is the period to perform
  2353.                               reconciliation with the Calico datastore. [Default:
  2354.                               5m]'
  2355.                             type: string
  2356.                         type: object
  2357.                       node:
  2358.                         description: Node enables and configures the node controller.
  2359.                           Enabled by default, set to nil to disable.
  2360.                         properties:
  2361.                           hostEndpoint:
  2362.                             description: HostEndpoint controls syncing nodes to host
  2363.                               endpoints. Disabled by default, set to nil to disable.
  2364.                             properties:
  2365.                               autoCreate:
  2366.                                 description: 'AutoCreate enables automatic creation
  2367.                                   of host endpoints for every node. [Default: Disabled]'
  2368.                                 type: string
  2369.                             type: object
  2370.                           reconcilerPeriod:
  2371.                             description: 'ReconcilerPeriod is the period to perform
  2372.                               reconciliation with the Calico datastore. [Default:
  2373.                               5m]'
  2374.                             type: string
  2375.                           syncLabels:
  2376.                             description: 'SyncLabels controls whether to copy Kubernetes
  2377.                               node labels to Calico nodes. [Default: Enabled]'
  2378.                             type: string
  2379.                         type: object
  2380.                       policy:
  2381.                         description: Policy enables and configures the policy controller.
  2382.                           Enabled by default, set to nil to disable.
  2383.                         properties:
  2384.                           reconcilerPeriod:
  2385.                             description: 'ReconcilerPeriod is the period to perform
  2386.                               reconciliation with the Calico datastore. [Default:
  2387.                               5m]'
  2388.                             type: string
  2389.                         type: object
  2390.                       serviceAccount:
  2391.                         description: ServiceAccount enables and configures the service
  2392.                           account controller. Enabled by default, set to nil to disable.
  2393.                         properties:
  2394.                           reconcilerPeriod:
  2395.                             description: 'ReconcilerPeriod is the period to perform
  2396.                               reconciliation with the Calico datastore. [Default:
  2397.                               5m]'
  2398.                             type: string
  2399.                         type: object
  2400.                       workloadEndpoint:
  2401.                         description: WorkloadEndpoint enables and configures the workload
  2402.                           endpoint controller. Enabled by default, set to nil to disable.
  2403.                         properties:
  2404.                           reconcilerPeriod:
  2405.                             description: 'ReconcilerPeriod is the period to perform
  2406.                               reconciliation with the Calico datastore. [Default:
  2407.                               5m]'
  2408.                             type: string
  2409.                         type: object
  2410.                     type: object
  2411.                   etcdV3CompactionPeriod:
  2412.                     description: 'EtcdV3CompactionPeriod is the period between etcdv3
  2413.                       compaction requests. Set to 0 to disable. [Default: 10m]'
  2414.                     type: string
  2415.                   healthChecks:
  2416.                     description: 'HealthChecks enables or disables support for health
  2417.                       checks [Default: Enabled]'
  2418.                     type: string
  2419.                   logSeverityScreen:
  2420.                     description: 'LogSeverityScreen is the log severity above which
  2421.                       logs are sent to the stdout. [Default: Info]'
  2422.                     type: string
  2423.                   prometheusMetricsPort:
  2424.                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
  2425.                       metrics server should bind to. Set to 0 to disable. [Default:
  2426.                       9094]'
  2427.                     type: integer
  2428.                 required:
  2429.                 - controllers
  2430.                 type: object
  2431.             type: object
  2432.         type: object
  2433.     served: true
  2434.     storage: true
  2435. status:
  2436.   acceptedNames:
  2437.     kind: ""
  2438.     plural: ""
  2439.   conditions: []
  2440.   storedVersions: []
  2441.  
  2442. ---
  2443. apiVersion: apiextensions.k8s.io/v1
  2444. kind: CustomResourceDefinition
  2445. metadata:
  2446.   name: networkpolicies.crd.projectcalico.org
  2447. spec:
  2448.   group: crd.projectcalico.org
  2449.   names:
  2450.     kind: NetworkPolicy
  2451.     listKind: NetworkPolicyList
  2452.     plural: networkpolicies
  2453.     singular: networkpolicy
  2454.   scope: Namespaced
  2455.   versions:
  2456.   - name: v1
  2457.     schema:
  2458.       openAPIV3Schema:
  2459.         properties:
  2460.           apiVersion:
  2461.             description: 'APIVersion defines the versioned schema of this representation
  2462.               of an object. Servers should convert recognized schemas to the latest
  2463.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2464.             type: string
  2465.           kind:
  2466.             description: 'Kind is a string value representing the REST resource this
  2467.               object represents. Servers may infer this from the endpoint the client
  2468.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2469.             type: string
  2470.           metadata:
  2471.             type: object
  2472.           spec:
  2473.             properties:
  2474.               egress:
  2475.                 description: The ordered set of egress rules.  Each rule contains
  2476.                   a set of packet match criteria and a corresponding action to apply.
  2477.                 items:
  2478.                   description: "A Rule encapsulates a set of match criteria and an
  2479.                     action.  Both selector-based security Policy and security Profiles
  2480.                     reference rules - separated out as a list of rules for both ingress
  2481.                     and egress packet matching. \n Each positive match criteria has
  2482.                     a negated version, prefixed with \"Not\". All the match criteria
  2483.                     within a rule must be satisfied for a packet to match. A single
  2484.                     rule can contain the positive and negative version of a match
  2485.                     and both must be satisfied for the rule to match."
  2486.                   properties:
  2487.                     action:
  2488.                       type: string
  2489.                     destination:
  2490.                       description: Destination contains the match criteria that apply
  2491.                         to destination entity.
  2492.                       properties:
  2493.                         namespaceSelector:
  2494.                           description: "NamespaceSelector is an optional field that
  2495.                             contains a selector expression. Only traffic that originates
  2496.                             from (or terminates at) endpoints within the selected
  2497.                             namespaces will be matched. When both NamespaceSelector
  2498.                             and Selector are defined on the same rule, then only workload
  2499.                             endpoints that are matched by both selectors will be selected
  2500.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  2501.                             implies that the Selector is limited to selecting only
  2502.                             workload endpoints in the same namespace as the NetworkPolicy.
  2503.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  2504.                             that the Selector is limited to selecting only GlobalNetworkSet
  2505.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  2506.                             NamespaceSelector implies the Selector applies to workload
  2507.                             endpoints across all namespaces."
  2508.                           type: string
  2509.                         nets:
  2510.                           description: Nets is an optional field that restricts the
  2511.                             rule to only apply to traffic that originates from (or
  2512.                             terminates at) IP addresses in any of the given subnets.
  2513.                           items:
  2514.                             type: string
  2515.                           type: array
  2516.                         notNets:
  2517.                           description: NotNets is the negated version of the Nets
  2518.                             field.
  2519.                           items:
  2520.                             type: string
  2521.                           type: array
  2522.                         notPorts:
  2523.                           description: NotPorts is the negated version of the Ports
  2524.                             field. Since only some protocols have ports, if any ports
  2525.                             are specified it requires the Protocol match in the Rule
  2526.                             to be set to "TCP" or "UDP".
  2527.                           items:
  2528.                             anyOf:
  2529.                             - type: integer
  2530.                             - type: string
  2531.                             pattern: ^.*
  2532.                             x-kubernetes-int-or-string: true
  2533.                           type: array
  2534.                         notSelector:
  2535.                           description: NotSelector is the negated version of the Selector
  2536.                             field.  See Selector field for subtleties with negated
  2537.                             selectors.
  2538.                           type: string
  2539.                         ports:
  2540.                           description: "Ports is an optional field that restricts
  2541.                             the rule to only apply to traffic that has a source (destination)
  2542.                             port that matches one of these ranges/values. This value
  2543.                             is a list of integers or strings that represent ranges
  2544.                             of ports. \n Since only some protocols have ports, if
  2545.                             any ports are specified it requires the Protocol match
  2546.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  2547.                           items:
  2548.                             anyOf:
  2549.                             - type: integer
  2550.                             - type: string
  2551.                             pattern: ^.*
  2552.                             x-kubernetes-int-or-string: true
  2553.                           type: array
  2554.                         selector:
  2555.                           description: "Selector is an optional field that contains
  2556.                             a selector expression (see Policy for sample syntax).
  2557.                             \ Only traffic that originates from (terminates at) endpoints
  2558.                             matching the selector will be matched. \n Note that: in
  2559.                             addition to the negated version of the Selector (see NotSelector
  2560.                             below), the selector expression syntax itself supports
  2561.                             negation.  The two types of negation are subtly different.
  2562.                             One negates the set of matched endpoints, the other negates
  2563.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  2564.                             packets that are from other Calico-controlled \tendpoints
  2565.                             that do not have the label \"my_label\". \n \tNotSelector
  2566.                             = \"has(my_label)\" matches packets that are not from
  2567.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  2568.                             \n The effect is that the latter will accept packets from
  2569.                             non-Calico sources whereas the former is limited to packets
  2570.                             from Calico-controlled endpoints."
  2571.                           type: string
  2572.                         serviceAccounts:
  2573.                           description: ServiceAccounts is an optional field that restricts
  2574.                             the rule to only apply to traffic that originates from
  2575.                             (or terminates at) a pod running as a matching service
  2576.                             account.
  2577.                           properties:
  2578.                             names:
  2579.                               description: Names is an optional field that restricts
  2580.                                 the rule to only apply to traffic that originates
  2581.                                 from (or terminates at) a pod running as a service
  2582.                                 account whose name is in the list.
  2583.                               items:
  2584.                                 type: string
  2585.                               type: array
  2586.                             selector:
  2587.                               description: Selector is an optional field that restricts
  2588.                                 the rule to only apply to traffic that originates
  2589.                                 from (or terminates at) a pod running as a service
  2590.                                 account that matches the given label selector. If
  2591.                                 both Names and Selector are specified then they are
  2592.                                 AND'ed.
  2593.                               type: string
  2594.                           type: object
  2595.                       type: object
  2596.                     http:
  2597.                       description: HTTP contains match criteria that apply to HTTP
  2598.                         requests.
  2599.                       properties:
  2600.                         methods:
  2601.                           description: Methods is an optional field that restricts
  2602.                             the rule to apply only to HTTP requests that use one of
  2603.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  2604.                             methods are OR'd together.
  2605.                           items:
  2606.                             type: string
  2607.                           type: array
  2608.                         paths:
  2609.                           description: 'Paths is an optional field that restricts
  2610.                             the rule to apply to HTTP requests that use one of the
  2611.                             listed HTTP Paths. Multiple paths are OR''d together.
  2612.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  2613.                             ONLY specify either a `exact` or a `prefix` match. The
  2614.                             validator will check for it.'
  2615.                           items:
  2616.                             description: 'HTTPPath specifies an HTTP path to match.
  2617.                               It may be either of the form: exact: <path>: which matches
  2618.                               the path exactly or prefix: <path-prefix>: which matches
  2619.                               the path prefix'
  2620.                             properties:
  2621.                               exact:
  2622.                                 type: string
  2623.                               prefix:
  2624.                                 type: string
  2625.                             type: object
  2626.                           type: array
  2627.                       type: object
  2628.                     icmp:
  2629.                       description: ICMP is an optional field that restricts the rule
  2630.                         to apply to a specific type and code of ICMP traffic.  This
  2631.                         should only be specified if the Protocol field is set to "ICMP"
  2632.                         or "ICMPv6".
  2633.                       properties:
  2634.                         code:
  2635.                           description: Match on a specific ICMP code.  If specified,
  2636.                             the Type value must also be specified. This is a technical
  2637.                             limitation imposed by the kernel's iptables firewall,
  2638.                             which Calico uses to enforce the rule.
  2639.                           type: integer
  2640.                         type:
  2641.                           description: Match on a specific ICMP type.  For example
  2642.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2643.                           type: integer
  2644.                       type: object
  2645.                     ipVersion:
  2646.                       description: IPVersion is an optional field that restricts the
  2647.                         rule to only match a specific IP version.
  2648.                       type: integer
  2649.                     metadata:
  2650.                       description: Metadata contains additional information for this
  2651.                         rule
  2652.                       properties:
  2653.                         annotations:
  2654.                           additionalProperties:
  2655.                             type: string
  2656.                           description: Annotations is a set of key value pairs that
  2657.                             give extra information about the rule
  2658.                           type: object
  2659.                       type: object
  2660.                     notICMP:
  2661.                       description: NotICMP is the negated version of the ICMP field.
  2662.                       properties:
  2663.                         code:
  2664.                           description: Match on a specific ICMP code.  If specified,
  2665.                             the Type value must also be specified. This is a technical
  2666.                             limitation imposed by the kernel's iptables firewall,
  2667.                             which Calico uses to enforce the rule.
  2668.                           type: integer
  2669.                         type:
  2670.                           description: Match on a specific ICMP type.  For example
  2671.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2672.                           type: integer
  2673.                       type: object
  2674.                     notProtocol:
  2675.                       anyOf:
  2676.                       - type: integer
  2677.                       - type: string
  2678.                       description: NotProtocol is the negated version of the Protocol
  2679.                         field.
  2680.                       pattern: ^.*
  2681.                       x-kubernetes-int-or-string: true
  2682.                     protocol:
  2683.                       anyOf:
  2684.                       - type: integer
  2685.                       - type: string
  2686.                       description: "Protocol is an optional field that restricts the
  2687.                         rule to only apply to traffic of a specific IP protocol. Required
  2688.                         if any of the EntityRules contain Ports (because ports only
  2689.                         apply to certain protocols). \n Must be one of these string
  2690.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  2691.                         \"UDPLite\" or an integer in the range 1-255."
  2692.                       pattern: ^.*
  2693.                       x-kubernetes-int-or-string: true
  2694.                     source:
  2695.                       description: Source contains the match criteria that apply to
  2696.                         source entity.
  2697.                       properties:
  2698.                         namespaceSelector:
  2699.                           description: "NamespaceSelector is an optional field that
  2700.                             contains a selector expression. Only traffic that originates
  2701.                             from (or terminates at) endpoints within the selected
  2702.                             namespaces will be matched. When both NamespaceSelector
  2703.                             and Selector are defined on the same rule, then only workload
  2704.                             endpoints that are matched by both selectors will be selected
  2705.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  2706.                             implies that the Selector is limited to selecting only
  2707.                             workload endpoints in the same namespace as the NetworkPolicy.
  2708.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  2709.                             that the Selector is limited to selecting only GlobalNetworkSet
  2710.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  2711.                             NamespaceSelector implies the Selector applies to workload
  2712.                             endpoints across all namespaces."
  2713.                           type: string
  2714.                         nets:
  2715.                           description: Nets is an optional field that restricts the
  2716.                             rule to only apply to traffic that originates from (or
  2717.                             terminates at) IP addresses in any of the given subnets.
  2718.                           items:
  2719.                             type: string
  2720.                           type: array
  2721.                         notNets:
  2722.                           description: NotNets is the negated version of the Nets
  2723.                             field.
  2724.                           items:
  2725.                             type: string
  2726.                           type: array
  2727.                         notPorts:
  2728.                           description: NotPorts is the negated version of the Ports
  2729.                             field. Since only some protocols have ports, if any ports
  2730.                             are specified it requires the Protocol match in the Rule
  2731.                             to be set to "TCP" or "UDP".
  2732.                           items:
  2733.                             anyOf:
  2734.                             - type: integer
  2735.                             - type: string
  2736.                             pattern: ^.*
  2737.                             x-kubernetes-int-or-string: true
  2738.                           type: array
  2739.                         notSelector:
  2740.                           description: NotSelector is the negated version of the Selector
  2741.                             field.  See Selector field for subtleties with negated
  2742.                             selectors.
  2743.                           type: string
  2744.                         ports:
  2745.                           description: "Ports is an optional field that restricts
  2746.                             the rule to only apply to traffic that has a source (destination)
  2747.                             port that matches one of these ranges/values. This value
  2748.                             is a list of integers or strings that represent ranges
  2749.                             of ports. \n Since only some protocols have ports, if
  2750.                             any ports are specified it requires the Protocol match
  2751.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  2752.                           items:
  2753.                             anyOf:
  2754.                             - type: integer
  2755.                             - type: string
  2756.                             pattern: ^.*
  2757.                             x-kubernetes-int-or-string: true
  2758.                           type: array
  2759.                         selector:
  2760.                           description: "Selector is an optional field that contains
  2761.                             a selector expression (see Policy for sample syntax).
  2762.                             \ Only traffic that originates from (terminates at) endpoints
  2763.                             matching the selector will be matched. \n Note that: in
  2764.                             addition to the negated version of the Selector (see NotSelector
  2765.                             below), the selector expression syntax itself supports
  2766.                             negation.  The two types of negation are subtly different.
  2767.                             One negates the set of matched endpoints, the other negates
  2768.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  2769.                             packets that are from other Calico-controlled \tendpoints
  2770.                             that do not have the label \"my_label\". \n \tNotSelector
  2771.                             = \"has(my_label)\" matches packets that are not from
  2772.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  2773.                             \n The effect is that the latter will accept packets from
  2774.                             non-Calico sources whereas the former is limited to packets
  2775.                             from Calico-controlled endpoints."
  2776.                           type: string
  2777.                         serviceAccounts:
  2778.                           description: ServiceAccounts is an optional field that restricts
  2779.                             the rule to only apply to traffic that originates from
  2780.                             (or terminates at) a pod running as a matching service
  2781.                             account.
  2782.                           properties:
  2783.                             names:
  2784.                               description: Names is an optional field that restricts
  2785.                                 the rule to only apply to traffic that originates
  2786.                                 from (or terminates at) a pod running as a service
  2787.                                 account whose name is in the list.
  2788.                               items:
  2789.                                 type: string
  2790.                               type: array
  2791.                             selector:
  2792.                               description: Selector is an optional field that restricts
  2793.                                 the rule to only apply to traffic that originates
  2794.                                 from (or terminates at) a pod running as a service
  2795.                                 account that matches the given label selector. If
  2796.                                 both Names and Selector are specified then they are
  2797.                                 AND'ed.
  2798.                               type: string
  2799.                           type: object
  2800.                       type: object
  2801.                   required:
  2802.                   - action
  2803.                   type: object
  2804.                 type: array
  2805.               ingress:
  2806.                 description: The ordered set of ingress rules.  Each rule contains
  2807.                   a set of packet match criteria and a corresponding action to apply.
  2808.                 items:
  2809.                   description: "A Rule encapsulates a set of match criteria and an
  2810.                     action.  Both selector-based security Policy and security Profiles
  2811.                     reference rules - separated out as a list of rules for both ingress
  2812.                     and egress packet matching. \n Each positive match criteria has
  2813.                     a negated version, prefixed with \"Not\". All the match criteria
  2814.                     within a rule must be satisfied for a packet to match. A single
  2815.                     rule can contain the positive and negative version of a match
  2816.                     and both must be satisfied for the rule to match."
  2817.                   properties:
  2818.                     action:
  2819.                       type: string
  2820.                     destination:
  2821.                       description: Destination contains the match criteria that apply
  2822.                         to destination entity.
  2823.                       properties:
  2824.                         namespaceSelector:
  2825.                           description: "NamespaceSelector is an optional field that
  2826.                             contains a selector expression. Only traffic that originates
  2827.                             from (or terminates at) endpoints within the selected
  2828.                             namespaces will be matched. When both NamespaceSelector
  2829.                             and Selector are defined on the same rule, then only workload
  2830.                             endpoints that are matched by both selectors will be selected
  2831.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  2832.                             implies that the Selector is limited to selecting only
  2833.                             workload endpoints in the same namespace as the NetworkPolicy.
  2834.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  2835.                             that the Selector is limited to selecting only GlobalNetworkSet
  2836.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  2837.                             NamespaceSelector implies the Selector applies to workload
  2838.                             endpoints across all namespaces."
  2839.                           type: string
  2840.                         nets:
  2841.                           description: Nets is an optional field that restricts the
  2842.                             rule to only apply to traffic that originates from (or
  2843.                             terminates at) IP addresses in any of the given subnets.
  2844.                           items:
  2845.                             type: string
  2846.                           type: array
  2847.                         notNets:
  2848.                           description: NotNets is the negated version of the Nets
  2849.                             field.
  2850.                           items:
  2851.                             type: string
  2852.                           type: array
  2853.                         notPorts:
  2854.                           description: NotPorts is the negated version of the Ports
  2855.                             field. Since only some protocols have ports, if any ports
  2856.                             are specified it requires the Protocol match in the Rule
  2857.                             to be set to "TCP" or "UDP".
  2858.                           items:
  2859.                             anyOf:
  2860.                             - type: integer
  2861.                             - type: string
  2862.                             pattern: ^.*
  2863.                             x-kubernetes-int-or-string: true
  2864.                           type: array
  2865.                         notSelector:
  2866.                           description: NotSelector is the negated version of the Selector
  2867.                             field.  See Selector field for subtleties with negated
  2868.                             selectors.
  2869.                           type: string
  2870.                         ports:
  2871.                           description: "Ports is an optional field that restricts
  2872.                             the rule to only apply to traffic that has a source (destination)
  2873.                             port that matches one of these ranges/values. This value
  2874.                             is a list of integers or strings that represent ranges
  2875.                             of ports. \n Since only some protocols have ports, if
  2876.                             any ports are specified it requires the Protocol match
  2877.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  2878.                           items:
  2879.                             anyOf:
  2880.                             - type: integer
  2881.                             - type: string
  2882.                             pattern: ^.*
  2883.                             x-kubernetes-int-or-string: true
  2884.                           type: array
  2885.                         selector:
  2886.                           description: "Selector is an optional field that contains
  2887.                             a selector expression (see Policy for sample syntax).
  2888.                             \ Only traffic that originates from (terminates at) endpoints
  2889.                             matching the selector will be matched. \n Note that: in
  2890.                             addition to the negated version of the Selector (see NotSelector
  2891.                             below), the selector expression syntax itself supports
  2892.                             negation.  The two types of negation are subtly different.
  2893.                             One negates the set of matched endpoints, the other negates
  2894.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  2895.                             packets that are from other Calico-controlled \tendpoints
  2896.                             that do not have the label \"my_label\". \n \tNotSelector
  2897.                             = \"has(my_label)\" matches packets that are not from
  2898.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  2899.                             \n The effect is that the latter will accept packets from
  2900.                             non-Calico sources whereas the former is limited to packets
  2901.                             from Calico-controlled endpoints."
  2902.                           type: string
  2903.                         serviceAccounts:
  2904.                           description: ServiceAccounts is an optional field that restricts
  2905.                             the rule to only apply to traffic that originates from
  2906.                             (or terminates at) a pod running as a matching service
  2907.                             account.
  2908.                           properties:
  2909.                             names:
  2910.                               description: Names is an optional field that restricts
  2911.                                 the rule to only apply to traffic that originates
  2912.                                 from (or terminates at) a pod running as a service
  2913.                                 account whose name is in the list.
  2914.                               items:
  2915.                                 type: string
  2916.                               type: array
  2917.                             selector:
  2918.                               description: Selector is an optional field that restricts
  2919.                                 the rule to only apply to traffic that originates
  2920.                                 from (or terminates at) a pod running as a service
  2921.                                 account that matches the given label selector. If
  2922.                                 both Names and Selector are specified then they are
  2923.                                 AND'ed.
  2924.                               type: string
  2925.                           type: object
  2926.                       type: object
  2927.                     http:
  2928.                       description: HTTP contains match criteria that apply to HTTP
  2929.                         requests.
  2930.                       properties:
  2931.                         methods:
  2932.                           description: Methods is an optional field that restricts
  2933.                             the rule to apply only to HTTP requests that use one of
  2934.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  2935.                             methods are OR'd together.
  2936.                           items:
  2937.                             type: string
  2938.                           type: array
  2939.                         paths:
  2940.                           description: 'Paths is an optional field that restricts
  2941.                             the rule to apply to HTTP requests that use one of the
  2942.                             listed HTTP Paths. Multiple paths are OR''d together.
  2943.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  2944.                             ONLY specify either a `exact` or a `prefix` match. The
  2945.                             validator will check for it.'
  2946.                           items:
  2947.                             description: 'HTTPPath specifies an HTTP path to match.
  2948.                               It may be either of the form: exact: <path>: which matches
  2949.                               the path exactly or prefix: <path-prefix>: which matches
  2950.                               the path prefix'
  2951.                             properties:
  2952.                               exact:
  2953.                                 type: string
  2954.                               prefix:
  2955.                                 type: string
  2956.                             type: object
  2957.                           type: array
  2958.                       type: object
  2959.                     icmp:
  2960.                       description: ICMP is an optional field that restricts the rule
  2961.                         to apply to a specific type and code of ICMP traffic.  This
  2962.                         should only be specified if the Protocol field is set to "ICMP"
  2963.                         or "ICMPv6".
  2964.                       properties:
  2965.                         code:
  2966.                           description: Match on a specific ICMP code.  If specified,
  2967.                             the Type value must also be specified. This is a technical
  2968.                             limitation imposed by the kernel's iptables firewall,
  2969.                             which Calico uses to enforce the rule.
  2970.                           type: integer
  2971.                         type:
  2972.                           description: Match on a specific ICMP type.  For example
  2973.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2974.                           type: integer
  2975.                       type: object
  2976.                     ipVersion:
  2977.                       description: IPVersion is an optional field that restricts the
  2978.                         rule to only match a specific IP version.
  2979.                       type: integer
  2980.                     metadata:
  2981.                       description: Metadata contains additional information for this
  2982.                         rule
  2983.                       properties:
  2984.                         annotations:
  2985.                           additionalProperties:
  2986.                             type: string
  2987.                           description: Annotations is a set of key value pairs that
  2988.                             give extra information about the rule
  2989.                           type: object
  2990.                       type: object
  2991.                     notICMP:
  2992.                       description: NotICMP is the negated version of the ICMP field.
  2993.                       properties:
  2994.                         code:
  2995.                           description: Match on a specific ICMP code.  If specified,
  2996.                             the Type value must also be specified. This is a technical
  2997.                             limitation imposed by the kernel's iptables firewall,
  2998.                             which Calico uses to enforce the rule.
  2999.                           type: integer
  3000.                         type:
  3001.                           description: Match on a specific ICMP type.  For example
  3002.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  3003.                           type: integer
  3004.                       type: object
  3005.                     notProtocol:
  3006.                       anyOf:
  3007.                       - type: integer
  3008.                       - type: string
  3009.                       description: NotProtocol is the negated version of the Protocol
  3010.                         field.
  3011.                       pattern: ^.*
  3012.                       x-kubernetes-int-or-string: true
  3013.                     protocol:
  3014.                       anyOf:
  3015.                       - type: integer
  3016.                       - type: string
  3017.                       description: "Protocol is an optional field that restricts the
  3018.                         rule to only apply to traffic of a specific IP protocol. Required
  3019.                         if any of the EntityRules contain Ports (because ports only
  3020.                         apply to certain protocols). \n Must be one of these string
  3021.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  3022.                         \"UDPLite\" or an integer in the range 1-255."
  3023.                       pattern: ^.*
  3024.                       x-kubernetes-int-or-string: true
  3025.                     source:
  3026.                       description: Source contains the match criteria that apply to
  3027.                         source entity.
  3028.                       properties:
  3029.                         namespaceSelector:
  3030.                           description: "NamespaceSelector is an optional field that
  3031.                             contains a selector expression. Only traffic that originates
  3032.                             from (or terminates at) endpoints within the selected
  3033.                             namespaces will be matched. When both NamespaceSelector
  3034.                             and Selector are defined on the same rule, then only workload
  3035.                             endpoints that are matched by both selectors will be selected
  3036.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  3037.                             implies that the Selector is limited to selecting only
  3038.                             workload endpoints in the same namespace as the NetworkPolicy.
  3039.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  3040.                             that the Selector is limited to selecting only GlobalNetworkSet
  3041.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  3042.                             NamespaceSelector implies the Selector applies to workload
  3043.                             endpoints across all namespaces."
  3044.                           type: string
  3045.                         nets:
  3046.                           description: Nets is an optional field that restricts the
  3047.                             rule to only apply to traffic that originates from (or
  3048.                             terminates at) IP addresses in any of the given subnets.
  3049.                           items:
  3050.                             type: string
  3051.                           type: array
  3052.                         notNets:
  3053.                           description: NotNets is the negated version of the Nets
  3054.                             field.
  3055.                           items:
  3056.                             type: string
  3057.                           type: array
  3058.                         notPorts:
  3059.                           description: NotPorts is the negated version of the Ports
  3060.                             field. Since only some protocols have ports, if any ports
  3061.                             are specified it requires the Protocol match in the Rule
  3062.                             to be set to "TCP" or "UDP".
  3063.                           items:
  3064.                             anyOf:
  3065.                             - type: integer
  3066.                             - type: string
  3067.                             pattern: ^.*
  3068.                             x-kubernetes-int-or-string: true
  3069.                           type: array
  3070.                         notSelector:
  3071.                           description: NotSelector is the negated version of the Selector
  3072.                             field.  See Selector field for subtleties with negated
  3073.                             selectors.
  3074.                           type: string
  3075.                         ports:
  3076.                           description: "Ports is an optional field that restricts
  3077.                             the rule to only apply to traffic that has a source (destination)
  3078.                             port that matches one of these ranges/values. This value
  3079.                             is a list of integers or strings that represent ranges
  3080.                             of ports. \n Since only some protocols have ports, if
  3081.                             any ports are specified it requires the Protocol match
  3082.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  3083.                           items:
  3084.                             anyOf:
  3085.                             - type: integer
  3086.                             - type: string
  3087.                             pattern: ^.*
  3088.                             x-kubernetes-int-or-string: true
  3089.                           type: array
  3090.                         selector:
  3091.                           description: "Selector is an optional field that contains
  3092.                             a selector expression (see Policy for sample syntax).
  3093.                             \ Only traffic that originates from (terminates at) endpoints
  3094.                             matching the selector will be matched. \n Note that: in
  3095.                             addition to the negated version of the Selector (see NotSelector
  3096.                             below), the selector expression syntax itself supports
  3097.                             negation.  The two types of negation are subtly different.
  3098.                             One negates the set of matched endpoints, the other negates
  3099.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  3100.                             packets that are from other Calico-controlled \tendpoints
  3101.                             that do not have the label \"my_label\". \n \tNotSelector
  3102.                             = \"has(my_label)\" matches packets that are not from
  3103.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  3104.                             \n The effect is that the latter will accept packets from
  3105.                             non-Calico sources whereas the former is limited to packets
  3106.                             from Calico-controlled endpoints."
  3107.                           type: string
  3108.                         serviceAccounts:
  3109.                           description: ServiceAccounts is an optional field that restricts
  3110.                             the rule to only apply to traffic that originates from
  3111.                             (or terminates at) a pod running as a matching service
  3112.                             account.
  3113.                           properties:
  3114.                             names:
  3115.                               description: Names is an optional field that restricts
  3116.                                 the rule to only apply to traffic that originates
  3117.                                 from (or terminates at) a pod running as a service
  3118.                                 account whose name is in the list.
  3119.                               items:
  3120.                                 type: string
  3121.                               type: array
  3122.                             selector:
  3123.                               description: Selector is an optional field that restricts
  3124.                                 the rule to only apply to traffic that originates
  3125.                                 from (or terminates at) a pod running as a service
  3126.                                 account that matches the given label selector. If
  3127.                                 both Names and Selector are specified then they are
  3128.                                 AND'ed.
  3129.                               type: string
  3130.                           type: object
  3131.                       type: object
  3132.                   required:
  3133.                   - action
  3134.                   type: object
  3135.                 type: array
  3136.               order:
  3137.                 description: Order is an optional field that specifies the order in
  3138.                   which the policy is applied. Policies with higher "order" are applied
  3139.                   after those with lower order.  If the order is omitted, it may be
  3140.                   considered to be "infinite" - i.e. the policy will be applied last.  Policies
  3141.                   with identical order will be applied in alphanumerical order based
  3142.                   on the Policy "Name".
  3143.                 type: number
  3144.               selector:
  3145.                 description: "The selector is an expression used to pick pick out
  3146.                   the endpoints that the policy should be applied to. \n Selector
  3147.                   expressions follow this syntax: \n \tlabel == \"string_literal\"
  3148.                   \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
  3149.                   \  ->  not equal; also matches if label is not present \tlabel in
  3150.                   { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
  3151.                   one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
  3152.                   ... }  ->  true if the value of label X is not one of \"a\", \"b\",
  3153.                   \"c\" \thas(label_name)  -> True if that label is present \t! expr
  3154.                   -> negation of expr \texpr && expr  -> Short-circuit and \texpr
  3155.                   || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
  3156.                   or the empty selector -> matches all endpoints. \n Label names are
  3157.                   allowed to contain alphanumerics, -, _ and /. String literals are
  3158.                   more permissive but they do not support escape characters. \n Examples
  3159.                   (with made-up labels): \n \ttype == \"webserver\" && deployment
  3160.                   == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
  3161.                   \"dev\" \t! has(label_name)"
  3162.                 type: string
  3163.               serviceAccountSelector:
  3164.                 description: ServiceAccountSelector is an optional field for an expression
  3165.                   used to select a pod based on service accounts.
  3166.                 type: string
  3167.               types:
  3168.                 description: "Types indicates whether this policy applies to ingress,
  3169.                   or to egress, or to both.  When not explicitly specified (and so
  3170.                   the value on creation is empty or nil), Calico defaults Types according
  3171.                   to what Ingress and Egress are present in the policy.  The default
  3172.                   is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
  3173.                   the case where there are   also no Ingress rules) \n - [ PolicyTypeEgress
  3174.                   ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
  3175.                   PolicyTypeEgress ], if there are both Ingress and Egress rules.
  3176.                   \n When the policy is read back again, Types will always be one
  3177.                   of these values, never empty or nil."
  3178.                 items:
  3179.                   description: PolicyType enumerates the possible values of the PolicySpec
  3180.                     Types field.
  3181.                   type: string
  3182.                 type: array
  3183.             type: object
  3184.         type: object
  3185.     served: true
  3186.     storage: true
  3187. status:
  3188.   acceptedNames:
  3189.     kind: ""
  3190.     plural: ""
  3191.   conditions: []
  3192.   storedVersions: []
  3193.  
  3194. ---
  3195. apiVersion: apiextensions.k8s.io/v1
  3196. kind: CustomResourceDefinition
  3197. metadata:
  3198.   name: networksets.crd.projectcalico.org
  3199. spec:
  3200.   group: crd.projectcalico.org
  3201.   names:
  3202.     kind: NetworkSet
  3203.     listKind: NetworkSetList
  3204.     plural: networksets
  3205.     singular: networkset
  3206.   scope: Namespaced
  3207.   versions:
  3208.   - name: v1
  3209.     schema:
  3210.       openAPIV3Schema:
  3211.         description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet.
  3212.         properties:
  3213.           apiVersion:
  3214.             description: 'APIVersion defines the versioned schema of this representation
  3215.               of an object. Servers should convert recognized schemas to the latest
  3216.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  3217.             type: string
  3218.           kind:
  3219.             description: 'Kind is a string value representing the REST resource this
  3220.               object represents. Servers may infer this from the endpoint the client
  3221.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  3222.             type: string
  3223.           metadata:
  3224.             type: object
  3225.           spec:
  3226.             description: NetworkSetSpec contains the specification for a NetworkSet
  3227.               resource.
  3228.             properties:
  3229.               nets:
  3230.                 description: The list of IP networks that belong to this set.
  3231.                 items:
  3232.                   type: string
  3233.                 type: array
  3234.             type: object
  3235.         type: object
  3236.     served: true
  3237.     storage: true
  3238. status:
  3239.   acceptedNames:
  3240.     kind: ""
  3241.     plural: ""
  3242.   conditions: []
  3243.   storedVersions: []
  3244.  
  3245. ---
  3246. ---
  3247. # Source: calico/templates/calico-kube-controllers-rbac.yaml
  3248.  
  3249. # Include a clusterrole for the kube-controllers component,
  3250. # and bind it to the calico-kube-controllers serviceaccount.
  3251. kind: ClusterRole
  3252. apiVersion: rbac.authorization.k8s.io/v1
  3253. metadata:
  3254.   name: calico-kube-controllers
  3255. rules:
  3256.   # Nodes are watched to monitor for deletions.
  3257.   - apiGroups: [""]
  3258.     resources:
  3259.       - nodes
  3260.     verbs:
  3261.       - watch
  3262.       - list
  3263.       - get
  3264.   # Pods are queried to check for existence.
  3265.   - apiGroups: [""]
  3266.     resources:
  3267.       - pods
  3268.     verbs:
  3269.       - get
  3270.   # IPAM resources are manipulated when nodes are deleted.
  3271.   - apiGroups: ["crd.projectcalico.org"]
  3272.     resources:
  3273.       - ippools
  3274.     verbs:
  3275.       - list
  3276.   - apiGroups: ["crd.projectcalico.org"]
  3277.     resources:
  3278.       - blockaffinities
  3279.       - ipamblocks
  3280.       - ipamhandles
  3281.     verbs:
  3282.       - get
  3283.       - list
  3284.       - create
  3285.       - update
  3286.       - delete
  3287.       - watch
  3288.   # kube-controllers manages hostendpoints.
  3289.   - apiGroups: ["crd.projectcalico.org"]
  3290.     resources:
  3291.       - hostendpoints
  3292.     verbs:
  3293.       - get
  3294.       - list
  3295.       - create
  3296.       - update
  3297.       - delete
  3298.   # Needs access to update clusterinformations.
  3299.   - apiGroups: ["crd.projectcalico.org"]
  3300.     resources:
  3301.       - clusterinformations
  3302.     verbs:
  3303.       - get
  3304.       - create
  3305.       - update
  3306.   # KubeControllersConfiguration is where it gets its config
  3307.   - apiGroups: ["crd.projectcalico.org"]
  3308.     resources:
  3309.       - kubecontrollersconfigurations
  3310.     verbs:
  3311.       # read its own config
  3312.       - get
  3313.       # create a default if none exists
  3314.       - create
  3315.       # update status
  3316.       - update
  3317.       # watch for changes
  3318.       - watch
  3319. ---
  3320. kind: ClusterRoleBinding
  3321. apiVersion: rbac.authorization.k8s.io/v1
  3322. metadata:
  3323.   name: calico-kube-controllers
  3324. roleRef:
  3325.   apiGroup: rbac.authorization.k8s.io
  3326.   kind: ClusterRole
  3327.   name: calico-kube-controllers
  3328. subjects:
  3329. - kind: ServiceAccount
  3330.   name: calico-kube-controllers
  3331.   namespace: kube-system
  3332. ---
  3333.  
  3334. ---
  3335. # Source: calico/templates/calico-node-rbac.yaml
  3336. # Include a clusterrole for the calico-node DaemonSet,
  3337. # and bind it to the calico-node serviceaccount.
  3338. kind: ClusterRole
  3339. apiVersion: rbac.authorization.k8s.io/v1
  3340. metadata:
  3341.   name: calico-node
  3342. rules:
  3343.   # The CNI plugin needs to get pods, nodes, and namespaces.
  3344.   - apiGroups: [""]
  3345.     resources:
  3346.       - pods
  3347.       - nodes
  3348.       - namespaces
  3349.     verbs:
  3350.       - get
  3351.   - apiGroups: [""]
  3352.     resources:
  3353.       - endpoints
  3354.       - services
  3355.     verbs:
  3356.       # Used to discover service IPs for advertisement.
  3357.       - watch
  3358.       - list
  3359.       # Used to discover Typhas.
  3360.       - get
  3361.   # Pod CIDR auto-detection on kubeadm needs access to config maps.
  3362.   - apiGroups: [""]
  3363.     resources:
  3364.       - configmaps
  3365.     verbs:
  3366.       - get
  3367.   - apiGroups: [""]
  3368.     resources:
  3369.       - nodes/status
  3370.     verbs:
  3371.       # Needed for clearing NodeNetworkUnavailable flag.
  3372.       - patch
  3373.       # Calico stores some configuration information in node annotations.
  3374.       - update
  3375.   # Watch for changes to Kubernetes NetworkPolicies.
  3376.   - apiGroups: ["networking.k8s.io"]
  3377.     resources:
  3378.       - networkpolicies
  3379.     verbs:
  3380.       - watch
  3381.       - list
  3382.   # Used by Calico for policy information.
  3383.   - apiGroups: [""]
  3384.     resources:
  3385.       - pods
  3386.       - namespaces
  3387.       - serviceaccounts
  3388.     verbs:
  3389.       - list
  3390.       - watch
  3391.   # The CNI plugin patches pods/status.
  3392.   - apiGroups: [""]
  3393.     resources:
  3394.       - pods/status
  3395.     verbs:
  3396.       - patch
  3397.   # Calico monitors various CRDs for config.
  3398.   - apiGroups: ["crd.projectcalico.org"]
  3399.     resources:
  3400.       - globalfelixconfigs
  3401.       - felixconfigurations
  3402.       - bgppeers
  3403.       - globalbgpconfigs
  3404.       - bgpconfigurations
  3405.       - ippools
  3406.       - ipamblocks
  3407.       - globalnetworkpolicies
  3408.       - globalnetworksets
  3409.       - networkpolicies
  3410.       - networksets
  3411.       - clusterinformations
  3412.       - hostendpoints
  3413.       - blockaffinities
  3414.     verbs:
  3415.       - get
  3416.       - list
  3417.       - watch
  3418.   # Calico must create and update some CRDs on startup.
  3419.   - apiGroups: ["crd.projectcalico.org"]
  3420.     resources:
  3421.       - ippools
  3422.       - felixconfigurations
  3423.       - clusterinformations
  3424.     verbs:
  3425.       - create
  3426.       - update
  3427.   # Calico stores some configuration information on the node.
  3428.   - apiGroups: [""]
  3429.     resources:
  3430.       - nodes
  3431.     verbs:
  3432.       - get
  3433.       - list
  3434.       - watch
  3435.   # These permissions are only required for upgrade from v2.6, and can
  3436.   # be removed after upgrade or on fresh installations.
  3437.   - apiGroups: ["crd.projectcalico.org"]
  3438.     resources:
  3439.       - bgpconfigurations
  3440.       - bgppeers
  3441.     verbs:
  3442.       - create
  3443.       - update
  3444.   # These permissions are required for Calico CNI to perform IPAM allocations.
  3445.   - apiGroups: ["crd.projectcalico.org"]
  3446.     resources:
  3447.       - blockaffinities
  3448.       - ipamblocks
  3449.       - ipamhandles
  3450.     verbs:
  3451.       - get
  3452.       - list
  3453.       - create
  3454.       - update
  3455.       - delete
  3456.   - apiGroups: ["crd.projectcalico.org"]
  3457.     resources:
  3458.       - ipamconfigs
  3459.     verbs:
  3460.       - get
  3461.   # Block affinities must also be watchable by confd for route aggregation.
  3462.   - apiGroups: ["crd.projectcalico.org"]
  3463.     resources:
  3464.       - blockaffinities
  3465.     verbs:
  3466.       - watch
  3467.   # The Calico IPAM migration needs to get daemonsets. These permissions can be
  3468.   # removed if not upgrading from an installation using host-local IPAM.
  3469.   - apiGroups: ["apps"]
  3470.     resources:
  3471.       - daemonsets
  3472.     verbs:
  3473.       - get
  3474.  
  3475. ---
  3476. apiVersion: rbac.authorization.k8s.io/v1
  3477. kind: ClusterRoleBinding
  3478. metadata:
  3479.   name: calico-node
  3480. roleRef:
  3481.   apiGroup: rbac.authorization.k8s.io
  3482.   kind: ClusterRole
  3483.   name: calico-node
  3484. subjects:
  3485. - kind: ServiceAccount
  3486.   name: calico-node
  3487.   namespace: kube-system
  3488.  
  3489. ---
  3490. # Source: calico/templates/calico-node.yaml
  3491. # This manifest installs the calico-node container, as well
  3492. # as the CNI plugins and network config on
  3493. # each master and worker node in a Kubernetes cluster.
  3494. kind: DaemonSet
  3495. apiVersion: apps/v1
  3496. metadata:
  3497.   name: calico-node
  3498.   namespace: kube-system
  3499.   labels:
  3500.     k8s-app: calico-node
  3501. spec:
  3502.   selector:
  3503.     matchLabels:
  3504.       k8s-app: calico-node
  3505.   updateStrategy:
  3506.     type: RollingUpdate
  3507.     rollingUpdate:
  3508.       maxUnavailable: 1
  3509.   template:
  3510.     metadata:
  3511.       labels:
  3512.         k8s-app: calico-node
  3513.     spec:
  3514.       nodeSelector:
  3515.         kubernetes.io/os: linux
  3516.       hostNetwork: true
  3517.       tolerations:
  3518.         # Make sure calico-node gets scheduled on all nodes.
  3519.         - effect: NoSchedule
  3520.           operator: Exists
  3521.         # Mark the pod as a critical add-on for rescheduling.
  3522.         - key: CriticalAddonsOnly
  3523.           operator: Exists
  3524.         - effect: NoExecute
  3525.           operator: Exists
  3526.       serviceAccountName: calico-node
  3527.       # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
  3528.       # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
  3529.       terminationGracePeriodSeconds: 0
  3530.       priorityClassName: system-node-critical
  3531.       initContainers:
  3532.         # This container performs upgrade from host-local IPAM to calico-ipam.
  3533.         # It can be deleted if this is a fresh installation, or if you have already
  3534.         # upgraded to use calico-ipam.
  3535.         - name: upgrade-ipam
  3536.           image: docker.io/calico/cni:v3.18.0
  3537.           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
  3538.           envFrom:
  3539.           - configMapRef:
  3540.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
  3541.               name: kubernetes-services-endpoint
  3542.               optional: true
  3543.           env:
  3544.             - name: KUBERNETES_NODE_NAME
  3545.               valueFrom:
  3546.                 fieldRef:
  3547.                   fieldPath: spec.nodeName
  3548.             - name: CALICO_NETWORKING_BACKEND
  3549.               valueFrom:
  3550.                 configMapKeyRef:
  3551.                   name: calico-config
  3552.                   key: calico_backend
  3553.           volumeMounts:
  3554.             - mountPath: /var/lib/cni/networks
  3555.               name: host-local-net-dir
  3556.             - mountPath: /host/opt/cni/bin
  3557.               name: cni-bin-dir
  3558.           securityContext:
  3559.             privileged: true
  3560.         # This container installs the CNI binaries
  3561.         # and CNI network config file on each node.
  3562.         - name: install-cni
  3563.           image: docker.io/calico/cni:v3.18.0
  3564.           command: ["/opt/cni/bin/install"]
  3565.           envFrom:
  3566.           - configMapRef:
  3567.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
  3568.               name: kubernetes-services-endpoint
  3569.               optional: true
  3570.           env:
  3571.             # Name of the CNI config file to create.
  3572.             - name: CNI_CONF_NAME
  3573.               value: "10-calico.conflist"
  3574.             # The CNI network config to install on each node.
  3575.             - name: CNI_NETWORK_CONFIG
  3576.               valueFrom:
  3577.                 configMapKeyRef:
  3578.                   name: calico-config
  3579.                   key: cni_network_config
  3580.             # Set the hostname based on the k8s node name.
  3581.             - name: KUBERNETES_NODE_NAME
  3582.               valueFrom:
  3583.                 fieldRef:
  3584.                   fieldPath: spec.nodeName
  3585.             # CNI MTU Config variable
  3586.             - name: CNI_MTU
  3587.               valueFrom:
  3588.                 configMapKeyRef:
  3589.                   name: calico-config
  3590.                   key: veth_mtu
  3591.             # Prevents the container from sleeping forever.
  3592.             - name: SLEEP
  3593.               value: "false"
  3594.           volumeMounts:
  3595.             - mountPath: /host/opt/cni/bin
  3596.               name: cni-bin-dir
  3597.             - mountPath: /host/etc/cni/net.d
  3598.               name: cni-net-dir
  3599.           securityContext:
  3600.             privileged: true
  3601.         # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
  3602.         # to communicate with Felix over the Policy Sync API.
  3603.         - name: flexvol-driver
  3604.           image: docker.io/calico/pod2daemon-flexvol:v3.18.0
  3605.           volumeMounts:
  3606.           - name: flexvol-driver-host
  3607.             mountPath: /host/driver
  3608.           securityContext:
  3609.             privileged: true
  3610.       containers:
  3611.         # Runs calico-node container on each Kubernetes node. This
  3612.         # container programs network policy and routes on each
  3613.         # host.
  3614.         - name: calico-node
  3615.           image: docker.io/calico/node:v3.18.0
  3616.           envFrom:
  3617.           - configMapRef:
  3618.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
  3619.               name: kubernetes-services-endpoint
  3620.               optional: true
  3621.           env:
  3622.             # Use Kubernetes API as the backing datastore.
  3623.             - name: DATASTORE_TYPE
  3624.               value: "kubernetes"
  3625.             # Wait for the datastore.
  3626.             - name: WAIT_FOR_DATASTORE
  3627.               value: "true"
  3628.             # Set based on the k8s node name.
  3629.             - name: NODENAME
  3630.               valueFrom:
  3631.                 fieldRef:
  3632.                   fieldPath: spec.nodeName
  3633.             # Choose the backend to use.
  3634.             - name: CALICO_NETWORKING_BACKEND
  3635.               valueFrom:
  3636.                 configMapKeyRef:
  3637.                   name: calico-config
  3638.                   key: calico_backend
  3639.             # Cluster type to identify the deployment type
  3640.             - name: CLUSTER_TYPE
  3641.               value: "k8s,bgp"
  3642.             # Auto-detect the BGP IP address.
  3643.             - name: IP
  3644.               value: "autodetect"
  3645.             # Enable IPIP
  3646.             - name: CALICO_IPV4POOL_IPIP
  3647.               value: "Always"
  3648.             # Enable or Disable VXLAN on the default IP pool.
  3649.             - name: CALICO_IPV4POOL_VXLAN
  3650.               value: "Never"
  3651.             # Set MTU for tunnel device used if ipip is enabled
  3652.             - name: FELIX_IPINIPMTU
  3653.               valueFrom:
  3654.                 configMapKeyRef:
  3655.                   name: calico-config
  3656.                   key: veth_mtu
  3657.             # Set MTU for the VXLAN tunnel device.
  3658.             - name: FELIX_VXLANMTU
  3659.               valueFrom:
  3660.                 configMapKeyRef:
  3661.                   name: calico-config
  3662.                   key: veth_mtu
  3663.             # Set MTU for the Wireguard tunnel device.
  3664.             - name: FELIX_WIREGUARDMTU
  3665.               valueFrom:
  3666.                 configMapKeyRef:
  3667.                   name: calico-config
  3668.                   key: veth_mtu
  3669.             # The default IPv4 pool to create on startup if none exists. Pod IPs will be
  3670.             # chosen from this range. Changing this value after installation will have
  3671.             # no effect. This should fall within `--cluster-cidr`.
  3672.             # - name: CALICO_IPV4POOL_CIDR
  3673.             #   value: "192.168.0.0/16"
  3674.             # Disable file logging so `kubectl logs` works.
  3675.             - name: CALICO_DISABLE_FILE_LOGGING
  3676.               value: "true"
  3677.             # Set Felix endpoint to host default action to ACCEPT.
  3678.             - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
  3679.               value: "ACCEPT"
  3680.             # Disable IPv6 on Kubernetes.
  3681.             - name: FELIX_IPV6SUPPORT
  3682.               value: "false"
  3683.             # Set Felix logging to "info"
  3684.             - name: FELIX_LOGSEVERITYSCREEN
  3685.               value: "info"
  3686.             - name: FELIX_HEALTHENABLED
  3687.               value: "true"
  3688.           securityContext:
  3689.             privileged: true
  3690.           resources:
  3691.             requests:
  3692.               cpu: 250m
  3693.           livenessProbe:
  3694.             exec:
  3695.               command:
  3696.               - /bin/calico-node
  3697.               - -felix-live
  3698.               - -bird-live
  3699.             periodSeconds: 10
  3700.             initialDelaySeconds: 10
  3701.             failureThreshold: 6
  3702.           readinessProbe:
  3703.             exec:
  3704.               command:
  3705.               - /bin/calico-node
  3706.               - -felix-ready
  3707.               - -bird-ready
  3708.             periodSeconds: 10
  3709.           volumeMounts:
  3710.             - mountPath: /lib/modules
  3711.               name: lib-modules
  3712.               readOnly: true
  3713.             - mountPath: /run/xtables.lock
  3714.               name: xtables-lock
  3715.               readOnly: false
  3716.             - mountPath: /var/run/calico
  3717.               name: var-run-calico
  3718.               readOnly: false
  3719.             - mountPath: /var/lib/calico
  3720.               name: var-lib-calico
  3721.               readOnly: false
  3722.             - name: policysync
  3723.               mountPath: /var/run/nodeagent
  3724.             # For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the
  3725.             # parent directory.
  3726.             - name: sysfs
  3727.               mountPath: /sys/fs/
  3728.               # Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host.
  3729.               # If the host is known to mount that filesystem already then Bidirectional can be omitted.
  3730.               mountPropagation: Bidirectional
  3731.             - name: cni-log-dir
  3732.               mountPath: /var/log/calico/cni
  3733.               readOnly: true
  3734.       volumes:
  3735.         # Used by calico-node.
  3736.         - name: lib-modules
  3737.           hostPath:
  3738.             path: /lib/modules
  3739.         - name: var-run-calico
  3740.           hostPath:
  3741.             path: /var/run/calico
  3742.         - name: var-lib-calico
  3743.           hostPath:
  3744.             path: /var/lib/calico
  3745.         - name: xtables-lock
  3746.           hostPath:
  3747.             path: /run/xtables.lock
  3748.             type: FileOrCreate
  3749.         - name: sysfs
  3750.           hostPath:
  3751.             path: /sys/fs/
  3752.             type: DirectoryOrCreate
  3753.         # Used to install CNI.
  3754.         - name: cni-bin-dir
  3755.           hostPath:
  3756.             path: /opt/cni/bin
  3757.         - name: cni-net-dir
  3758.           hostPath:
  3759.             path: /etc/cni/net.d
  3760.         # Used to access CNI logs.
  3761.         - name: cni-log-dir
  3762.           hostPath:
  3763.             path: /var/log/calico/cni
  3764.         # Mount in the directory for host-local IPAM allocations. This is
  3765.         # used when upgrading from host-local to calico-ipam, and can be removed
  3766.         # if not using the upgrade-ipam init container.
  3767.         - name: host-local-net-dir
  3768.           hostPath:
  3769.             path: /var/lib/cni/networks
  3770.         # Used to create per-pod Unix Domain Sockets
  3771.         - name: policysync
  3772.           hostPath:
  3773.             type: DirectoryOrCreate
  3774.             path: /var/run/nodeagent
  3775.         # Used to install Flex Volume Driver
  3776.         - name: flexvol-driver-host
  3777.           hostPath:
  3778.             type: DirectoryOrCreate
  3779.             path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
  3780. ---
  3781.  
  3782. apiVersion: v1
  3783. kind: ServiceAccount
  3784. metadata:
  3785.   name: calico-node
  3786.   namespace: kube-system
  3787.  
  3788. ---
  3789. # Source: calico/templates/calico-kube-controllers.yaml
  3790. # See https://github.com/projectcalico/kube-controllers
  3791. apiVersion: apps/v1
  3792. kind: Deployment
  3793. metadata:
  3794.   name: calico-kube-controllers
  3795.   namespace: kube-system
  3796.   labels:
  3797.     k8s-app: calico-kube-controllers
  3798. spec:
  3799.   # The controllers can only have a single active instance.
  3800.   replicas: 1
  3801.   selector:
  3802.     matchLabels:
  3803.       k8s-app: calico-kube-controllers
  3804.   strategy:
  3805.     type: Recreate
  3806.   template:
  3807.     metadata:
  3808.       name: calico-kube-controllers
  3809.       namespace: kube-system
  3810.       labels:
  3811.         k8s-app: calico-kube-controllers
  3812.     spec:
  3813.       nodeSelector:
  3814.         kubernetes.io/os: linux
  3815.       tolerations:
  3816.         # Mark the pod as a critical add-on for rescheduling.
  3817.         - key: CriticalAddonsOnly
  3818.           operator: Exists
  3819.         - key: node-role.kubernetes.io/master
  3820.           effect: NoSchedule
  3821.       serviceAccountName: calico-kube-controllers
  3822.       priorityClassName: system-cluster-critical
  3823.       containers:
  3824.         - name: calico-kube-controllers
  3825.           image: docker.io/calico/kube-controllers:v3.18.0
  3826.           env:
  3827.             # Choose which controllers to run.
  3828.             - name: ENABLED_CONTROLLERS
  3829.               value: node
  3830.             - name: DATASTORE_TYPE
  3831.               value: kubernetes
  3832.           readinessProbe:
  3833.             exec:
  3834.               command:
  3835.               - /usr/bin/check-status
  3836.               - -r
  3837.  
  3838. ---
  3839.  
  3840. apiVersion: v1
  3841. kind: ServiceAccount
  3842. metadata:
  3843.   name: calico-kube-controllers
  3844.   namespace: kube-system
  3845.  
  3846. ---
  3847.  
  3848. # This manifest creates a Pod Disruption Budget for Controller to allow K8s Cluster Autoscaler to evict
  3849.  
  3850. apiVersion: policy/v1
  3851. kind: PodDisruptionBudget
  3852. metadata:
  3853.   name: calico-kube-controllers
  3854.   namespace: kube-system
  3855.   labels:
  3856.     k8s-app: calico-kube-controllers
  3857. spec:
  3858.   maxUnavailable: 1
  3859.   selector:
  3860.     matchLabels:
  3861.       k8s-app: calico-kube-controllers
  3862.  
  3863. ---
  3864. # Source: calico/templates/calico-etcd-secrets.yaml
  3865.  
  3866. ---
  3867. # Source: calico/templates/calico-typha.yaml
  3868.  
  3869. ---
  3870. # Source: calico/templates/configure-canal.yaml
  3871.  
  3872.

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/Gausst松鼠会/article/detail/315666
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号