devbox
凡人多烦事01
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

ARM架构部署k8s1.21.1_veth_mtu:0

作者：凡人多烦事01 | 2024-03-28 03:34:30

赞

踩

veth_mtu:0
  • Kubenetes:v1.21.1
  • docker:20.10.10
  • helm:v3.12.3
  • 操作系统：Bclinux-Euler
  • linux内核：4.19.90-2107.6.0.0192.8.oe1.bclinux.aarch64

参考文档

ARM架构下部署docker_docker arm_Ango_Cango的博客-CSDN博客

helm安装rancher(2.6.4)_wnfee的博客-CSDN博客

最新版V1.21.1版k8s,Kubeadm 安装部署_k8s1.21支持docker最新版本是20.10_学的好秃的早的博客-CSDN博客

配置基础环境

1.配置yum源
  1. #kubernetes yam源
  2. kubernetes.repo
  3. [kubernetes]
  4. name=Kubernetes
  5. baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-aarch64
  6. enabled=1
  7. gpgcheck=1
  8. repo_gpgcheck=1
  9. gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
  10.       http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
  11.  
  12. #BClinux Euler 自带yum源
  13. [OS]
  14. name=BC-Linux-release - OS
  15. baseurl=http://mirrors.cmecloud.cn/bclinux/oe21.10U3/OS/$basearch/
  16. gpgcheck=1
  17. enabled=1
  18. gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-BCLinux-For-Euler
  19.  
  20. [everything]
  21. name=BC-Linux-release - everything
  22. baseurl=http://mirrors.cmecloud.cn/bclinux/oe21.10U3/everything/$basearch/
  23. gpgcheck=1
  24. enabled=1
  25. gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-BCLinux-For-Euler
  26.  
  27.  
  28. [update]
  29. name=BC-Linux-release - update
  30. baseurl=http://mirrors.cmecloud.cn/bclinux/oe21.10U3/update/$basearch/
  31. gpgcheck=1
  32. enabled=1
  33. gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-BCLinux-For-Euler
  34.  
  35. [EPOL]
  36. name=EPOL
  37. baseurl=http://mirrors.cmecloud.cn/openeuler/openEuler-20.03-LTS-SP3/EPOL/main/$basearch/
  38. enabled=0
  39. gpgcheck=1
  40. gpgkey=http://mirrors.cmecloud.cn/openeuler/openEuler-20.03-LTS-SP3/OS/$basearch/RPM-GPG-KEY-openEuler
  41.  
  42. #华为Euler yum源
  43. [base]
  44. name=EulerOS-2.0SP8 base
  45. baseurl=http://mirrors.huaweicloud.com/euler/2.8/os/aarch64/
  46. enabled=1
  47. gpgcheck=1
  48. gpgkey=http://mirrors.huaweicloud.com/euler/2.8/os/RPM-GPG-KEY-EulerOS
  49.  
  50.
2.配置环境
  1. 1.修改主机名
  2. hostnamectl set-hostname
  3. 2.关闭selinnx swap
  4. sed -i s#SELINUX=enforcing#SELINUX=disabled# /etc/selinux/config    #永久关闭
  5. setenforce　0    #临时关闭
  6. 3.关闭防火墙
  7. systemctl stop firewalld 
  8. systemctl disable firewalld
  9. 4.关闭swap分区
  10. swapoff -a    #临时关闭
  11. 注释掉 /etc/fstab 文件中的 swap配置    #永久关闭
  12. 5.文件数配置
  13. ulimit -SHn 65535
  14. cat <<EOF >> /etc/security/limits.conf
  15. * soft nofile 655360
  16. * hard nofile 131072
  17. * soft nproc 655350
  18. * hard nproc 655350
  19. * soft memlock unlimited
  20. * hard memlock unlimited
  21. EOF
  22. 6.ipvs配置
  23. yum install ipvsadm ipset sysstat conntrack libseccomp -y
  24. modprobe -- ip_vs 
  25. modprobe -- ip_vs_rr 
  26. modprobe -- ip_vs_wrr 
  27. modprobe -- ip_vs_sh 
  28. modprobe -- nf_conntrack_ipv4     
  29.  
  30. cat >/etc/modules-load.d/ipvs.conf <<EOF 
  31. ip_vs 
  32. ip_vs_lc 
  33. ip_vs_wlc 
  34. ip_vs_rr 
  35. ip_vs_wrr 
  36. ip_vs_lblc 
  37. ip_vs_lblcr 
  38. ip_vs_dh 
  39. ip_vs_sh  
  40. ip_vs_nq 
  41. ip_vs_sed 
  42. ip_vs_ftp 
  43. ip_vs_sh 
  44. nf_conntrack_ipv4 
  45. ip_tables 
  46. ip_set 
  47. xt_set 
  48. ipt_set 
  49. ipt_rpfilter 
  50. ipt_REJECT 
  51. ipip 
  52. EOF
  53. systemctl enable systemd-modules-load.service && systemctl daemon-reload
  54. 7.内核优化
  55. cat <<EOF > /etc/sysctl.d/k8s.conf   
  56. net.ipv4.ip_forward = 1
  57. net.bridge.bridge-nf-call-iptables = 1
  58. net.bridge.bridge-nf-call-ip6tables = 1
  59. fs.may_detach_mounts = 1
  60. vm.overcommit_memory=1
  61. vm.panic_on_oom=0
  62. fs.inotify.max_user_watches=89100
  63. fs.file-max=52706963
  64. fs.nr_open=52706963
  65. net.netfilter.nf_conntrack_max=2310720
  66. net.ipv4.tcp_keepalive_time = 600
  67. net.ipv4.tcp_keepalive_probes = 3
  68. net.ipv4.tcp_keepalive_intvl =15
  69. net.ipv4.tcp_max_tw_buckets = 36000
  70. net.ipv4.tcp_tw_reuse = 1
  71. net.ipv4.tcp_max_orphans = 327680
  72. net.ipv4.tcp_orphan_retries = 3
  73. net.ipv4.tcp_syncookies = 1
  74. net.ipv4.tcp_max_syn_backlog = 16384
  75. net.ipv4.ip_conntrack_max = 131072
  76. net.ipv4.tcp_max_syn_backlog = 16384
  77. net.ipv4.tcp_timestamps = 0
  78. net.core.somaxconn = 16384
  79. EOF
  80. 8.docker daemon.json配置
  81. mkdir -p /etc/docker/
  82. tee /etc/docker/daemon.json <<-'EOF'
  83. {
  84.      "registry-mirrors": [
  85.         "https://docker.m.daocloud.io",
  86.         "https://dockerproxy.com",
  87.         "https://docker.mirrors.ustc.edu.cn",
  88.         "https://docker.nju.edu.cn",
  89.         "https://cvtby7bo.mirror.aliyuncs.com"],
  90.  "exec-opts": ["native.cgroupdriver=systemd"]
  91. }
  92. EOF
  93.  
  94. 注意：环境配置非全部适用，无法保证所有环境适配，尤其是国产化环境下谨慎选择！！！
 3.docker安装配置
  1. docker下载地址
  2. https://download.docker.com/linux/static/stable/aarch64/
  3.  
  4. #配置docker systemctl
  5. cat >/usr/lib/systemd/system/docker.service <<EOF 
  6. [Unit] 
  7. Description=Docker Application Container Engine 
  8. Documentation=http://docs.docker.com 
  9. After=network.target docker.socket 
  10. [Service] 
  11. Type=notify 
  12. EnvironmentFile=-/run/flannel/docker 
  13. WorkingDirectory=/usr/local/bin 
  14. ExecStart=/usr/bin/dockerd  -H tcp://0.0.0.0:4243 -H unix:///var/run/docker.sock --selinux-enabled=false --log-opt max-size=1g 
  15. ExecReload=/bin/kill -s HUP $MAINPID 
  16. # Having non-zero Limit*s causes performance problems due to accounting overhead 
  17. # in the kernel. We recommend using cgroups to do container-local accounting. 
  18. LimitNOFILE=infinity 
  19. LimitNPROC=infinity 
  20. LimitCORE=infinity 
  21. # Uncomment TasksMax if your systemd version supports it. 
  22. # Only systemd 226 and above support this version. 
  23. #TasksMax=infinity 
  24. TimeoutStartSec=0 
  25. # set delegate yes so that systemd does not reset the cgroups of docker containers 
  26. Delegate=yes 
  27. # kill only the docker process, not all processes in the cgroup 
  28. KillMode=process 
  29. Restart=on-failure 
  30. [Install] 
  31. WantedBy=multi-user.target 
  32. EOF
  33. #启动docker
  34. systemctl start docker
  35. docker info

K8s1.21.1部署 

1.部署k8s
  1. #yum安装kubeadm kubectl kubelet
  2. yum -y install kubeadm-1.21.1 kubectl-1.21.1 kubelet-1.21.1
  3.  
  4. #下载国内k8s镜像
  5. kubeadm config images pull --image-repository registry.aliyuncs.com/google_containers --kubernetes-version v1.21.1
  6.  
  7. 注意：cronedns会有问题，把cronedns/cronedns改成cronedns
  8.  
  9. #镜像打标签，也可以不打指定镜像仓库来部署使用
  10. docker tag registry.aliyuncs.com/google_containers/kube-apiserver:v1.21.1  k8s.gcr.io/kube-apiserver:v1.21.1				
  11. docker tag registry.aliyuncs.com/google_containers/kube-proxy:v1.21.1  k8s.gcr.io/kube-proxy:v1.21.1					
  12. docker tag registry.aliyuncs.com/google_containers/kube-controller-manager:v1.21.1  k8s.gcr.io/kube-controller-manager:v1.21.1
  13. docker tag registry.aliyuncs.com/google_containers/kube-scheduler:v1.21.1  k8s.gcr.io/kube-scheduler:v1.21.1
  14. docker tag registry.aliyuncs.com/google_containers/pause:3.4.1  k8s.gcr.io/pause:3.4.1
  15. docker tag registry.aliyuncs.com/google_containers/coredns:v1.8.0  k8s.gcr.io/coredns/coredns:v1.8.0
  16. docker tag registry.aliyuncs.com/google_containers/etcd:3.4.13-0  k8s.gcr.io/etcd:3.4.13-0
  17.  
  18. #删除旧镜像
  19. docker images | grep registry.aliyuncs.com | awk '{print $1":"$2}' | xargs docker rmi -f
  20.  
  21. #初始化节点 kubeadm
  22. kubeadm init \
  23. --apiserver-advertise-address=192.168.229.29 \
  24. --kubernetes-version v1.21.1 \
  25. --service-cidr=10.96.0.0/12 \
  26. --pod-network-cidr=10.244.0.0/16 \
  27. --service-dns-domain=cluster.local \
  28. --upload-certs \
  29. --v=5
  30.  
  31. #解决node节点8080问题
  32. scp /etc/kubernetes/admin.conf root@k8s-node:/etc/kubernetes/admin.conf
  33. node节点执行：
  34. echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bash_profile
  35. source ~/.bash_profile
  36.  
  37. #kubectl支持补全
  38. yum install -y bash-completion	
  39. echo 'source  <(kubectl completion bash)' >>/root/.bashrc
  40. source /root/.bashrc
2.部署网络插件calico

 - name: IP_AUTODETECTION_METHOD

   value: "interface=eth0"        #国产化网卡名称不一样，注意修改

 - name: CALICO_IPV4POOL_CIDR

   value: "10.244.0.0/16"        #要跟init时候配置一致

calico/pod2daemon-flexvolv3.17.185a7dc8c60a0
calico/cniv3.17.15605570997cc
calico/nodev3.17.1723ee8f82f0e

vim Calico.yaml

kubectl apply -f Calico.yaml

  1. ---
  2. # Source: calico/templates/calico-config.yaml
  3. # This ConfigMap is used to configure a self-hosted Calico installation.
  4. kind: ConfigMap
  5. apiVersion: v1
  6. metadata:
  7.   name: calico-config
  8.   namespace: kube-system
  9. data:
  10.   # Typha is disabled.
  11.   typha_service_name: "none"
  12.   # Configure the backend to use.
  13.   calico_backend: "bird"
  14.  
  15.   # Configure the MTU to use for workload interfaces and tunnels.
  16.   # By default, MTU is auto-detected, and explicitly setting this field should not be required.
  17.   # You can override auto-detection by providing a non-zero value.
  18.   veth_mtu: "0"
  19.  
  20.   # The CNI network configuration to install on each node. The special
  21.   # values in this config will be automatically populated.
  22.   cni_network_config: |-
  23.     {
  24.       "name": "k8s-pod-network",
  25.       "cniVersion": "0.3.1",
  26.       "plugins": [
  27.         {
  28.           "type": "calico",
  29.           "log_level": "info",
  30.           "log_file_path": "/var/log/calico/cni/cni.log",
  31.           "datastore_type": "kubernetes",
  32.           "nodename": "__KUBERNETES_NODE_NAME__",
  33.           "mtu": __CNI_MTU__,
  34.           "ipam": {
  35.               "type": "calico-ipam"
  36.           },
  37.           "policy": {
  38.               "type": "k8s"
  39.           },
  40.           "kubernetes": {
  41.               "kubeconfig": "__KUBECONFIG_FILEPATH__"
  42.           }
  43.         },
  44.         {
  45.           "type": "portmap",
  46.           "snat": true,
  47.           "capabilities": {"portMappings": true}
  48.         },
  49.         {
  50.           "type": "bandwidth",
  51.           "capabilities": {"bandwidth": true}
  52.         }
  53.       ]
  54.     }
  55.  
  56. ---
  57. # Source: calico/templates/kdd-crds.yaml
  58.  
  59. apiVersion: apiextensions.k8s.io/v1
  60. kind: CustomResourceDefinition
  61. metadata:
  62.   name: bgpconfigurations.crd.projectcalico.org
  63. spec:
  64.   group: crd.projectcalico.org
  65.   names:
  66.     kind: BGPConfiguration
  67.     listKind: BGPConfigurationList
  68.     plural: bgpconfigurations
  69.     singular: bgpconfiguration
  70.   scope: Cluster
  71.   versions:
  72.   - name: v1
  73.     schema:
  74.       openAPIV3Schema:
  75.         description: BGPConfiguration contains the configuration for any BGP routing.
  76.         properties:
  77.           apiVersion:
  78.             description: 'APIVersion defines the versioned schema of this representation
  79.               of an object. Servers should convert recognized schemas to the latest
  80.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  81.             type: string
  82.           kind:
  83.             description: 'Kind is a string value representing the REST resource this
  84.               object represents. Servers may infer this from the endpoint the client
  85.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  86.             type: string
  87.           metadata:
  88.             type: object
  89.           spec:
  90.             description: BGPConfigurationSpec contains the values of the BGP configuration.
  91.             properties:
  92.               asNumber:
  93.                 description: 'ASNumber is the default AS number used by a node. [Default:
  94.                   64512]'
  95.                 format: int32
  96.                 type: integer
  97.               communities:
  98.                 description: Communities is a list of BGP community values and their
  99.                   arbitrary names for tagging routes.
  100.                 items:
  101.                   description: Community contains standard or large community value
  102.                     and its name.
  103.                   properties:
  104.                     name:
  105.                       description: Name given to community value.
  106.                       type: string
  107.                     value:
  108.                       description: Value must be of format `aa:nn` or `aa:nn:mm`.
  109.                         For standard community use `aa:nn` format, where `aa` and
  110.                         `nn` are 16 bit number. For large community use `aa:nn:mm`
  111.                         format, where `aa`, `nn` and `mm` are 32 bit number. Where,
  112.                         `aa` is an AS Number, `nn` and `mm` are per-AS identifier.
  113.                       pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$
  114.                       type: string
  115.                   type: object
  116.                 type: array
  117.               listenPort:
  118.                 description: ListenPort is the port where BGP protocol should listen.
  119.                   Defaults to 179
  120.                 maximum: 65535
  121.                 minimum: 1
  122.                 type: integer
  123.               logSeverityScreen:
  124.                 description: 'LogSeverityScreen is the log severity above which logs
  125.                   are sent to the stdout. [Default: INFO]'
  126.                 type: string
  127.               nodeToNodeMeshEnabled:
  128.                 description: 'NodeToNodeMeshEnabled sets whether full node to node
  129.                   BGP mesh is enabled. [Default: true]'
  130.                 type: boolean
  131.               prefixAdvertisements:
  132.                 description: PrefixAdvertisements contains per-prefix advertisement
  133.                   configuration.
  134.                 items:
  135.                   description: PrefixAdvertisement configures advertisement properties
  136.                     for the specified CIDR.
  137.                   properties:
  138.                     cidr:
  139.                       description: CIDR for which properties should be advertised.
  140.                       type: string
  141.                     communities:
  142.                       description: Communities can be list of either community names
  143.                         already defined in `Specs.Communities` or community value
  144.                         of format `aa:nn` or `aa:nn:mm`. For standard community use
  145.                         `aa:nn` format, where `aa` and `nn` are 16 bit number. For
  146.                         large community use `aa:nn:mm` format, where `aa`, `nn` and
  147.                         `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and
  148.                         `mm` are per-AS identifier.
  149.                       items:
  150.                         type: string
  151.                       type: array
  152.                   type: object
  153.                 type: array
  154.               serviceClusterIPs:
  155.                 description: ServiceClusterIPs are the CIDR blocks from which service
  156.                   cluster IPs are allocated. If specified, Calico will advertise these
  157.                   blocks, as well as any cluster IPs within them.
  158.                 items:
  159.                   description: ServiceClusterIPBlock represents a single allowed ClusterIP
  160.                     CIDR block.
  161.                   properties:
  162.                     cidr:
  163.                       type: string
  164.                   type: object
  165.                 type: array
  166.               serviceExternalIPs:
  167.                 description: ServiceExternalIPs are the CIDR blocks for Kubernetes
  168.                   Service External IPs. Kubernetes Service ExternalIPs will only be
  169.                   advertised if they are within one of these blocks.
  170.                 items:
  171.                   description: ServiceExternalIPBlock represents a single allowed
  172.                     External IP CIDR block.
  173.                   properties:
  174.                     cidr:
  175.                       type: string
  176.                   type: object
  177.                 type: array
  178.             type: object
  179.         type: object
  180.     served: true
  181.     storage: true
  182. status:
  183.   acceptedNames:
  184.     kind: ""
  185.     plural: ""
  186.   conditions: []
  187.   storedVersions: []
  188.  
  189. ---
  190. apiVersion: apiextensions.k8s.io/v1
  191. kind: CustomResourceDefinition
  192. metadata:
  193.   name: bgppeers.crd.projectcalico.org
  194. spec:
  195.   group: crd.projectcalico.org
  196.   names:
  197.     kind: BGPPeer
  198.     listKind: BGPPeerList
  199.     plural: bgppeers
  200.     singular: bgppeer
  201.   scope: Cluster
  202.   versions:
  203.   - name: v1
  204.     schema:
  205.       openAPIV3Schema:
  206.         properties:
  207.           apiVersion:
  208.             description: 'APIVersion defines the versioned schema of this representation
  209.               of an object. Servers should convert recognized schemas to the latest
  210.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  211.             type: string
  212.           kind:
  213.             description: 'Kind is a string value representing the REST resource this
  214.               object represents. Servers may infer this from the endpoint the client
  215.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  216.             type: string
  217.           metadata:
  218.             type: object
  219.           spec:
  220.             description: BGPPeerSpec contains the specification for a BGPPeer resource.
  221.             properties:
  222.               asNumber:
  223.                 description: The AS Number of the peer.
  224.                 format: int32
  225.                 type: integer
  226.               keepOriginalNextHop:
  227.                 description: Option to keep the original nexthop field when routes
  228.                   are sent to a BGP Peer. Setting "true" configures the selected BGP
  229.                   Peers node to use the "next hop keep;" instead of "next hop self;"(default)
  230.                   in the specific branch of the Node on "bird.cfg".
  231.                 type: boolean
  232.               node:
  233.                 description: The node name identifying the Calico node instance that
  234.                   is targeted by this peer. If this is not set, and no nodeSelector
  235.                   is specified, then this BGP peer selects all nodes in the cluster.
  236.                 type: string
  237.               nodeSelector:
  238.                 description: Selector for the nodes that should have this peering.  When
  239.                   this is set, the Node field must be empty.
  240.                 type: string
  241.               password:
  242.                 description: Optional BGP password for the peerings generated by this
  243.                   BGPPeer resource.
  244.                 properties:
  245.                   secretKeyRef:
  246.                     description: Selects a key of a secret in the node pod's namespace.
  247.                     properties:
  248.                       key:
  249.                         description: The key of the secret to select from.  Must be
  250.                           a valid secret key.
  251.                         type: string
  252.                       name:
  253.                         description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  254.                           TODO: Add other useful fields. apiVersion, kind, uid?'
  255.                         type: string
  256.                       optional:
  257.                         description: Specify whether the Secret or its key must be
  258.                           defined
  259.                         type: boolean
  260.                     required:
  261.                     - key
  262.                     type: object
  263.                 type: object
  264.               peerIP:
  265.                 description: The IP address of the peer followed by an optional port
  266.                   number to peer with. If port number is given, format should be `[<IPv6>]:port`
  267.                   or `<IPv4>:<port>` for IPv4. If optional port number is not set,
  268.                   and this peer IP and ASNumber belongs to a calico/node with ListenPort
  269.                   set in BGPConfiguration, then we use that port to peer.
  270.                 type: string
  271.               peerSelector:
  272.                 description: Selector for the remote nodes to peer with.  When this
  273.                   is set, the PeerIP and ASNumber fields must be empty.  For each
  274.                   peering between the local node and selected remote nodes, we configure
  275.                   an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified,
  276.                   and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified.  The
  277.                   remote AS number comes from the remote node's NodeBGPSpec.ASNumber,
  278.                   or the global default if that is not set.
  279.                 type: string
  280.             type: object
  281.         type: object
  282.     served: true
  283.     storage: true
  284. status:
  285.   acceptedNames:
  286.     kind: ""
  287.     plural: ""
  288.   conditions: []
  289.   storedVersions: []
  290.  
  291. ---
  292. apiVersion: apiextensions.k8s.io/v1
  293. kind: CustomResourceDefinition
  294. metadata:
  295.   name: blockaffinities.crd.projectcalico.org
  296. spec:
  297.   group: crd.projectcalico.org
  298.   names:
  299.     kind: BlockAffinity
  300.     listKind: BlockAffinityList
  301.     plural: blockaffinities
  302.     singular: blockaffinity
  303.   scope: Cluster
  304.   versions:
  305.   - name: v1
  306.     schema:
  307.       openAPIV3Schema:
  308.         properties:
  309.           apiVersion:
  310.             description: 'APIVersion defines the versioned schema of this representation
  311.               of an object. Servers should convert recognized schemas to the latest
  312.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  313.             type: string
  314.           kind:
  315.             description: 'Kind is a string value representing the REST resource this
  316.               object represents. Servers may infer this from the endpoint the client
  317.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  318.             type: string
  319.           metadata:
  320.             type: object
  321.           spec:
  322.             description: BlockAffinitySpec contains the specification for a BlockAffinity
  323.               resource.
  324.             properties:
  325.               cidr:
  326.                 type: string
  327.               deleted:
  328.                 description: Deleted indicates that this block affinity is being deleted.
  329.                   This field is a string for compatibility with older releases that
  330.                   mistakenly treat this field as a string.
  331.                 type: string
  332.               node:
  333.                 type: string
  334.               state:
  335.                 type: string
  336.             required:
  337.             - cidr
  338.             - deleted
  339.             - node
  340.             - state
  341.             type: object
  342.         type: object
  343.     served: true
  344.     storage: true
  345. status:
  346.   acceptedNames:
  347.     kind: ""
  348.     plural: ""
  349.   conditions: []
  350.   storedVersions: []
  351.  
  352. ---
  353. apiVersion: apiextensions.k8s.io/v1
  354. kind: CustomResourceDefinition
  355. metadata:
  356.   name: clusterinformations.crd.projectcalico.org
  357. spec:
  358.   group: crd.projectcalico.org
  359.   names:
  360.     kind: ClusterInformation
  361.     listKind: ClusterInformationList
  362.     plural: clusterinformations
  363.     singular: clusterinformation
  364.   scope: Cluster
  365.   versions:
  366.   - name: v1
  367.     schema:
  368.       openAPIV3Schema:
  369.         description: ClusterInformation contains the cluster specific information.
  370.         properties:
  371.           apiVersion:
  372.             description: 'APIVersion defines the versioned schema of this representation
  373.               of an object. Servers should convert recognized schemas to the latest
  374.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  375.             type: string
  376.           kind:
  377.             description: 'Kind is a string value representing the REST resource this
  378.               object represents. Servers may infer this from the endpoint the client
  379.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  380.             type: string
  381.           metadata:
  382.             type: object
  383.           spec:
  384.             description: ClusterInformationSpec contains the values of describing
  385.               the cluster.
  386.             properties:
  387.               calicoVersion:
  388.                 description: CalicoVersion is the version of Calico that the cluster
  389.                   is running
  390.                 type: string
  391.               clusterGUID:
  392.                 description: ClusterGUID is the GUID of the cluster
  393.                 type: string
  394.               clusterType:
  395.                 description: ClusterType describes the type of the cluster
  396.                 type: string
  397.               datastoreReady:
  398.                 description: DatastoreReady is used during significant datastore migrations
  399.                   to signal to components such as Felix that it should wait before
  400.                   accessing the datastore.
  401.                 type: boolean
  402.               variant:
  403.                 description: Variant declares which variant of Calico should be active.
  404.                 type: string
  405.             type: object
  406.         type: object
  407.     served: true
  408.     storage: true
  409. status:
  410.   acceptedNames:
  411.     kind: ""
  412.     plural: ""
  413.   conditions: []
  414.   storedVersions: []
  415.  
  416. ---
  417. apiVersion: apiextensions.k8s.io/v1
  418. kind: CustomResourceDefinition
  419. metadata:
  420.   name: felixconfigurations.crd.projectcalico.org
  421. spec:
  422.   group: crd.projectcalico.org
  423.   names:
  424.     kind: FelixConfiguration
  425.     listKind: FelixConfigurationList
  426.     plural: felixconfigurations
  427.     singular: felixconfiguration
  428.   scope: Cluster
  429.   versions:
  430.   - name: v1
  431.     schema:
  432.       openAPIV3Schema:
  433.         description: Felix Configuration contains the configuration for Felix.
  434.         properties:
  435.           apiVersion:
  436.             description: 'APIVersion defines the versioned schema of this representation
  437.               of an object. Servers should convert recognized schemas to the latest
  438.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  439.             type: string
  440.           kind:
  441.             description: 'Kind is a string value representing the REST resource this
  442.               object represents. Servers may infer this from the endpoint the client
  443.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  444.             type: string
  445.           metadata:
  446.             type: object
  447.           spec:
  448.             description: FelixConfigurationSpec contains the values of the Felix configuration.
  449.             properties:
  450.               allowIPIPPacketsFromWorkloads:
  451.                 description: 'AllowIPIPPacketsFromWorkloads controls whether Felix
  452.                   will add a rule to drop IPIP encapsulated traffic from workloads
  453.                   [Default: false]'
  454.                 type: boolean
  455.               allowVXLANPacketsFromWorkloads:
  456.                 description: 'AllowVXLANPacketsFromWorkloads controls whether Felix
  457.                   will add a rule to drop VXLAN encapsulated traffic from workloads
  458.                   [Default: false]'
  459.                 type: boolean
  460.               awsSrcDstCheck:
  461.                 description: 'Set source-destination-check on AWS EC2 instances. Accepted
  462.                   value must be one of "DoNothing", "Enabled" or "Disabled". [Default:
  463.                   DoNothing]'
  464.                 enum:
  465.                 - DoNothing
  466.                 - Enable
  467.                 - Disable
  468.                 type: string
  469.               bpfConnectTimeLoadBalancingEnabled:
  470.                 description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode,
  471.                   controls whether Felix installs the connection-time load balancer.  The
  472.                   connect-time load balancer is required for the host to be able to
  473.                   reach Kubernetes services and it improves the performance of pod-to-service
  474.                   connections.  The only reason to disable it is for debugging purposes.  [Default:
  475.                   true]'
  476.                 type: boolean
  477.               bpfDataIfacePattern:
  478.                 description: BPFDataIfacePattern is a regular expression that controls
  479.                   which interfaces Felix should attach BPF programs to in order to
  480.                   catch traffic to/from the network.  This needs to match the interfaces
  481.                   that Calico workload traffic flows over as well as any interfaces
  482.                   that handle incoming traffic to nodeports and services from outside
  483.                   the cluster.  It should not match the workload interfaces (usually
  484.                   named cali...).
  485.                 type: string
  486.               bpfDisableUnprivileged:
  487.                 description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled
  488.                   sysctl to disable unprivileged use of BPF.  This ensures that unprivileged
  489.                   users cannot access Calico''s BPF maps and cannot insert their own
  490.                   BPF programs to interfere with Calico''s. [Default: true]'
  491.                 type: boolean
  492.               bpfEnabled:
  493.                 description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
  494.                   [Default: false]'
  495.                 type: boolean
  496.               bpfExternalServiceMode:
  497.                 description: 'BPFExternalServiceMode in BPF mode, controls how connections
  498.                   from outside the cluster to services (node ports and cluster IPs)
  499.                   are forwarded to remote workloads.  If set to "Tunnel" then both
  500.                   request and response traffic is tunneled to the remote node.  If
  501.                   set to "DSR", the request traffic is tunneled but the response traffic
  502.                   is sent directly from the remote node.  In "DSR" mode, the remote
  503.                   node appears to use the IP of the ingress node; this requires a
  504.                   permissive L2 network.  [Default: Tunnel]'
  505.                 type: string
  506.               bpfKubeProxyEndpointSlicesEnabled:
  507.                 description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
  508.                   whether Felix's embedded kube-proxy accepts EndpointSlices or not.
  509.                 type: boolean
  510.               bpfKubeProxyIptablesCleanupEnabled:
  511.                 description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF
  512.                   mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s
  513.                   iptables chains.  Should only be enabled if kube-proxy is not running.  [Default:
  514.                   true]'
  515.                 type: boolean
  516.               bpfKubeProxyMinSyncPeriod:
  517.                 description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the
  518.                   minimum time between updates to the dataplane for Felix''s embedded
  519.                   kube-proxy.  Lower values give reduced set-up latency.  Higher values
  520.                   reduce Felix CPU usage by batching up more work.  [Default: 1s]'
  521.                 type: string
  522.               bpfLogLevel:
  523.                 description: 'BPFLogLevel controls the log level of the BPF programs
  524.                   when in BPF dataplane mode.  One of "Off", "Info", or "Debug".  The
  525.                   logs are emitted to the BPF trace pipe, accessible with the command
  526.                   `tc exec bpf debug`. [Default: Off].'
  527.                 type: string
  528.               chainInsertMode:
  529.                 description: 'ChainInsertMode controls whether Felix hooks the kernel''s
  530.                   top-level iptables chains by inserting a rule at the top of the
  531.                   chain or by appending a rule at the bottom. insert is the safe default
  532.                   since it prevents Calico''s rules from being bypassed. If you switch
  533.                   to append mode, be sure that the other rules in the chains signal
  534.                   acceptance by falling through to the Calico rules, otherwise the
  535.                   Calico policy will be bypassed. [Default: insert]'
  536.                 type: string
  537.               dataplaneDriver:
  538.                 type: string
  539.               debugDisableLogDropping:
  540.                 type: boolean
  541.               debugMemoryProfilePath:
  542.                 type: string
  543.               debugSimulateCalcGraphHangAfter:
  544.                 type: string
  545.               debugSimulateDataplaneHangAfter:
  546.                 type: string
  547.               defaultEndpointToHostAction:
  548.                 description: 'DefaultEndpointToHostAction controls what happens to
  549.                   traffic that goes from a workload endpoint to the host itself (after
  550.                   the traffic hits the endpoint egress policy). By default Calico
  551.                   blocks traffic from workload endpoints to the host itself with an
  552.                   iptables 鈥淒ROP鈥� action. If you want to allow some or all traffic
  553.                   from endpoint to host, set this parameter to RETURN or ACCEPT. Use
  554.                   RETURN if you have your own rules in the iptables 鈥淚NPUT鈥� chain;
  555.                   Calico will insert its rules at the top of that chain, then 鈥淩ETURN鈥�
  556.                   packets to the 鈥淚NPUT鈥� chain once it has completed processing workload
  557.                   endpoint egress policy. Use ACCEPT to unconditionally accept packets
  558.                   from workloads after processing workload endpoint egress policy.
  559.                   [Default: Drop]'
  560.                 type: string
  561.               deviceRouteProtocol:
  562.                 description: This defines the route protocol added to programmed device
  563.                   routes, by default this will be RTPROT_BOOT when left blank.
  564.                 type: integer
  565.               deviceRouteSourceAddress:
  566.                 description: This is the source address to use on programmed device
  567.                   routes. By default the source address is left blank, leaving the
  568.                   kernel to choose the source address used.
  569.                 type: string
  570.               disableConntrackInvalidCheck:
  571.                 type: boolean
  572.               endpointReportingDelay:
  573.                 type: string
  574.               endpointReportingEnabled:
  575.                 type: boolean
  576.               externalNodesList:
  577.                 description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes
  578.                   which may source tunnel traffic and have the tunneled traffic be
  579.                   accepted at calico nodes.
  580.                 items:
  581.                   type: string
  582.                 type: array
  583.               failsafeInboundHostPorts:
  584.                 description: 'FailsafeInboundHostPorts is a comma-delimited list of
  585.                   UDP/TCP ports that Felix will allow incoming traffic to host endpoints
  586.                   on irrespective of the security policy. This is useful to avoid
  587.                   accidentally cutting off a host with incorrect configuration. Each
  588.                   port should be specified as tcp:<port-number> or udp:<port-number>.
  589.                   For back-compatibility, if the protocol is not specified, it defaults
  590.                   to 鈥渢cp鈥�. To disable all inbound host ports, use the value none.
  591.                   The default value allows ssh access and DHCP. [Default: tcp:22,
  592.                   udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
  593.                 items:
  594.                   description: ProtoPort is combination of protocol and port, both
  595.                     must be specified.
  596.                   properties:
  597.                     port:
  598.                       type: integer
  599.                     protocol:
  600.                       type: string
  601.                   required:
  602.                   - port
  603.                   - protocol
  604.                   type: object
  605.                 type: array
  606.               failsafeOutboundHostPorts:
  607.                 description: 'FailsafeOutboundHostPorts is a comma-delimited list
  608.                   of UDP/TCP ports that Felix will allow outgoing traffic from host
  609.                   endpoints to irrespective of the security policy. This is useful
  610.                   to avoid accidentally cutting off a host with incorrect configuration.
  611.                   Each port should be specified as tcp:<port-number> or udp:<port-number>.
  612.                   For back-compatibility, if the protocol is not specified, it defaults
  613.                   to 鈥渢cp鈥�. To disable all outbound host ports, use the value none.
  614.                   The default value opens etcd''s standard ports to ensure that Felix
  615.                   does not get cut off from etcd as well as allowing DHCP and DNS.
  616.                   [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667,
  617.                   udp:53, udp:67]'
  618.                 items:
  619.                   description: ProtoPort is combination of protocol and port, both
  620.                     must be specified.
  621.                   properties:
  622.                     port:
  623.                       type: integer
  624.                     protocol:
  625.                       type: string
  626.                   required:
  627.                   - port
  628.                   - protocol
  629.                   type: object
  630.                 type: array
  631.               featureDetectOverride:
  632.                 description: FeatureDetectOverride is used to override the feature
  633.                   detection. Values are specified in a comma separated list with no
  634.                   spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=".
  635.                   "true" or "false" will force the feature, empty or omitted values
  636.                   are auto-detected.
  637.                 type: string
  638.               genericXDPEnabled:
  639.                 description: 'GenericXDPEnabled enables Generic XDP so network cards
  640.                   that don''t support XDP offload or driver modes can use XDP. This
  641.                   is not recommended since it doesn''t provide better performance
  642.                   than iptables. [Default: false]'
  643.                 type: boolean
  644.               healthEnabled:
  645.                 type: boolean
  646.               healthHost:
  647.                 type: string
  648.               healthPort:
  649.                 type: integer
  650.               interfaceExclude:
  651.                 description: 'InterfaceExclude is a comma-separated list of interfaces
  652.                   that Felix should exclude when monitoring for host endpoints. The
  653.                   default value ensures that Felix ignores Kubernetes'' IPVS dummy
  654.                   interface, which is used internally by kube-proxy. If you want to
  655.                   exclude multiple interface names using a single value, the list
  656.                   supports regular expressions. For regular expressions you must wrap
  657.                   the value with ''/''. For example having values ''/^kube/,veth1''
  658.                   will exclude all interfaces that begin with ''kube'' and also the
  659.                   interface ''veth1''. [Default: kube-ipvs0]'
  660.                 type: string
  661.               interfacePrefix:
  662.                 description: 'InterfacePrefix is the interface name prefix that identifies
  663.                   workload endpoints and so distinguishes them from host endpoint
  664.                   interfaces. Note: in environments other than bare metal, the orchestrators
  665.                   configure this appropriately. For example our Kubernetes and Docker
  666.                   integrations set the ''cali'' value, and our OpenStack integration
  667.                   sets the ''tap'' value. [Default: cali]'
  668.                 type: string
  669.               interfaceRefreshInterval:
  670.                 description: InterfaceRefreshInterval is the period at which Felix
  671.                   rescans local interfaces to verify their state. The rescan can be
  672.                   disabled by setting the interval to 0.
  673.                 type: string
  674.               ipipEnabled:
  675.                 type: boolean
  676.               ipipMTU:
  677.                 description: 'IPIPMTU is the MTU to set on the tunnel device. See
  678.                   Configuring MTU [Default: 1440]'
  679.                 type: integer
  680.               ipsetsRefreshInterval:
  681.                 description: 'IpsetsRefreshInterval is the period at which Felix re-checks
  682.                   all iptables state to ensure that no other process has accidentally
  683.                   broken Calico''s rules. Set to 0 to disable iptables refresh. [Default:
  684.                   90s]'
  685.                 type: string
  686.               iptablesBackend:
  687.                 description: IptablesBackend specifies which backend of iptables will
  688.                   be used. The default is legacy.
  689.                 type: string
  690.               iptablesFilterAllowAction:
  691.                 type: string
  692.               iptablesLockFilePath:
  693.                 description: 'IptablesLockFilePath is the location of the iptables
  694.                   lock file. You may need to change this if the lock file is not in
  695.                   its standard location (for example if you have mapped it into Felix''s
  696.                   container at a different path). [Default: /run/xtables.lock]'
  697.                 type: string
  698.               iptablesLockProbeInterval:
  699.                 description: 'IptablesLockProbeInterval is the time that Felix will
  700.                   wait between attempts to acquire the iptables lock if it is not
  701.                   available. Lower values make Felix more responsive when the lock
  702.                   is contended, but use more CPU. [Default: 50ms]'
  703.                 type: string
  704.               iptablesLockTimeout:
  705.                 description: 'IptablesLockTimeout is the time that Felix will wait
  706.                   for the iptables lock, or 0, to disable. To use this feature, Felix
  707.                   must share the iptables lock file with all other processes that
  708.                   also take the lock. When running Felix inside a container, this
  709.                   requires the /run directory of the host to be mounted into the calico/node
  710.                   or calico/felix container. [Default: 0s disabled]'
  711.                 type: string
  712.               iptablesMangleAllowAction:
  713.                 type: string
  714.               iptablesMarkMask:
  715.                 description: 'IptablesMarkMask is the mask that Felix selects its
  716.                   IPTables Mark bits from. Should be a 32 bit hexadecimal number with
  717.                   at least 8 bits set, none of which clash with any other mark bits
  718.                   in use on the system. [Default: 0xff000000]'
  719.                 format: int32
  720.                 type: integer
  721.               iptablesNATOutgoingInterfaceFilter:
  722.                 type: string
  723.               iptablesPostWriteCheckInterval:
  724.                 description: 'IptablesPostWriteCheckInterval is the period after Felix
  725.                   has done a write to the dataplane that it schedules an extra read
  726.                   back in order to check the write was not clobbered by another process.
  727.                   This should only occur if another application on the system doesn''t
  728.                   respect the iptables lock. [Default: 1s]'
  729.                 type: string
  730.               iptablesRefreshInterval:
  731.                 description: 'IptablesRefreshInterval is the period at which Felix
  732.                   re-checks the IP sets in the dataplane to ensure that no other process
  733.                   has accidentally broken Calico''s rules. Set to 0 to disable IP
  734.                   sets refresh. Note: the default for this value is lower than the
  735.                   other refresh intervals as a workaround for a Linux kernel bug that
  736.                   was fixed in kernel version 4.11. If you are using v4.11 or greater
  737.                   you may want to set this to, a higher value to reduce Felix CPU
  738.                   usage. [Default: 10s]'
  739.                 type: string
  740.               ipv6Support:
  741.                 type: boolean
  742.               kubeNodePortRanges:
  743.                 description: 'KubeNodePortRanges holds list of port ranges used for
  744.                   service node ports. Only used if felix detects kube-proxy running
  745.                   in ipvs mode. Felix uses these ranges to separate host and workload
  746.                   traffic. [Default: 30000:32767].'
  747.                 items:
  748.                   anyOf:
  749.                   - type: integer
  750.                   - type: string
  751.                   pattern: ^.*
  752.                   x-kubernetes-int-or-string: true
  753.                 type: array
  754.               logFilePath:
  755.                 description: 'LogFilePath is the full path to the Felix log. Set to
  756.                   none to disable file logging. [Default: /var/log/calico/felix.log]'
  757.                 type: string
  758.               logPrefix:
  759.                 description: 'LogPrefix is the log prefix that Felix uses when rendering
  760.                   LOG rules. [Default: calico-packet]'
  761.                 type: string
  762.               logSeverityFile:
  763.                 description: 'LogSeverityFile is the log severity above which logs
  764.                   are sent to the log file. [Default: Info]'
  765.                 type: string
  766.               logSeverityScreen:
  767.                 description: 'LogSeverityScreen is the log severity above which logs
  768.                   are sent to the stdout. [Default: Info]'
  769.                 type: string
  770.               logSeveritySys:
  771.                 description: 'LogSeveritySys is the log severity above which logs
  772.                   are sent to the syslog. Set to None for no logging to syslog. [Default:
  773.                   Info]'
  774.                 type: string
  775.               maxIpsetSize:
  776.                 type: integer
  777.               metadataAddr:
  778.                 description: 'MetadataAddr is the IP address or domain name of the
  779.                   server that can answer VM queries for cloud-init metadata. In OpenStack,
  780.                   this corresponds to the machine running nova-api (or in Ubuntu,
  781.                   nova-api-metadata). A value of none (case insensitive) means that
  782.                   Felix should not set up any NAT rule for the metadata path. [Default:
  783.                   127.0.0.1]'
  784.                 type: string
  785.               metadataPort:
  786.                 description: 'MetadataPort is the port of the metadata server. This,
  787.                   combined with global.MetadataAddr (if not ''None''), is used to
  788.                   set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
  789.                   In most cases this should not need to be changed [Default: 8775].'
  790.                 type: integer
  791.               mtuIfacePattern:
  792.                 description: MTUIfacePattern is a regular expression that controls
  793.                   which interfaces Felix should scan in order to calculate the host's
  794.                   MTU. This should not match workload interfaces (usually named cali...).
  795.                 type: string
  796.               natOutgoingAddress:
  797.                 description: NATOutgoingAddress specifies an address to use when performing
  798.                   source NAT for traffic in a natOutgoing pool that is leaving the
  799.                   network. By default the address used is an address on the interface
  800.                   the traffic is leaving on (ie it uses the iptables MASQUERADE target)
  801.                 type: string
  802.               natPortRange:
  803.                 anyOf:
  804.                 - type: integer
  805.                 - type: string
  806.                 description: NATPortRange specifies the range of ports that is used
  807.                   for port mapping when doing outgoing NAT. When unset the default
  808.                   behavior of the network stack is used.
  809.                 pattern: ^.*
  810.                 x-kubernetes-int-or-string: true
  811.               netlinkTimeout:
  812.                 type: string
  813.               openstackRegion:
  814.                 description: 'OpenstackRegion is the name of the region that a particular
  815.                   Felix belongs to. In a multi-region Calico/OpenStack deployment,
  816.                   this must be configured somehow for each Felix (here in the datamodel,
  817.                   or in felix.cfg or the environment on each compute node), and must
  818.                   match the [calico] openstack_region value configured in neutron.conf
  819.                   on each node. [Default: Empty]'
  820.                 type: string
  821.               policySyncPathPrefix:
  822.                 description: 'PolicySyncPathPrefix is used to by Felix to communicate
  823.                   policy changes to external services, like Application layer policy.
  824.                   [Default: Empty]'
  825.                 type: string
  826.               prometheusGoMetricsEnabled:
  827.                 description: 'PrometheusGoMetricsEnabled disables Go runtime metrics
  828.                   collection, which the Prometheus client does by default, when set
  829.                   to false. This reduces the number of metrics reported, reducing
  830.                   Prometheus load. [Default: true]'
  831.                 type: boolean
  832.               prometheusMetricsEnabled:
  833.                 description: 'PrometheusMetricsEnabled enables the Prometheus metrics
  834.                   server in Felix if set to true. [Default: false]'
  835.                 type: boolean
  836.               prometheusMetricsHost:
  837.                 description: 'PrometheusMetricsHost is the host that the Prometheus
  838.                   metrics server should bind to. [Default: empty]'
  839.                 type: string
  840.               prometheusMetricsPort:
  841.                 description: 'PrometheusMetricsPort is the TCP port that the Prometheus
  842.                   metrics server should bind to. [Default: 9091]'
  843.                 type: integer
  844.               prometheusProcessMetricsEnabled:
  845.                 description: 'PrometheusProcessMetricsEnabled disables process metrics
  846.                   collection, which the Prometheus client does by default, when set
  847.                   to false. This reduces the number of metrics reported, reducing
  848.                   Prometheus load. [Default: true]'
  849.                 type: boolean
  850.               removeExternalRoutes:
  851.                 description: Whether or not to remove device routes that have not
  852.                   been programmed by Felix. Disabling this will allow external applications
  853.                   to also add device routes. This is enabled by default which means
  854.                   we will remove externally added routes.
  855.                 type: boolean
  856.               reportingInterval:
  857.                 description: 'ReportingInterval is the interval at which Felix reports
  858.                   its status into the datastore or 0 to disable. Must be non-zero
  859.                   in OpenStack deployments. [Default: 30s]'
  860.                 type: string
  861.               reportingTTL:
  862.                 description: 'ReportingTTL is the time-to-live setting for process-wide
  863.                   status reports. [Default: 90s]'
  864.                 type: string
  865.               routeRefreshInterval:
  866.                 description: 'RouteRefreshInterval is the period at which Felix re-checks
  867.                   the routes in the dataplane to ensure that no other process has
  868.                   accidentally broken Calico''s rules. Set to 0 to disable route refresh.
  869.                   [Default: 90s]'
  870.                 type: string
  871.               routeSource:
  872.                 description: 'RouteSource configures where Felix gets its routing
  873.                   information. - WorkloadIPs: use workload endpoints to construct
  874.                   routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
  875.                 type: string
  876.               routeTableRange:
  877.                 description: Calico programs additional Linux route tables for various
  878.                   purposes.  RouteTableRange specifies the indices of the route tables
  879.                   that Calico should use.
  880.                 properties:
  881.                   max:
  882.                     type: integer
  883.                   min:
  884.                     type: integer
  885.                 required:
  886.                 - max
  887.                 - min
  888.                 type: object
  889.               serviceLoopPrevention:
  890.                 description: 'When service IP advertisement is enabled, prevent routing
  891.                   loops to service IPs that are not in use, by dropping or rejecting
  892.                   packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled",
  893.                   in which case such routing loops continue to be allowed. [Default:
  894.                   Drop]'
  895.                 type: string
  896.               sidecarAccelerationEnabled:
  897.                 description: 'SidecarAccelerationEnabled enables experimental sidecar
  898.                   acceleration [Default: false]'
  899.                 type: boolean
  900.               usageReportingEnabled:
  901.                 description: 'UsageReportingEnabled reports anonymous Calico version
  902.                   number and cluster size to projectcalico.org. Logs warnings returned
  903.                   by the usage server. For example, if a significant security vulnerability
  904.                   has been discovered in the version of Calico being used. [Default:
  905.                   true]'
  906.                 type: boolean
  907.               usageReportingInitialDelay:
  908.                 description: 'UsageReportingInitialDelay controls the minimum delay
  909.                   before Felix makes a report. [Default: 300s]'
  910.                 type: string
  911.               usageReportingInterval:
  912.                 description: 'UsageReportingInterval controls the interval at which
  913.                   Felix makes reports. [Default: 86400s]'
  914.                 type: string
  915.               useInternalDataplaneDriver:
  916.                 type: boolean
  917.               vxlanEnabled:
  918.                 type: boolean
  919.               vxlanMTU:
  920.                 description: 'VXLANMTU is the MTU to set on the tunnel device. See
  921.                   Configuring MTU [Default: 1440]'
  922.                 type: integer
  923.               vxlanPort:
  924.                 type: integer
  925.               vxlanVNI:
  926.                 type: integer
  927.               wireguardEnabled:
  928.                 description: 'WireguardEnabled controls whether Wireguard is enabled.
  929.                   [Default: false]'
  930.                 type: boolean
  931.               wireguardInterfaceName:
  932.                 description: 'WireguardInterfaceName specifies the name to use for
  933.                   the Wireguard interface. [Default: wg.calico]'
  934.                 type: string
  935.               wireguardListeningPort:
  936.                 description: 'WireguardListeningPort controls the listening port used
  937.                   by Wireguard. [Default: 51820]'
  938.                 type: integer
  939.               wireguardMTU:
  940.                 description: 'WireguardMTU controls the MTU on the Wireguard interface.
  941.                   See Configuring MTU [Default: 1420]'
  942.                 type: integer
  943.               wireguardRoutingRulePriority:
  944.                 description: 'WireguardRoutingRulePriority controls the priority value
  945.                   to use for the Wireguard routing rule. [Default: 99]'
  946.                 type: integer
  947.               xdpEnabled:
  948.                 description: 'XDPEnabled enables XDP acceleration for suitable untracked
  949.                   incoming deny rules. [Default: true]'
  950.                 type: boolean
  951.               xdpRefreshInterval:
  952.                 description: 'XDPRefreshInterval is the period at which Felix re-checks
  953.                   all XDP state to ensure that no other process has accidentally broken
  954.                   Calico''s BPF maps or attached programs. Set to 0 to disable XDP
  955.                   refresh. [Default: 90s]'
  956.                 type: string
  957.             type: object
  958.         type: object
  959.     served: true
  960.     storage: true
  961. status:
  962.   acceptedNames:
  963.     kind: ""
  964.     plural: ""
  965.   conditions: []
  966.   storedVersions: []
  968. ---
  969. apiVersion: apiextensions.k8s.io/v1
  970. kind: CustomResourceDefinition
  971. metadata:
  972.   name: globalnetworkpolicies.crd.projectcalico.org
  973. spec:
  974.   group: crd.projectcalico.org
  975.   names:
  976.     kind: GlobalNetworkPolicy
  977.     listKind: GlobalNetworkPolicyList
  978.     plural: globalnetworkpolicies
  979.     singular: globalnetworkpolicy
  980.   scope: Cluster
  981.   versions:
  982.   - name: v1
  983.     schema:
  984.       openAPIV3Schema:
  985.         properties:
  986.           apiVersion:
  987.             description: 'APIVersion defines the versioned schema of this representation
  988.               of an object. Servers should convert recognized schemas to the latest
  989.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  990.             type: string
  991.           kind:
  992.             description: 'Kind is a string value representing the REST resource this
  993.               object represents. Servers may infer this from the endpoint the client
  994.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  995.             type: string
  996.           metadata:
  997.             type: object
  998.           spec:
  999.             properties:
  1000.               applyOnForward:
  1001.                 description: ApplyOnForward indicates to apply the rules in this policy
  1002.                   on forward traffic.
  1003.                 type: boolean
  1004.               doNotTrack:
  1005.                 description: DoNotTrack indicates whether packets matched by the rules
  1006.                   in this policy should go through the data plane's connection tracking,
  1007.                   such as Linux conntrack.  If True, the rules in this policy are
  1008.                   applied before any data plane connection tracking, and packets allowed
  1009.                   by this policy are marked as not to be tracked.
  1010.                 type: boolean
  1011.               egress:
  1012.                 description: The ordered set of egress rules.  Each rule contains
  1013.                   a set of packet match criteria and a corresponding action to apply.
  1014.                 items:
  1015.                   description: "A Rule encapsulates a set of match criteria and an
  1016.                     action.  Both selector-based security Policy and security Profiles
  1017.                     reference rules - separated out as a list of rules for both ingress
  1018.                     and egress packet matching. \n Each positive match criteria has
  1019.                     a negated version, prefixed with 鈥漀ot鈥�. All the match criteria
  1020.                     within a rule must be satisfied for a packet to match. A single
  1021.                     rule can contain the positive and negative version of a match
  1022.                     and both must be satisfied for the rule to match."
  1023.                   properties:
  1024.                     action:
  1025.                       type: string
  1026.                     destination:
  1027.                       description: Destination contains the match criteria that apply
  1028.                         to destination entity.
  1029.                       properties:
  1030.                         namespaceSelector:
  1031.                           description: "NamespaceSelector is an optional field that
  1032.                             contains a selector expression. Only traffic that originates
  1033.                             from (or terminates at) endpoints within the selected
  1034.                             namespaces will be matched. When both NamespaceSelector
  1035.                             and Selector are defined on the same rule, then only workload
  1036.                             endpoints that are matched by both selectors will be selected
  1037.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1038.                             implies that the Selector is limited to selecting only
  1039.                             workload endpoints in the same namespace as the NetworkPolicy.
  1040.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1041.                             that the Selector is limited to selecting only GlobalNetworkSet
  1042.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1043.                             NamespaceSelector implies the Selector applies to workload
  1044.                             endpoints across all namespaces."
  1045.                           type: string
  1046.                         nets:
  1047.                           description: Nets is an optional field that restricts the
  1048.                             rule to only apply to traffic that originates from (or
  1049.                             terminates at) IP addresses in any of the given subnets.
  1050.                           items:
  1051.                             type: string
  1052.                           type: array
  1053.                         notNets:
  1054.                           description: NotNets is the negated version of the Nets
  1055.                             field.
  1056.                           items:
  1057.                             type: string
  1058.                           type: array
  1059.                         notPorts:
  1060.                           description: NotPorts is the negated version of the Ports
  1061.                             field. Since only some protocols have ports, if any ports
  1062.                             are specified it requires the Protocol match in the Rule
  1063.                             to be set to "TCP" or "UDP".
  1064.                           items:
  1065.                             anyOf:
  1066.                             - type: integer
  1067.                             - type: string
  1068.                             pattern: ^.*
  1069.                             x-kubernetes-int-or-string: true
  1070.                           type: array
  1071.                         notSelector:
  1072.                           description: NotSelector is the negated version of the Selector
  1073.                             field.  See Selector field for subtleties with negated
  1074.                             selectors.
  1075.                           type: string
  1076.                         ports:
  1077.                           description: "Ports is an optional field that restricts
  1078.                             the rule to only apply to traffic that has a source (destination)
  1079.                             port that matches one of these ranges/values. This value
  1080.                             is a list of integers or strings that represent ranges
  1081.                             of ports. \n Since only some protocols have ports, if
  1082.                             any ports are specified it requires the Protocol match
  1083.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1084.                           items:
  1085.                             anyOf:
  1086.                             - type: integer
  1087.                             - type: string
  1088.                             pattern: ^.*
  1089.                             x-kubernetes-int-or-string: true
  1090.                           type: array
  1091.                         selector:
  1092.                           description: "Selector is an optional field that contains
  1093.                             a selector expression (see Policy for sample syntax).
  1094.                             \ Only traffic that originates from (terminates at) endpoints
  1095.                             matching the selector will be matched. \n Note that: in
  1096.                             addition to the negated version of the Selector (see NotSelector
  1097.                             below), the selector expression syntax itself supports
  1098.                             negation.  The two types of negation are subtly different.
  1099.                             One negates the set of matched endpoints, the other negates
  1100.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1101.                             packets that are from other Calico-controlled \tendpoints
  1102.                             that do not have the label 鈥渕y_label鈥�. \n \tNotSelector
  1103.                             = \"has(my_label)\" matches packets that are not from
  1104.                             Calico-controlled \tendpoints that do have the label 鈥渕y_label鈥�.
  1105.                             \n The effect is that the latter will accept packets from
  1106.                             non-Calico sources whereas the former is limited to packets
  1107.                             from Calico-controlled endpoints."
  1108.                           type: string
  1109.                         serviceAccounts:
  1110.                           description: ServiceAccounts is an optional field that restricts
  1111.                             the rule to only apply to traffic that originates from
  1112.                             (or terminates at) a pod running as a matching service
  1113.                             account.
  1114.                           properties:
  1115.                             names:
  1116.                               description: Names is an optional field that restricts
  1117.                                 the rule to only apply to traffic that originates
  1118.                                 from (or terminates at) a pod running as a service
  1119.                                 account whose name is in the list.
  1120.                               items:
  1121.                                 type: string
  1122.                               type: array
  1123.                             selector:
  1124.                               description: Selector is an optional field that restricts
  1125.                                 the rule to only apply to traffic that originates
  1126.                                 from (or terminates at) a pod running as a service
  1127.                                 account that matches the given label selector. If
  1128.                                 both Names and Selector are specified then they are
  1129.                                 AND'ed.
  1130.                               type: string
  1131.                           type: object
  1132.                       type: object
  1133.                     http:
  1134.                       description: HTTP contains match criteria that apply to HTTP
  1135.                         requests.
  1136.                       properties:
  1137.                         methods:
  1138.                           description: Methods is an optional field that restricts
  1139.                             the rule to apply only to HTTP requests that use one of
  1140.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  1141.                             methods are OR'd together.
  1142.                           items:
  1143.                             type: string
  1144.                           type: array
  1145.                         paths:
  1146.                           description: 'Paths is an optional field that restricts
  1147.                             the rule to apply to HTTP requests that use one of the
  1148.                             listed HTTP Paths. Multiple paths are OR''d together.
  1149.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  1150.                             ONLY specify either a `exact` or a `prefix` match. The
  1151.                             validator will check for it.'
  1152.                           items:
  1153.                             description: 'HTTPPath specifies an HTTP path to match.
  1154.                               It may be either of the form: exact: <path>: which matches
  1155.                               the path exactly or prefix: <path-prefix>: which matches
  1156.                               the path prefix'
  1157.                             properties:
  1158.                               exact:
  1159.                                 type: string
  1160.                               prefix:
  1161.                                 type: string
  1162.                             type: object
  1163.                           type: array
  1164.                       type: object
  1165.                     icmp:
  1166.                       description: ICMP is an optional field that restricts the rule
  1167.                         to apply to a specific type and code of ICMP traffic.  This
  1168.                         should only be specified if the Protocol field is set to "ICMP"
  1169.                         or "ICMPv6".
  1170.                       properties:
  1171.                         code:
  1172.                           description: Match on a specific ICMP code.  If specified,
  1173.                             the Type value must also be specified. This is a technical
  1174.                             limitation imposed by the kernel's iptables firewall,
  1175.                             which Calico uses to enforce the rule.
  1176.                           type: integer
  1177.                         type:
  1178.                           description: Match on a specific ICMP type.  For example
  1179.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1180.                           type: integer
  1181.                       type: object
  1182.                     ipVersion:
  1183.                       description: IPVersion is an optional field that restricts the
  1184.                         rule to only match a specific IP version.
  1185.                       type: integer
  1186.                     metadata:
  1187.                       description: Metadata contains additional information for this
  1188.                         rule
  1189.                       properties:
  1190.                         annotations:
  1191.                           additionalProperties:
  1192.                             type: string
  1193.                           description: Annotations is a set of key value pairs that
  1194.                             give extra information about the rule
  1195.                           type: object
  1196.                       type: object
  1197.                     notICMP:
  1198.                       description: NotICMP is the negated version of the ICMP field.
  1199.                       properties:
  1200.                         code:
  1201.                           description: Match on a specific ICMP code.  If specified,
  1202.                             the Type value must also be specified. This is a technical
  1203.                             limitation imposed by the kernel's iptables firewall,
  1204.                             which Calico uses to enforce the rule.
  1205.                           type: integer
  1206.                         type:
  1207.                           description: Match on a specific ICMP type.  For example
  1208.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1209.                           type: integer
  1210.                       type: object
  1211.                     notProtocol:
  1212.                       anyOf:
  1213.                       - type: integer
  1214.                       - type: string
  1215.                       description: NotProtocol is the negated version of the Protocol
  1216.                         field.
  1217.                       pattern: ^.*
  1218.                       x-kubernetes-int-or-string: true
  1219.                     protocol:
  1220.                       anyOf:
  1221.                       - type: integer
  1222.                       - type: string
  1223.                       description: "Protocol is an optional field that restricts the
  1224.                         rule to only apply to traffic of a specific IP protocol. Required
  1225.                         if any of the EntityRules contain Ports (because ports only
  1226.                         apply to certain protocols). \n Must be one of these string
  1227.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  1228.                         \"UDPLite\" or an integer in the range 1-255."
  1229.                       pattern: ^.*
  1230.                       x-kubernetes-int-or-string: true
  1231.                     source:
  1232.                       description: Source contains the match criteria that apply to
  1233.                         source entity.
  1234.                       properties:
  1235.                         namespaceSelector:
  1236.                           description: "NamespaceSelector is an optional field that
  1237.                             contains a selector expression. Only traffic that originates
  1238.                             from (or terminates at) endpoints within the selected
  1239.                             namespaces will be matched. When both NamespaceSelector
  1240.                             and Selector are defined on the same rule, then only workload
  1241.                             endpoints that are matched by both selectors will be selected
  1242.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1243.                             implies that the Selector is limited to selecting only
  1244.                             workload endpoints in the same namespace as the NetworkPolicy.
  1245.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1246.                             that the Selector is limited to selecting only GlobalNetworkSet
  1247.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1248.                             NamespaceSelector implies the Selector applies to workload
  1249.                             endpoints across all namespaces."
  1250.                           type: string
  1251.                         nets:
  1252.                           description: Nets is an optional field that restricts the
  1253.                             rule to only apply to traffic that originates from (or
  1254.                             terminates at) IP addresses in any of the given subnets.
  1255.                           items:
  1256.                             type: string
  1257.                           type: array
  1258.                         notNets:
  1259.                           description: NotNets is the negated version of the Nets
  1260.                             field.
  1261.                           items:
  1262.                             type: string
  1263.                           type: array
  1264.                         notPorts:
  1265.                           description: NotPorts is the negated version of the Ports
  1266.                             field. Since only some protocols have ports, if any ports
  1267.                             are specified it requires the Protocol match in the Rule
  1268.                             to be set to "TCP" or "UDP".
  1269.                           items:
  1270.                             anyOf:
  1271.                             - type: integer
  1272.                             - type: string
  1273.                             pattern: ^.*
  1274.                             x-kubernetes-int-or-string: true
  1275.                           type: array
  1276.                         notSelector:
  1277.                           description: NotSelector is the negated version of the Selector
  1278.                             field.  See Selector field for subtleties with negated
  1279.                             selectors.
  1280.                           type: string
  1281.                         ports:
  1282.                           description: "Ports is an optional field that restricts
  1283.                             the rule to only apply to traffic that has a source (destination)
  1284.                             port that matches one of these ranges/values. This value
  1285.                             is a list of integers or strings that represent ranges
  1286.                             of ports. \n Since only some protocols have ports, if
  1287.                             any ports are specified it requires the Protocol match
  1288.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1289.                           items:
  1290.                             anyOf:
  1291.                             - type: integer
  1292.                             - type: string
  1293.                             pattern: ^.*
  1294.                             x-kubernetes-int-or-string: true
  1295.                           type: array
  1296.                         selector:
  1297.                           description: "Selector is an optional field that contains
  1298.                             a selector expression (see Policy for sample syntax).
  1299.                             \ Only traffic that originates from (terminates at) endpoints
  1300.                             matching the selector will be matched. \n Note that: in
  1301.                             addition to the negated version of the Selector (see NotSelector
  1302.                             below), the selector expression syntax itself supports
  1303.                             negation.  The two types of negation are subtly different.
  1304.                             One negates the set of matched endpoints, the other negates
  1305.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1306.                             packets that are from other Calico-controlled \tendpoints
  1307.                             that do not have the label 鈥渕y_label鈥�. \n \tNotSelector
  1308.                             = \"has(my_label)\" matches packets that are not from
  1309.                             Calico-controlled \tendpoints that do have the label 鈥渕y_label鈥�.
  1310.                             \n The effect is that the latter will accept packets from
  1311.                             non-Calico sources whereas the former is limited to packets
  1312.                             from Calico-controlled endpoints."
  1313.                           type: string
  1314.                         serviceAccounts:
  1315.                           description: ServiceAccounts is an optional field that restricts
  1316.                             the rule to only apply to traffic that originates from
  1317.                             (or terminates at) a pod running as a matching service
  1318.                             account.
  1319.                           properties:
  1320.                             names:
  1321.                               description: Names is an optional field that restricts
  1322.                                 the rule to only apply to traffic that originates
  1323.                                 from (or terminates at) a pod running as a service
  1324.                                 account whose name is in the list.
  1325.                               items:
  1326.                                 type: string
  1327.                               type: array
  1328.                             selector:
  1329.                               description: Selector is an optional field that restricts
  1330.                                 the rule to only apply to traffic that originates
  1331.                                 from (or terminates at) a pod running as a service
  1332.                                 account that matches the given label selector. If
  1333.                                 both Names and Selector are specified then they are
  1334.                                 AND'ed.
  1335.                               type: string
  1336.                           type: object
  1337.                       type: object
  1338.                   required:
  1339.                   - action
  1340.                   type: object
  1341.                 type: array
  1342.               ingress:
  1343.                 description: The ordered set of ingress rules.  Each rule contains
  1344.                   a set of packet match criteria and a corresponding action to apply.
  1345.                 items:
  1346.                   description: "A Rule encapsulates a set of match criteria and an
  1347.                     action.  Both selector-based security Policy and security Profiles
  1348.                     reference rules - separated out as a list of rules for both ingress
  1349.                     and egress packet matching. \n Each positive match criteria has
  1350.                     a negated version, prefixed with 鈥漀ot鈥�. All the match criteria
  1351.                     within a rule must be satisfied for a packet to match. A single
  1352.                     rule can contain the positive and negative version of a match
  1353.                     and both must be satisfied for the rule to match."
  1354.                   properties:
  1355.                     action:
  1356.                       type: string
  1357.                     destination:
  1358.                       description: Destination contains the match criteria that apply
  1359.                         to destination entity.
  1360.                       properties:
  1361.                         namespaceSelector:
  1362.                           description: "NamespaceSelector is an optional field that
  1363.                             contains a selector expression. Only traffic that originates
  1364.                             from (or terminates at) endpoints within the selected
  1365.                             namespaces will be matched. When both NamespaceSelector
  1366.                             and Selector are defined on the same rule, then only workload
  1367.                             endpoints that are matched by both selectors will be selected
  1368.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1369.                             implies that the Selector is limited to selecting only
  1370.                             workload endpoints in the same namespace as the NetworkPolicy.
  1371.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1372.                             that the Selector is limited to selecting only GlobalNetworkSet
  1373.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1374.                             NamespaceSelector implies the Selector applies to workload
  1375.                             endpoints across all namespaces."
  1376.                           type: string
  1377.                         nets:
  1378.                           description: Nets is an optional field that restricts the
  1379.                             rule to only apply to traffic that originates from (or
  1380.                             terminates at) IP addresses in any of the given subnets.
  1381.                           items:
  1382.                             type: string
  1383.                           type: array
  1384.                         notNets:
  1385.                           description: NotNets is the negated version of the Nets
  1386.                             field.
  1387.                           items:
  1388.                             type: string
  1389.                           type: array
  1390.                         notPorts:
  1391.                           description: NotPorts is the negated version of the Ports
  1392.                             field. Since only some protocols have ports, if any ports
  1393.                             are specified it requires the Protocol match in the Rule
  1394.                             to be set to "TCP" or "UDP".
  1395.                           items:
  1396.                             anyOf:
  1397.                             - type: integer
  1398.                             - type: string
  1399.                             pattern: ^.*
  1400.                             x-kubernetes-int-or-string: true
  1401.                           type: array
  1402.                         notSelector:
  1403.                           description: NotSelector is the negated version of the Selector
  1404.                             field.  See Selector field for subtleties with negated
  1405.                             selectors.
  1406.                           type: string
  1407.                         ports:
  1408.                           description: "Ports is an optional field that restricts
  1409.                             the rule to only apply to traffic that has a source (destination)
  1410.                             port that matches one of these ranges/values. This value
  1411.                             is a list of integers or strings that represent ranges
  1412.                             of ports. \n Since only some protocols have ports, if
  1413.                             any ports are specified it requires the Protocol match
  1414.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1415.                           items:
  1416.                             anyOf:
  1417.                             - type: integer
  1418.                             - type: string
  1419.                             pattern: ^.*
  1420.                             x-kubernetes-int-or-string: true
  1421.                           type: array
  1422.                         selector:
  1423.                           description: "Selector is an optional field that contains
  1424.                             a selector expression (see Policy for sample syntax).
  1425.                             \ Only traffic that originates from (terminates at) endpoints
  1426.                             matching the selector will be matched. \n Note that: in
  1427.                             addition to the negated version of the Selector (see NotSelector
  1428.                             below), the selector expression syntax itself supports
  1429.                             negation.  The two types of negation are subtly different.
  1430.                             One negates the set of matched endpoints, the other negates
  1431.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1432.                             packets that are from other Calico-controlled \tendpoints
  1433.                             that do not have the label 鈥渕y_label鈥�. \n \tNotSelector
  1434.                             = \"has(my_label)\" matches packets that are not from
  1435.                             Calico-controlled \tendpoints that do have the label 鈥渕y_label鈥�.
  1436.                             \n The effect is that the latter will accept packets from
  1437.                             non-Calico sources whereas the former is limited to packets
  1438.                             from Calico-controlled endpoints."
  1439.                           type: string
  1440.                         serviceAccounts:
  1441.                           description: ServiceAccounts is an optional field that restricts
  1442.                             the rule to only apply to traffic that originates from
  1443.                             (or terminates at) a pod running as a matching service
  1444.                             account.
  1445.                           properties:
  1446.                             names:
  1447.                               description: Names is an optional field that restricts
  1448.                                 the rule to only apply to traffic that originates
  1449.                                 from (or terminates at) a pod running as a service
  1450.                                 account whose name is in the list.
  1451.                               items:
  1452.                                 type: string
  1453.                               type: array
  1454.                             selector:
  1455.                               description: Selector is an optional field that restricts
  1456.                                 the rule to only apply to traffic that originates
  1457.                                 from (or terminates at) a pod running as a service
  1458.                                 account that matches the given label selector. If
  1459.                                 both Names and Selector are specified then they are
  1460.                                 AND'ed.
  1461.                               type: string
  1462.                           type: object
  1463.                       type: object
  1464.                     http:
  1465.                       description: HTTP contains match criteria that apply to HTTP
  1466.                         requests.
  1467.                       properties:
  1468.                         methods:
  1469.                           description: Methods is an optional field that restricts
  1470.                             the rule to apply only to HTTP requests that use one of
  1471.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  1472.                             methods are OR'd together.
  1473.                           items:
  1474.                             type: string
  1475.                           type: array
  1476.                         paths:
  1477.                           description: 'Paths is an optional field that restricts
  1478.                             the rule to apply to HTTP requests that use one of the
  1479.                             listed HTTP Paths. Multiple paths are OR''d together.
  1480.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  1481.                             ONLY specify either a `exact` or a `prefix` match. The
  1482.                             validator will check for it.'
  1483.                           items:
  1484.                             description: 'HTTPPath specifies an HTTP path to match.
  1485.                               It may be either of the form: exact: <path>: which matches
  1486.                               the path exactly or prefix: <path-prefix>: which matches
  1487.                               the path prefix'
  1488.                             properties:
  1489.                               exact:
  1490.                                 type: string
  1491.                               prefix:
  1492.                                 type: string
  1493.                             type: object
  1494.                           type: array
  1495.                       type: object
  1496.                     icmp:
  1497.                       description: ICMP is an optional field that restricts the rule
  1498.                         to apply to a specific type and code of ICMP traffic.  This
  1499.                         should only be specified if the Protocol field is set to "ICMP"
  1500.                         or "ICMPv6".
  1501.                       properties:
  1502.                         code:
  1503.                           description: Match on a specific ICMP code.  If specified,
  1504.                             the Type value must also be specified. This is a technical
  1505.                             limitation imposed by the kernel's iptables firewall,
  1506.                             which Calico uses to enforce the rule.
  1507.                           type: integer
  1508.                         type:
  1509.                           description: Match on a specific ICMP type.  For example
  1510.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1511.                           type: integer
  1512.                       type: object
  1513.                     ipVersion:
  1514.                       description: IPVersion is an optional field that restricts the
  1515.                         rule to only match a specific IP version.
  1516.                       type: integer
  1517.                     metadata:
  1518.                       description: Metadata contains additional information for this
  1519.                         rule
  1520.                       properties:
  1521.                         annotations:
  1522.                           additionalProperties:
  1523.                             type: string
  1524.                           description: Annotations is a set of key value pairs that
  1525.                             give extra information about the rule
  1526.                           type: object
  1527.                       type: object
  1528.                     notICMP:
  1529.                       description: NotICMP is the negated version of the ICMP field.
  1530.                       properties:
  1531.                         code:
  1532.                           description: Match on a specific ICMP code.  If specified,
  1533.                             the Type value must also be specified. This is a technical
  1534.                             limitation imposed by the kernel's iptables firewall,
  1535.                             which Calico uses to enforce the rule.
  1536.                           type: integer
  1537.                         type:
  1538.                           description: Match on a specific ICMP type.  For example
  1539.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1540.                           type: integer
  1541.                       type: object
  1542.                     notProtocol:
  1543.                       anyOf:
  1544.                       - type: integer
  1545.                       - type: string
  1546.                       description: NotProtocol is the negated version of the Protocol
  1547.                         field.
  1548.                       pattern: ^.*
  1549.                       x-kubernetes-int-or-string: true
  1550.                     protocol:
  1551.                       anyOf:
  1552.                       - type: integer
  1553.                       - type: string
  1554.                       description: "Protocol is an optional field that restricts the
  1555.                         rule to only apply to traffic of a specific IP protocol. Required
  1556.                         if any of the EntityRules contain Ports (because ports only
  1557.                         apply to certain protocols). \n Must be one of these string
  1558.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  1559.                         \"UDPLite\" or an integer in the range 1-255."
  1560.                       pattern: ^.*
  1561.                       x-kubernetes-int-or-string: true
  1562.                     source:
  1563.                       description: Source contains the match criteria that apply to
  1564.                         source entity.
  1565.                       properties:
  1566.                         namespaceSelector:
  1567.                           description: "NamespaceSelector is an optional field that
  1568.                             contains a selector expression. Only traffic that originates
  1569.                             from (or terminates at) endpoints within the selected
  1570.                             namespaces will be matched. When both NamespaceSelector
  1571.                             and Selector are defined on the same rule, then only workload
  1572.                             endpoints that are matched by both selectors will be selected
  1573.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1574.                             implies that the Selector is limited to selecting only
  1575.                             workload endpoints in the same namespace as the NetworkPolicy.
  1576.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1577.                             that the Selector is limited to selecting only GlobalNetworkSet
  1578.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1579.                             NamespaceSelector implies the Selector applies to workload
  1580.                             endpoints across all namespaces."
  1581.                           type: string
  1582.                         nets:
  1583.                           description: Nets is an optional field that restricts the
  1584.                             rule to only apply to traffic that originates from (or
  1585.                             terminates at) IP addresses in any of the given subnets.
  1586.                           items:
  1587.                             type: string
  1588.                           type: array
  1589.                         notNets:
  1590.                           description: NotNets is the negated version of the Nets
  1591.                             field.
  1592.                           items:
  1593.                             type: string
  1594.                           type: array
  1595.                         notPorts:
  1596.                           description: NotPorts is the negated version of the Ports
  1597.                             field. Since only some protocols have ports, if any ports
  1598.                             are specified it requires the Protocol match in the Rule
  1599.                             to be set to "TCP" or "UDP".
  1600.                           items:
  1601.                             anyOf:
  1602.                             - type: integer
  1603.                             - type: string
  1604.                             pattern: ^.*
  1605.                             x-kubernetes-int-or-string: true
  1606.                           type: array
  1607.                         notSelector:
  1608.                           description: NotSelector is the negated version of the Selector
  1609.                             field.  See Selector field for subtleties with negated
  1610.                             selectors.
  1611.                           type: string
  1612.                         ports:
  1613.                           description: "Ports is an optional field that restricts
  1614.                             the rule to only apply to traffic that has a source (destination)
  1615.                             port that matches one of these ranges/values. This value
  1616.                             is a list of integers or strings that represent ranges
  1617.                             of ports. \n Since only some protocols have ports, if
  1618.                             any ports are specified it requires the Protocol match
  1619.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1620.                           items:
  1621.                             anyOf:
  1622.                             - type: integer
  1623.                             - type: string
  1624.                             pattern: ^.*
  1625.                             x-kubernetes-int-or-string: true
  1626.                           type: array
  1627.                         selector:
  1628.                           description: "Selector is an optional field that contains
  1629.                             a selector expression (see Policy for sample syntax).
  1630.                             \ Only traffic that originates from (terminates at) endpoints
  1631.                             matching the selector will be matched. \n Note that: in
  1632.                             addition to the negated version of the Selector (see NotSelector
  1633.                             below), the selector expression syntax itself supports
  1634.                             negation.  The two types of negation are subtly different.
  1635.                             One negates the set of matched endpoints, the other negates
  1636.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1637.                             packets that are from other Calico-controlled \tendpoints
  1638.                             that do not have the label 鈥渕y_label鈥�. \n \tNotSelector
  1639.                             = \"has(my_label)\" matches packets that are not from
  1640.                             Calico-controlled \tendpoints that do have the label 鈥渕y_label鈥�.
  1641.                             \n The effect is that the latter will accept packets from
  1642.                             non-Calico sources whereas the former is limited to packets
  1643.                             from Calico-controlled endpoints."
  1644.                           type: string
  1645.                         serviceAccounts:
  1646.                           description: ServiceAccounts is an optional field that restricts
  1647.                             the rule to only apply to traffic that originates from
  1648.                             (or terminates at) a pod running as a matching service
  1649.                             account.
  1650.                           properties:
  1651.                             names:
  1652.                               description: Names is an optional field that restricts
  1653.                                 the rule to only apply to traffic that originates
  1654.                                 from (or terminates at) a pod running as a service
  1655.                                 account whose name is in the list.
  1656.                               items:
  1657.                                 type: string
  1658.                               type: array
  1659.                             selector:
  1660.                               description: Selector is an optional field that restricts
  1661.                                 the rule to only apply to traffic that originates
  1662.                                 from (or terminates at) a pod running as a service
  1663.                                 account that matches the given label selector. If
  1664.                                 both Names and Selector are specified then they are
  1665.                                 AND'ed.
  1666.                               type: string
  1667.                           type: object
  1668.                       type: object
  1669.                   required:
  1670.                   - action
  1671.                   type: object
  1672.                 type: array
  1673.               namespaceSelector:
  1674.                 description: NamespaceSelector is an optional field for an expression
  1675.                   used to select a pod based on namespaces.
  1676.                 type: string
  1677.               order:
  1678.                 description: Order is an optional field that specifies the order in
  1679.                   which the policy is applied. Policies with higher "order" are applied
  1680.                   after those with lower order.  If the order is omitted, it may be
  1681.                   considered to be "infinite" - i.e. the policy will be applied last.  Policies
  1682.                   with identical order will be applied in alphanumerical order based
  1683.                   on the Policy "Name".
  1684.                 type: number
  1685.               preDNAT:
  1686.                 description: PreDNAT indicates to apply the rules in this policy before
  1687.                   any DNAT.
  1688.                 type: boolean
  1689.               selector:
  1690.                 description: "The selector is an expression used to pick pick out
  1691.                   the endpoints that the policy should be applied to. \n Selector
  1692.                   expressions follow this syntax: \n \tlabel == \"string_literal\"
  1693.                   \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
  1694.                   \  ->  not equal; also matches if label is not present \tlabel in
  1695.                   { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
  1696.                   one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
  1697.                   ... }  ->  true if the value of label X is not one of \"a\", \"b\",
  1698.                   \"c\" \thas(label_name)  -> True if that label is present \t! expr
  1699.                   -> negation of expr \texpr && expr  -> Short-circuit and \texpr
  1700.                   || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
  1701.                   or the empty selector -> matches all endpoints. \n Label names are
  1702.                   allowed to contain alphanumerics, -, _ and /. String literals are
  1703.                   more permissive but they do not support escape characters. \n Examples
  1704.                   (with made-up labels): \n \ttype == \"webserver\" && deployment
  1705.                   == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
  1706.                   \"dev\" \t! has(label_name)"
  1707.                 type: string
  1708.               serviceAccountSelector:
  1709.                 description: ServiceAccountSelector is an optional field for an expression
  1710.                   used to select a pod based on service accounts.
  1711.                 type: string
  1712.               types:
  1713.                 description: "Types indicates whether this policy applies to ingress,
  1714.                   or to egress, or to both.  When not explicitly specified (and so
  1715.                   the value on creation is empty or nil), Calico defaults Types according
  1716.                   to what Ingress and Egress rules are present in the policy.  The
  1717.                   default is: \n - [ PolicyTypeIngress ], if there are no Egress rules
  1718.                   (including the case where there are   also no Ingress rules) \n
  1719.                   - [ PolicyTypeEgress ], if there are Egress rules but no Ingress
  1720.                   rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are
  1721.                   both Ingress and Egress rules. \n When the policy is read back again,
  1722.                   Types will always be one of these values, never empty or nil."
  1723.                 items:
  1724.                   description: PolicyType enumerates the possible values of the PolicySpec
  1725.                     Types field.
  1726.                   type: string
  1727.                 type: array
  1728.             type: object
  1729.         type: object
  1730.     served: true
  1731.     storage: true
  1732. status:
  1733.   acceptedNames:
  1734.     kind: ""
  1735.     plural: ""
  1736.   conditions: []
  1737.   storedVersions: []
  1739. ---
  1740. apiVersion: apiextensions.k8s.io/v1
  1741. kind: CustomResourceDefinition
  1742. metadata:
  1743.   name: globalnetworksets.crd.projectcalico.org
  1744. spec:
  1745.   group: crd.projectcalico.org
  1746.   names:
  1747.     kind: GlobalNetworkSet
  1748.     listKind: GlobalNetworkSetList
  1749.     plural: globalnetworksets
  1750.     singular: globalnetworkset
  1751.   scope: Cluster
  1752.   versions:
  1753.   - name: v1
  1754.     schema:
  1755.       openAPIV3Schema:
  1756.         description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
  1757.           that share labels to allow rules to refer to them via selectors.  The labels
  1758.           of GlobalNetworkSet are not namespaced.
  1759.         properties:
  1760.           apiVersion:
  1761.             description: 'APIVersion defines the versioned schema of this representation
  1762.               of an object. Servers should convert recognized schemas to the latest
  1763.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1764.             type: string
  1765.           kind:
  1766.             description: 'Kind is a string value representing the REST resource this
  1767.               object represents. Servers may infer this from the endpoint the client
  1768.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1769.             type: string
  1770.           metadata:
  1771.             type: object
  1772.           spec:
  1773.             description: GlobalNetworkSetSpec contains the specification for a NetworkSet
  1774.               resource.
  1775.             properties:
  1776.               nets:
  1777.                 description: The list of IP networks that belong to this set.
  1778.                 items:
  1779.                   type: string
  1780.                 type: array
  1781.             type: object
  1782.         type: object
  1783.     served: true
  1784.     storage: true
  1785. status:
  1786.   acceptedNames:
  1787.     kind: ""
  1788.     plural: ""
  1789.   conditions: []
  1790.   storedVersions: []
  1791.  
  1792. ---
  1793. apiVersion: apiextensions.k8s.io/v1
  1794. kind: CustomResourceDefinition
  1795. metadata:
  1796.   name: hostendpoints.crd.projectcalico.org
  1797. spec:
  1798.   group: crd.projectcalico.org
  1799.   names:
  1800.     kind: HostEndpoint
  1801.     listKind: HostEndpointList
  1802.     plural: hostendpoints
  1803.     singular: hostendpoint
  1804.   scope: Cluster
  1805.   versions:
  1806.   - name: v1
  1807.     schema:
  1808.       openAPIV3Schema:
  1809.         properties:
  1810.           apiVersion:
  1811.             description: 'APIVersion defines the versioned schema of this representation
  1812.               of an object. Servers should convert recognized schemas to the latest
  1813.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1814.             type: string
  1815.           kind:
  1816.             description: 'Kind is a string value representing the REST resource this
  1817.               object represents. Servers may infer this from the endpoint the client
  1818.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1819.             type: string
  1820.           metadata:
  1821.             type: object
  1822.           spec:
  1823.             description: HostEndpointSpec contains the specification for a HostEndpoint
  1824.               resource.
  1825.             properties:
  1826.               expectedIPs:
  1827.                 description: "The expected IP addresses (IPv4 and IPv6) of the endpoint.
  1828.                   If \"InterfaceName\" is not present, Calico will look for an interface
  1829.                   matching any of the IPs in the list and apply policy to that. Note:
  1830.                   \tWhen using the selector match criteria in an ingress or egress
  1831.                   security Policy \tor Profile, Calico converts the selector into
  1832.                   a set of IP addresses. For host \tendpoints, the ExpectedIPs field
  1833.                   is used for that purpose. (If only the interface \tname is specified,
  1834.                   Calico does not learn the IPs of the interface for use in match
  1835.                   \tcriteria.)"
  1836.                 items:
  1837.                   type: string
  1838.                 type: array
  1839.               interfaceName:
  1840.                 description: "Either \"*\", or the name of a specific Linux interface
  1841.                   to apply policy to; or empty.  \"*\" indicates that this HostEndpoint
  1842.                   governs all traffic to, from or through the default network namespace
  1843.                   of the host named by the \"Node\" field; entering and leaving that
  1844.                   namespace via any interface, including those from/to non-host-networked
  1845.                   local workloads. \n If InterfaceName is not \"*\", this HostEndpoint
  1846.                   only governs traffic that enters or leaves the host through the
  1847.                   specific interface named by InterfaceName, or - when InterfaceName
  1848.                   is empty - through the specific interface that has one of the IPs
  1849.                   in ExpectedIPs. Therefore, when InterfaceName is empty, at least
  1850.                   one expected IP must be specified.  Only external interfaces (such
  1851.                   as 鈥渆th0鈥�) are supported here; it isn't possible for a HostEndpoint
  1852.                   to protect traffic through a specific local workload interface.
  1853.                   \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
  1854.                   initially just pre-DNAT policy.  Please check Calico documentation
  1855.                   for the latest position."
  1856.                 type: string
  1857.               node:
  1858.                 description: The node name identifying the Calico node instance.
  1859.                 type: string
  1860.               ports:
  1861.                 description: Ports contains the endpoint's named ports, which may
  1862.                   be referenced in security policy rules.
  1863.                 items:
  1864.                   properties:
  1865.                     name:
  1866.                       type: string
  1867.                     port:
  1868.                       type: integer
  1869.                     protocol:
  1870.                       anyOf:
  1871.                       - type: integer
  1872.                       - type: string
  1873.                       pattern: ^.*
  1874.                       x-kubernetes-int-or-string: true
  1875.                   required:
  1876.                   - name
  1877.                   - port
  1878.                   - protocol
  1879.                   type: object
  1880.                 type: array
  1881.               profiles:
  1882.                 description: A list of identifiers of security Profile objects that
  1883.                   apply to this endpoint. Each profile is applied in the order that
  1884.                   they appear in this list.  Profile rules are applied after the selector-based
  1885.                   security policy.
  1886.                 items:
  1887.                   type: string
  1888.                 type: array
  1889.             type: object
  1890.         type: object
  1891.     served: true
  1892.     storage: true
  1893. status:
  1894.   acceptedNames:
  1895.     kind: ""
  1896.     plural: ""
  1897.   conditions: []
  1898.   storedVersions: []
  1900. ---
  1901. apiVersion: apiextensions.k8s.io/v1
  1902. kind: CustomResourceDefinition
  1903. metadata:
  1904.   name: ipamblocks.crd.projectcalico.org
  1905. spec:
  1906.   group: crd.projectcalico.org
  1907.   names:
  1908.     kind: IPAMBlock
  1909.     listKind: IPAMBlockList
  1910.     plural: ipamblocks
  1911.     singular: ipamblock
  1912.   scope: Cluster
  1913.   versions:
  1914.   - name: v1
  1915.     schema:
  1916.       openAPIV3Schema:
  1917.         properties:
  1918.           apiVersion:
  1919.             description: 'APIVersion defines the versioned schema of this representation
  1920.               of an object. Servers should convert recognized schemas to the latest
  1921.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1922.             type: string
  1923.           kind:
  1924.             description: 'Kind is a string value representing the REST resource this
  1925.               object represents. Servers may infer this from the endpoint the client
  1926.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1927.             type: string
  1928.           metadata:
  1929.             type: object
  1930.           spec:
  1931.             description: IPAMBlockSpec contains the specification for an IPAMBlock
  1932.               resource.
  1933.             properties:
  1934.               affinity:
  1935.                 type: string
  1936.               allocations:
  1937.                 items:
  1938.                   type: integer
  1939.                   # TODO: This nullable is manually added in. We should update controller-gen
  1940.                   # to handle []*int properly itself.
  1941.                   nullable: true
  1942.                 type: array
  1943.               attributes:
  1944.                 items:
  1945.                   properties:
  1946.                     handle_id:
  1947.                       type: string
  1948.                     secondary:
  1949.                       additionalProperties:
  1950.                         type: string
  1951.                       type: object
  1952.                   type: object
  1953.                 type: array
  1954.               cidr:
  1955.                 type: string
  1956.               deleted:
  1957.                 type: boolean
  1958.               strictAffinity:
  1959.                 type: boolean
  1960.               unallocated:
  1961.                 items:
  1962.                   type: integer
  1963.                 type: array
  1964.             required:
  1965.             - allocations
  1966.             - attributes
  1967.             - cidr
  1968.             - strictAffinity
  1969.             - unallocated
  1970.             type: object
  1971.         type: object
  1972.     served: true
  1973.     storage: true
  1974. status:
  1975.   acceptedNames:
  1976.     kind: ""
  1977.     plural: ""
  1978.   conditions: []
  1979.   storedVersions: []
  1980.  
  1981. ---
  1982. apiVersion: apiextensions.k8s.io/v1
  1983. kind: CustomResourceDefinition
  1984. metadata:
  1985.   name: ipamconfigs.crd.projectcalico.org
  1986. spec:
  1987.   group: crd.projectcalico.org
  1988.   names:
  1989.     kind: IPAMConfig
  1990.     listKind: IPAMConfigList
  1991.     plural: ipamconfigs
  1992.     singular: ipamconfig
  1993.   scope: Cluster
  1994.   versions:
  1995.   - name: v1
  1996.     schema:
  1997.       openAPIV3Schema:
  1998.         properties:
  1999.           apiVersion:
  2000.             description: 'APIVersion defines the versioned schema of this representation
  2001.               of an object. Servers should convert recognized schemas to the latest
  2002.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2003.             type: string
  2004.           kind:
  2005.             description: 'Kind is a string value representing the REST resource this
  2006.               object represents. Servers may infer this from the endpoint the client
  2007.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2008.             type: string
  2009.           metadata:
  2010.             type: object
  2011.           spec:
  2012.             description: IPAMConfigSpec contains the specification for an IPAMConfig
  2013.               resource.
  2014.             properties:
  2015.               autoAllocateBlocks:
  2016.                 type: boolean
  2017.               maxBlocksPerHost:
  2018.                 description: MaxBlocksPerHost, if non-zero, is the max number of blocks
  2019.                   that can be affine to each host.
  2020.                 type: integer
  2021.               strictAffinity:
  2022.                 type: boolean
  2023.             required:
  2024.             - autoAllocateBlocks
  2025.             - strictAffinity
  2026.             type: object
  2027.         type: object
  2028.     served: true
  2029.     storage: true
  2030. status:
  2031.   acceptedNames:
  2032.     kind: ""
  2033.     plural: ""
  2034.   conditions: []
  2035.   storedVersions: []
  2036.  
  2037. ---
  2038. apiVersion: apiextensions.k8s.io/v1
  2039. kind: CustomResourceDefinition
  2040. metadata:
  2041.   name: ipamhandles.crd.projectcalico.org
  2042. spec:
  2043.   group: crd.projectcalico.org
  2044.   names:
  2045.     kind: IPAMHandle
  2046.     listKind: IPAMHandleList
  2047.     plural: ipamhandles
  2048.     singular: ipamhandle
  2049.   scope: Cluster
  2050.   versions:
  2051.   - name: v1
  2052.     schema:
  2053.       openAPIV3Schema:
  2054.         properties:
  2055.           apiVersion:
  2056.             description: 'APIVersion defines the versioned schema of this representation
  2057.               of an object. Servers should convert recognized schemas to the latest
  2058.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2059.             type: string
  2060.           kind:
  2061.             description: 'Kind is a string value representing the REST resource this
  2062.               object represents. Servers may infer this from the endpoint the client
  2063.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2064.             type: string
  2065.           metadata:
  2066.             type: object
  2067.           spec:
  2068.             description: IPAMHandleSpec contains the specification for an IPAMHandle
  2069.               resource.
  2070.             properties:
  2071.               block:
  2072.                 additionalProperties:
  2073.                   type: integer
  2074.                 type: object
  2075.               deleted:
  2076.                 type: boolean
  2077.               handleID:
  2078.                 type: string
  2079.             required:
  2080.             - block
  2081.             - handleID
  2082.             type: object
  2083.         type: object
  2084.     served: true
  2085.     storage: true
  2086. status:
  2087.   acceptedNames:
  2088.     kind: ""
  2089.     plural: ""
  2090.   conditions: []
  2091.   storedVersions: []
  2092.  
  2093. ---
  2094. apiVersion: apiextensions.k8s.io/v1
  2095. kind: CustomResourceDefinition
  2096. metadata:
  2097.   name: ippools.crd.projectcalico.org
  2098. spec:
  2099.   group: crd.projectcalico.org
  2100.   names:
  2101.     kind: IPPool
  2102.     listKind: IPPoolList
  2103.     plural: ippools
  2104.     singular: ippool
  2105.   scope: Cluster
  2106.   versions:
  2107.   - name: v1
  2108.     schema:
  2109.       openAPIV3Schema:
  2110.         properties:
  2111.           apiVersion:
  2112.             description: 'APIVersion defines the versioned schema of this representation
  2113.               of an object. Servers should convert recognized schemas to the latest
  2114.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2115.             type: string
  2116.           kind:
  2117.             description: 'Kind is a string value representing the REST resource this
  2118.               object represents. Servers may infer this from the endpoint the client
  2119.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2120.             type: string
  2121.           metadata:
  2122.             type: object
  2123.           spec:
  2124.             description: IPPoolSpec contains the specification for an IPPool resource.
  2125.             properties:
  2126.               blockSize:
  2127.                 description: The block size to use for IP address assignments from
  2128.                   this pool. Defaults to 26 for IPv4 and 112 for IPv6.
  2129.                 type: integer
  2130.               cidr:
  2131.                 description: The pool CIDR.
  2132.                 type: string
  2133.               disabled:
  2134.                 description: When disabled is true, Calico IPAM will not assign addresses
  2135.                   from this pool.
  2136.                 type: boolean
  2137.               ipip:
  2138.                 description: 'Deprecated: this field is only used for APIv1 backwards
  2139.                   compatibility. Setting this field is not allowed, this field is
  2140.                   for internal use only.'
  2141.                 properties:
  2142.                   enabled:
  2143.                     description: When enabled is true, ipip tunneling will be used
  2144.                       to deliver packets to destinations within this pool.
  2145.                     type: boolean
  2146.                   mode:
  2147.                     description: The IPIP mode.  This can be one of "always" or "cross-subnet".  A
  2148.                       mode of "always" will also use IPIP tunneling for routing to
  2149.                       destination IP addresses within this pool.  A mode of "cross-subnet"
  2150.                       will only use IPIP tunneling when the destination node is on
  2151.                       a different subnet to the originating node.  The default value
  2152.                       (if not specified) is "always".
  2153.                     type: string
  2154.                 type: object
  2155.               ipipMode:
  2156.                 description: Contains configuration for IPIP tunneling for this pool.
  2157.                   If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling
  2158.                   is disabled).
  2159.                 type: string
  2160.               nat-outgoing:
  2161.                 description: 'Deprecated: this field is only used for APIv1 backwards
  2162.                   compatibility. Setting this field is not allowed, this field is
  2163.                   for internal use only.'
  2164.                 type: boolean
  2165.               natOutgoing:
  2166.                 description: When nat-outgoing is true, packets sent from Calico networked
  2167.                   containers in this pool to destinations outside of this pool will
  2168.                   be masqueraded.
  2169.                 type: boolean
  2170.               nodeSelector:
  2171.                 description: Allows IPPool to allocate for a specific node by label
  2172.                   selector.
  2173.                 type: string
  2174.               vxlanMode:
  2175.                 description: Contains configuration for VXLAN tunneling for this pool.
  2176.                   If not specified, then this is defaulted to "Never" (i.e. VXLAN
  2177.                   tunneling is disabled).
  2178.                 type: string
  2179.             required:
  2180.             - cidr
  2181.             type: object
  2182.         type: object
  2183.     served: true
  2184.     storage: true
  2185. status:
  2186.   acceptedNames:
  2187.     kind: ""
  2188.     plural: ""
  2189.   conditions: []
  2190.   storedVersions: []
  2191.  
  2192. ---
  2193. apiVersion: apiextensions.k8s.io/v1
  2194. kind: CustomResourceDefinition
  2195. metadata:
  2196.   name: kubecontrollersconfigurations.crd.projectcalico.org
  2197. spec:
  2198.   group: crd.projectcalico.org
  2199.   names:
  2200.     kind: KubeControllersConfiguration
  2201.     listKind: KubeControllersConfigurationList
  2202.     plural: kubecontrollersconfigurations
  2203.     singular: kubecontrollersconfiguration
  2204.   scope: Cluster
  2205.   versions:
  2206.   - name: v1
  2207.     schema:
  2208.       openAPIV3Schema:
  2209.         properties:
  2210.           apiVersion:
  2211.             description: 'APIVersion defines the versioned schema of this representation
  2212.               of an object. Servers should convert recognized schemas to the latest
  2213.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2214.             type: string
  2215.           kind:
  2216.             description: 'Kind is a string value representing the REST resource this
  2217.               object represents. Servers may infer this from the endpoint the client
  2218.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2219.             type: string
  2220.           metadata:
  2221.             type: object
  2222.           spec:
  2223.             description: KubeControllersConfigurationSpec contains the values of the
  2224.               Kubernetes controllers configuration.
  2225.             properties:
  2226.               controllers:
  2227.                 description: Controllers enables and configures individual Kubernetes
  2228.                   controllers
  2229.                 properties:
  2230.                   namespace:
  2231.                     description: Namespace enables and configures the namespace controller.
  2232.                       Enabled by default, set to nil to disable.
  2233.                     properties:
  2234.                       reconcilerPeriod:
  2235.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2236.                           with the Calico datastore. [Default: 5m]'
  2237.                         type: string
  2238.                     type: object
  2239.                   node:
  2240.                     description: Node enables and configures the node controller.
  2241.                       Enabled by default, set to nil to disable.
  2242.                     properties:
  2243.                       hostEndpoint:
  2244.                         description: HostEndpoint controls syncing nodes to host endpoints.
  2245.                           Disabled by default, set to nil to disable.
  2246.                         properties:
  2247.                           autoCreate:
  2248.                             description: 'AutoCreate enables automatic creation of
  2249.                               host endpoints for every node. [Default: Disabled]'
  2250.                             type: string
  2251.                         type: object
  2252.                       reconcilerPeriod:
  2253.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2254.                           with the Calico datastore. [Default: 5m]'
  2255.                         type: string
  2256.                       syncLabels:
  2257.                         description: 'SyncLabels controls whether to copy Kubernetes
  2258.                           node labels to Calico nodes. [Default: Enabled]'
  2259.                         type: string
  2260.                     type: object
  2261.                   policy:
  2262.                     description: Policy enables and configures the policy controller.
  2263.                       Enabled by default, set to nil to disable.
  2264.                     properties:
  2265.                       reconcilerPeriod:
  2266.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2267.                           with the Calico datastore. [Default: 5m]'
  2268.                         type: string
  2269.                     type: object
  2270.                   serviceAccount:
  2271.                     description: ServiceAccount enables and configures the service
  2272.                       account controller. Enabled by default, set to nil to disable.
  2273.                     properties:
  2274.                       reconcilerPeriod:
  2275.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2276.                           with the Calico datastore. [Default: 5m]'
  2277.                         type: string
  2278.                     type: object
  2279.                   workloadEndpoint:
  2280.                     description: WorkloadEndpoint enables and configures the workload
  2281.                       endpoint controller. Enabled by default, set to nil to disable.
  2282.                     properties:
  2283.                       reconcilerPeriod:
  2284.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2285.                           with the Calico datastore. [Default: 5m]'
  2286.                         type: string
  2287.                     type: object
  2288.                 type: object
  2289.               etcdV3CompactionPeriod:
  2290.                 description: 'EtcdV3CompactionPeriod is the period between etcdv3
  2291.                   compaction requests. Set to 0 to disable. [Default: 10m]'
  2292.                 type: string
  2293.               healthChecks:
  2294.                 description: 'HealthChecks enables or disables support for health
  2295.                   checks [Default: Enabled]'
  2296.                 type: string
  2297.               logSeverityScreen:
  2298.                 description: 'LogSeverityScreen is the log severity above which logs
  2299.                   are sent to the stdout. [Default: Info]'
  2300.                 type: string
  2301.             required:
  2302.             - controllers
  2303.             type: object
  2304.           status:
  2305.             description: KubeControllersConfigurationStatus represents the status
  2306.               of the configuration. It's useful for admins to be able to see the actual
  2307.               config that was applied, which can be modified by environment variables
  2308.               on the kube-controllers process.
  2309.             properties:
  2310.               environmentVars:
  2311.                 additionalProperties:
  2312.                   type: string
  2313.                 description: EnvironmentVars contains the environment variables on
  2314.                   the kube-controllers that influenced the RunningConfig.
  2315.                 type: object
  2316.               runningConfig:
  2317.                 description: RunningConfig contains the effective config that is running
  2318.                   in the kube-controllers pod, after merging the API resource with
  2319.                   any environment variables.
  2320.                 properties:
  2321.                   controllers:
  2322.                     description: Controllers enables and configures individual Kubernetes
  2323.                       controllers
  2324.                     properties:
  2325.                       namespace:
  2326.                         description: Namespace enables and configures the namespace
  2327.                           controller. Enabled by default, set to nil to disable.
  2328.                         properties:
  2329.                           reconcilerPeriod:
  2330.                             description: 'ReconcilerPeriod is the period to perform
  2331.                               reconciliation with the Calico datastore. [Default:
  2332.                               5m]'
  2333.                             type: string
  2334.                         type: object
  2335.                       node:
  2336.                         description: Node enables and configures the node controller.
  2337.                           Enabled by default, set to nil to disable.
  2338.                         properties:
  2339.                           hostEndpoint:
  2340.                             description: HostEndpoint controls syncing nodes to host
  2341.                               endpoints. Disabled by default, set to nil to disable.
  2342.                             properties:
  2343.                               autoCreate:
  2344.                                 description: 'AutoCreate enables automatic creation
  2345.                                   of host endpoints for every node. [Default: Disabled]'
  2346.                                 type: string
  2347.                             type: object
  2348.                           reconcilerPeriod:
  2349.                             description: 'ReconcilerPeriod is the period to perform
  2350.                               reconciliation with the Calico datastore. [Default:
  2351.                               5m]'
  2352.                             type: string
  2353.                           syncLabels:
  2354.                             description: 'SyncLabels controls whether to copy Kubernetes
  2355.                               node labels to Calico nodes. [Default: Enabled]'
  2356.                             type: string
  2357.                         type: object
  2358.                       policy:
  2359.                         description: Policy enables and configures the policy controller.
  2360.                           Enabled by default, set to nil to disable.
  2361.                         properties:
  2362.                           reconcilerPeriod:
  2363.                             description: 'ReconcilerPeriod is the period to perform
  2364.                               reconciliation with the Calico datastore. [Default:
  2365.                               5m]'
  2366.                             type: string
  2367.                         type: object
  2368.                       serviceAccount:
  2369.                         description: ServiceAccount enables and configures the service
  2370.                           account controller. Enabled by default, set to nil to disable.
  2371.                         properties:
  2372.                           reconcilerPeriod:
  2373.                             description: 'ReconcilerPeriod is the period to perform
  2374.                               reconciliation with the Calico datastore. [Default:
  2375.                               5m]'
  2376.                             type: string
  2377.                         type: object
  2378.                       workloadEndpoint:
  2379.                         description: WorkloadEndpoint enables and configures the workload
  2380.                           endpoint controller. Enabled by default, set to nil to disable.
  2381.                         properties:
  2382.                           reconcilerPeriod:
  2383.                             description: 'ReconcilerPeriod is the period to perform
  2384.                               reconciliation with the Calico datastore. [Default:
  2385.                               5m]'
  2386.                             type: string
  2387.                         type: object
  2388.                     type: object
  2389.                   etcdV3CompactionPeriod:
  2390.                     description: 'EtcdV3CompactionPeriod is the period between etcdv3
  2391.                       compaction requests. Set to 0 to disable. [Default: 10m]'
  2392.                     type: string
  2393.                   healthChecks:
  2394.                     description: 'HealthChecks enables or disables support for health
  2395.                       checks [Default: Enabled]'
  2396.                     type: string
  2397.                   logSeverityScreen:
  2398.                     description: 'LogSeverityScreen is the log severity above which
  2399.                       logs are sent to the stdout. [Default: Info]'
  2400.                     type: string
  2401.                 required:
  2402.                 - controllers
  2403.                 type: object
  2404.             type: object
  2405.         type: object
  2406.     served: true
  2407.     storage: true
  2408. status:
  2409.   acceptedNames:
  2410.     kind: ""
  2411.     plural: ""
  2412.   conditions: []
  2413.   storedVersions: []
  2415. ---
  2416. apiVersion: apiextensions.k8s.io/v1
  2417. kind: CustomResourceDefinition
  2418. metadata:
  2419.   name: networkpolicies.crd.projectcalico.org
  2420. spec:
  2421.   group: crd.projectcalico.org
  2422.   names:
  2423.     kind: NetworkPolicy
  2424.     listKind: NetworkPolicyList
  2425.     plural: networkpolicies
  2426.     singular: networkpolicy
  2427.   scope: Namespaced
  2428.   versions:
  2429.   - name: v1
  2430.     schema:
  2431.       openAPIV3Schema:
  2432.         properties:
  2433.           apiVersion:
  2434.             description: 'APIVersion defines the versioned schema of this representation
  2435.               of an object. Servers should convert recognized schemas to the latest
  2436.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2437.             type: string
  2438.           kind:
  2439.             description: 'Kind is a string value representing the REST resource this
  2440.               object represents. Servers may infer this from the endpoint the client
  2441.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2442.             type: string
  2443.           metadata:
  2444.             type: object
  2445.           spec:
  2446.             properties:
  2447.               egress:
  2448.                 description: The ordered set of egress rules.  Each rule contains
  2449.                   a set of packet match criteria and a corresponding action to apply.
  2450.                 items:
  2451.                   description: "A Rule encapsulates a set of match criteria and an
  2452.                     action.  Both selector-based security Policy and security Profiles
  2453.                     reference rules - separated out as a list of rules for both ingress
  2454.                     and egress packet matching. \n Each positive match criteria has
  2455.                     a negated version, prefixed with 鈥漀ot鈥�. All the match criteria
  2456.                     within a rule must be satisfied for a packet to match. A single
  2457.                     rule can contain the positive and negative version of a match
  2458.                     and both must be satisfied for the rule to match."
  2459.                   properties:
  2460.                     action:
  2461.                       type: string
  2462.                     destination:
  2463.                       description: Destination contains the match criteria that apply
  2464.                         to destination entity.
  2465.                       properties:
  2466.                         namespaceSelector:
  2467.                           description: "NamespaceSelector is an optional field that
  2468.                             contains a selector expression. Only traffic that originates
  2469.                             from (or terminates at) endpoints within the selected
  2470.                             namespaces will be matched. When both NamespaceSelector
  2471.                             and Selector are defined on the same rule, then only workload
  2472.                             endpoints that are matched by both selectors will be selected
  2473.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  2474.                             implies that the Selector is limited to selecting only
  2475.                             workload endpoints in the same namespace as the NetworkPolicy.
  2476.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  2477.                             that the Selector is limited to selecting only GlobalNetworkSet
  2478.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  2479.                             NamespaceSelector implies the Selector applies to workload
  2480.                             endpoints across all namespaces."
  2481.                           type: string
  2482.                         nets:
  2483.                           description: Nets is an optional field that restricts the
  2484.                             rule to only apply to traffic that originates from (or
  2485.                             terminates at) IP addresses in any of the given subnets.
  2486.                           items:
  2487.                             type: string
  2488.                           type: array
  2489.                         notNets:
  2490.                           description: NotNets is the negated version of the Nets
  2491.                             field.
  2492.                           items:
  2493.                             type: string
  2494.                           type: array
  2495.                         notPorts:
  2496.                           description: NotPorts is the negated version of the Ports
  2497.                             field. Since only some protocols have ports, if any ports
  2498.                             are specified it requires the Protocol match in the Rule
  2499.                             to be set to "TCP" or "UDP".
  2500.                           items:
  2501.                             anyOf:
  2502.                             - type: integer
  2503.                             - type: string
  2504.                             pattern: ^.*
  2505.                             x-kubernetes-int-or-string: true
  2506.                           type: array
  2507.                         notSelector:
  2508.                           description: NotSelector is the negated version of the Selector
  2509.                             field.  See Selector field for subtleties with negated
  2510.                             selectors.
  2511.                           type: string
  2512.                         ports:
  2513.                           description: "Ports is an optional field that restricts
  2514.                             the rule to only apply to traffic that has a source (destination)
  2515.                             port that matches one of these ranges/values. This value
  2516.                             is a list of integers or strings that represent ranges
  2517.                             of ports. \n Since only some protocols have ports, if
  2518.                             any ports are specified it requires the Protocol match
  2519.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  2520.                           items:
  2521.                             anyOf:
  2522.                             - type: integer
  2523.                             - type: string
  2524.                             pattern: ^.*
  2525.                             x-kubernetes-int-or-string: true
  2526.                           type: array
  2527.                         selector:
  2528.                           description: "Selector is an optional field that contains
  2529.                             a selector expression (see Policy for sample syntax).
  2530.                             \ Only traffic that originates from (terminates at) endpoints
  2531.                             matching the selector will be matched. \n Note that: in
  2532.                             addition to the negated version of the Selector (see NotSelector
  2533.                             below), the selector expression syntax itself supports
  2534.                             negation.  The two types of negation are subtly different.
  2535.                             One negates the set of matched endpoints, the other negates
  2536.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  2537.                             packets that are from other Calico-controlled \tendpoints
  2538.                             that do not have the label 鈥渕y_label鈥�. \n \tNotSelector
  2539.                             = \"has(my_label)\" matches packets that are not from
  2540.                             Calico-controlled \tendpoints that do have the label 鈥渕y_label鈥�.
  2541.                             \n The effect is that the latter will accept packets from
  2542.                             non-Calico sources whereas the former is limited to packets
  2543.                             from Calico-controlled endpoints."
  2544.                           type: string
  2545.                         serviceAccounts:
  2546.                           description: ServiceAccounts is an optional field that restricts
  2547.                             the rule to only apply to traffic that originates from
  2548.                             (or terminates at) a pod running as a matching service
  2549.                             account.
  2550.                           properties:
  2551.                             names:
  2552.                               description: Names is an optional field that restricts
  2553.                                 the rule to only apply to traffic that originates
  2554.                                 from (or terminates at) a pod running as a service
  2555.                                 account whose name is in the list.
  2556.                               items:
  2557.                                 type: string
  2558.                               type: array
  2559.                             selector:
  2560.                               description: Selector is an optional field that restricts
  2561.                                 the rule to only apply to traffic that originates
  2562.                                 from (or terminates at) a pod running as a service
  2563.                                 account that matches the given label selector. If
  2564.                                 both Names and Selector are specified then they are
  2565.                                 AND'ed.
  2566.                               type: string
  2567.                           type: object
  2568.                       type: object
  2569.                     http:
  2570.                       description: HTTP contains match criteria that apply to HTTP
  2571.                         requests.
  2572.                       properties:
  2573.                         methods:
  2574.                           description: Methods is an optional field that restricts
  2575.                             the rule to apply only to HTTP requests that use one of
  2576.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  2577.                             methods are OR'd together.
  2578.                           items:
  2579.                             type: string
  2580.                           type: array
  2581.                         paths:
  2582.                           description: 'Paths is an optional field that restricts
  2583.                             the rule to apply to HTTP requests that use one of the
  2584.                             listed HTTP Paths. Multiple paths are OR''d together.
  2585.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  2586.                             ONLY specify either a `exact` or a `prefix` match. The
  2587.                             validator will check for it.'
  2588.                           items:
  2589.                             description: 'HTTPPath specifies an HTTP path to match.
  2590.                               It may be either of the form: exact: <path>: which matches
  2591.                               the path exactly or prefix: <path-prefix>: which matches
  2592.                               the path prefix'
  2593.                             properties:
  2594.                               exact:
  2595.                                 type: string
  2596.                               prefix:
  2597.                                 type: string
  2598.                             type: object
  2599.                           type: array
  2600.                       type: object
  2601.                     icmp:
  2602.                       description: ICMP is an optional field that restricts the rule
  2603.                         to apply to a specific type and code of ICMP traffic.  This
  2604.                         should only be specified if the Protocol field is set to "ICMP"
  2605.                         or "ICMPv6".
  2606.                       properties:
  2607.                         code:
  2608.                           description: Match on a specific ICMP code.  If specified,
  2609.                             the Type value must also be specified. This is a technical
  2610.                             limitation imposed by the kernel's iptables firewall,
  2611.                             which Calico uses to enforce the rule.
  2612.                           type: integer
  2613.                         type:
  2614.                           description: Match on a specific ICMP type.  For example
  2615.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2616.                           type: integer
  2617.                       type: object
  2618.                     ipVersion:
  2619.                       description: IPVersion is an optional field that restricts the
  2620.                         rule to only match a specific IP version.
  2621.                       type: integer
  2622.                     metadata:
  2623.                       description: Metadata contains additional information for this
  2624.                         rule
  2625.                       properties:
  2626.                         annotations:
  2627.                           additionalProperties:
  2628.                             type: string
  2629.                           description: Annotations is a set of key value pairs that
  2630.                             give extra information about the rule
  2631.                           type: object
  2632.                       type: object
  2633.                     notICMP:
  2634.                       description: NotICMP is the negated version of the ICMP field.
  2635.                       properties:
  2636.                         code:
  2637.                           description: Match on a specific ICMP code.  If specified,
  2638.                             the Type value must also be specified. This is a technical
  2639.                             limitation imposed by the kernel's iptables firewall,
  2640.                             which Calico uses to enforce the rule.
  2641.                           type: integer
  2642.                         type:
  2643.                           description: Match on a specific ICMP type.  For example
  2644.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2645.                           type: integer
  2646.                       type: object
  2647.                     notProtocol:
  2648.                       anyOf:
  2649.                       - type: integer
  2650.                       - type: string
  2651.                       description: NotProtocol is the negated version of the Protocol
  2652.                         field.
  2653.                       pattern: ^.*
  2654.                       x-kubernetes-int-or-string: true
  2655.                     protocol:
  2656.                       anyOf:
  2657.                       - type: integer
  2658.                       - type: string
  2659.                       description: "Protocol is an optional field that restricts the
  2660.                         rule to only apply to traffic of a specific IP protocol. Required
  2661.                         if any of the EntityRules contain Ports (because ports only
  2662.                         apply to certain protocols). \n Must be one of these string
  2663.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  2664.                         \"UDPLite\" or an integer in the range 1-255."
  2665.                       pattern: ^.*
  2666.                       x-kubernetes-int-or-string: true
  2667.                     source:
  2668.                       description: Source contains the match criteria that apply to
  2669.                         source entity.
  2670.                       properties:
  2671.                         namespaceSelector:
  2672.                           description: "NamespaceSelector is an optional field that
  2673.                             contains a selector expression. Only traffic that originates
  2674.                             from (or terminates at) endpoints within the selected
  2675.                             namespaces will be matched. When both NamespaceSelector
  2676.                             and Selector are defined on the same rule, then only workload
  2677.                             endpoints that are matched by both selectors will be selected
  2678.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  2679.                             implies that the Selector is limited to selecting only
  2680.                             workload endpoints in the same namespace as the NetworkPolicy.
  2681.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  2682.                             that the Selector is limited to selecting only GlobalNetworkSet
  2683.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  2684.                             NamespaceSelector implies the Selector applies to workload
  2685.                             endpoints across all namespaces."
  2686.                           type: string
  2687.                         nets:
  2688.                           description: Nets is an optional field that restricts the
  2689.                             rule to only apply to traffic that originates from (or
  2690.                             terminates at) IP addresses in any of the given subnets.
  2691.                           items:
  2692.                             type: string
  2693.                           type: array
  2694.                         notNets:
  2695.                           description: NotNets is the negated version of the Nets
  2696.                             field.
  2697.                           items:
  2698.                             type: string
  2699.                           type: array
  2700.                         notPorts:
  2701.                           description: NotPorts is the negated version of the Ports
  2702.                             field. Since only some protocols have ports, if any ports
  2703.                             are specified it requires the Protocol match in the Rule
  2704.                             to be set to "TCP" or "UDP".
  2705.                           items:
  2706.                             anyOf:
  2707.                             - type: integer
  2708.                             - type: string
  2709.                             pattern: ^.*
  2710.                             x-kubernetes-int-or-string: true
  2711.                           type: array
  2712.                         notSelector:
  2713.                           description: NotSelector is the negated version of the Selector
  2714.                             field.  See Selector field for subtleties with negated
  2715.                             selectors.
  2716.                           type: string
  2717.                         ports:
  2718.                           description: "Ports is an optional field that restricts
  2719.                             the rule to only apply to traffic that has a source (destination)
  2720.                             port that matches one of these ranges/values. This value
  2721.                             is a list of integers or strings that represent ranges
  2722.                             of ports. \n Since only some protocols have ports, if
  2723.                             any ports are specified it requires the Protocol match
  2724.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  2725.                           items:
  2726.                             anyOf:
  2727.                             - type: integer
  2728.                             - type: string
  2729.                             pattern: ^.*
  2730.                             x-kubernetes-int-or-string: true
  2731.                           type: array
  2732.                         selector:
  2733.                           description: "Selector is an optional field that contains
  2734.                             a selector expression (see Policy for sample syntax).
  2735.                             \ Only traffic that originates from (terminates at) endpoints
  2736.                             matching the selector will be matched. \n Note that: in
  2737.                             addition to the negated version of the Selector (see NotSelector
  2738.                             below), the selector expression syntax itself supports
  2739.                             negation.  The two types of negation are subtly different.
  2740.                             One negates the set of matched endpoints, the other negates
  2741.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  2742.                             packets that are from other Calico-controlled \tendpoints
  2743.                             that do not have the label 鈥渕y_label鈥�. \n \tNotSelector
  2744.                             = \"has(my_label)\" matches packets that are not from
  2745.                             Calico-controlled \tendpoints that do have the label 鈥渕y_label鈥�.
  2746.                             \n The effect is that the latter will accept packets from
  2747.                             non-Calico sources whereas the former is limited to packets
  2748.                             from Calico-controlled endpoints."
  2749.                           type: string
  2750.                         serviceAccounts:
  2751.                           description: ServiceAccounts is an optional field that restricts
  2752.                             the rule to only apply to traffic that originates from
  2753.                             (or terminates at) a pod running as a matching service
  2754.                             account.
  2755.                           properties:
  2756.                             names:
  2757.                               description: Names is an optional field that restricts
  2758.                                 the rule to only apply to traffic that originates
  2759.                                 from (or terminates at) a pod running as a service
  2760.                                 account whose name is in the list.
  2761.                               items:
  2762.                                 type: string
  2763.                               type: array
  2764.                             selector:
  2765.                               description: Selector is an optional field that restricts
  2766.                                 the rule to only apply to traffic that originates
  2767.                                 from (or terminates at) a pod running as a service
  2768.                                 account that matches the given label selector. If
  2769.                                 both Names and Selector are specified then they are
  2770.                                 AND'ed.
  2771.                               type: string
  2772.                           type: object
  2773.                       type: object
  2774.                   required:
  2775.                   - action
  2776.                   type: object
  2777.                 type: array
  2778.               ingress:
  2779.                 description: The ordered set of ingress rules.  Each rule contains
  2780.                   a set of packet match criteria and a corresponding action to apply.
  2781.                 items:
  2782.                   description: "A Rule encapsulates a set of match criteria and an
  2783.                     action.  Both selector-based security Policy and security Profiles
  2784.                     reference rules - separated out as a list of rules for both ingress
  2785.                     and egress packet matching. \n Each positive match criteria has
  2786.                     a negated version, prefixed with 鈥漀ot鈥�. All the match criteria
  2787.                     within a rule must be satisfied for a packet to match. A single
  2788.                     rule can contain the positive and negative version of a match
  2789.                     and both must be satisfied for the rule to match."
  2790.                   properties:
  2791.                     action:
  2792.                       type: string
  2793.                     destination:
  2794.                       description: Destination contains the match criteria that apply
  2795.                         to destination entity.
  2796.                       properties:
  2797.                         namespaceSelector:
  2798.                           description: "NamespaceSelector is an optional field that
  2799.                             contains a selector expression. Only traffic that originates
  2800.                             from (or terminates at) endpoints within the selected
  2801.                             namespaces will be matched. When both NamespaceSelector
  2802.                             and Selector are defined on the same rule, then only workload
  2803.                             endpoints that are matched by both selectors will be selected
  2804.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  2805.                             implies that the Selector is limited to selecting only
  2806.                             workload endpoints in the same namespace as the NetworkPolicy.
  2807.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  2808.                             that the Selector is limited to selecting only GlobalNetworkSet
  2809.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  2810.                             NamespaceSelector implies the Selector applies to workload
  2811.                             endpoints across all namespaces."
  2812.                           type: string
  2813.                         nets:
  2814.                           description: Nets is an optional field that restricts the
  2815.                             rule to only apply to traffic that originates from (or
  2816.                             terminates at) IP addresses in any of the given subnets.
  2817.                           items:
  2818.                             type: string
  2819.                           type: array
  2820.                         notNets:
  2821.                           description: NotNets is the negated version of the Nets
  2822.                             field.
  2823.                           items:
  2824.                             type: string
  2825.                           type: array
  2826.                         notPorts:
  2827.                           description: NotPorts is the negated version of the Ports
  2828.                             field. Since only some protocols have ports, if any ports
  2829.                             are specified it requires the Protocol match in the Rule
  2830.                             to be set to "TCP" or "UDP".
  2831.                           items:
  2832.                             anyOf:
  2833.                             - type: integer
  2834.                             - type: string
  2835.                             pattern: ^.*
  2836.                             x-kubernetes-int-or-string: true
  2837.                           type: array
  2838.                         notSelector:
  2839.                           description: NotSelector is the negated version of the Selector
  2840.                             field.  See Selector field for subtleties with negated
  2841.                             selectors.
  2842.                           type: string
  2843.                         ports:
  2844.                           description: "Ports is an optional field that restricts
  2845.                             the rule to only apply to traffic that has a source (destination)
  2846.                             port that matches one of these ranges/values. This value
  2847.                             is a list of integers or strings that represent ranges
  2848.                             of ports. \n Since only some protocols have ports, if
  2849.                             any ports are specified it requires the Protocol match
  2850.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  2851.                           items:
  2852.                             anyOf:
  2853.                             - type: integer
  2854.                             - type: string
  2855.                             pattern: ^.*
  2856.                             x-kubernetes-int-or-string: true
  2857.                           type: array
  2858.                         selector:
  2859.                           description: "Selector is an optional field that contains
  2860.                             a selector expression (see Policy for sample syntax).
  2861.                             \ Only traffic that originates from (terminates at) endpoints
  2862.                             matching the selector will be matched. \n Note that: in
  2863.                             addition to the negated version of the Selector (see NotSelector
  2864.                             below), the selector expression syntax itself supports
  2865.                             negation.  The two types of negation are subtly different.
  2866.                             One negates the set of matched endpoints, the other negates
  2867.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  2868.                             packets that are from other Calico-controlled \tendpoints
  2869.                             that do not have the label 鈥渕y_label鈥�. \n \tNotSelector
  2870.                             = \"has(my_label)\" matches packets that are not from
  2871.                             Calico-controlled \tendpoints that do have the label 鈥渕y_label鈥�.
  2872.                             \n The effect is that the latter will accept packets from
  2873.                             non-Calico sources whereas the former is limited to packets
  2874.                             from Calico-controlled endpoints."
  2875.                           type: string
  2876.                         serviceAccounts:
  2877.                           description: ServiceAccounts is an optional field that restricts
  2878.                             the rule to only apply to traffic that originates from
  2879.                             (or terminates at) a pod running as a matching service
  2880.                             account.
  2881.                           properties:
  2882.                             names:
  2883.                               description: Names is an optional field that restricts
  2884.                                 the rule to only apply to traffic that originates
  2885.                                 from (or terminates at) a pod running as a service
  2886.                                 account whose name is in the list.
  2887.                               items:
  2888.                                 type: string
  2889.                               type: array
  2890.                             selector:
  2891.                               description: Selector is an optional field that restricts
  2892.                                 the rule to only apply to traffic that originates
  2893.                                 from (or terminates at) a pod running as a service
  2894.                                 account that matches the given label selector. If
  2895.                                 both Names and Selector are specified then they are
  2896.                                 AND'ed.
  2897.                               type: string
  2898.                           type: object
  2899.                       type: object
  2900.                     http:
  2901.                       description: HTTP contains match criteria that apply to HTTP
  2902.                         requests.
  2903.                       properties:
  2904.                         methods:
  2905.                           description: Methods is an optional field that restricts
  2906.                             the rule to apply only to HTTP requests that use one of
  2907.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  2908.                             methods are OR'd together.
  2909.                           items:
  2910.                             type: string
  2911.                           type: array
  2912.                         paths:
  2913.                           description: 'Paths is an optional field that restricts
  2914.                             the rule to apply to HTTP requests that use one of the
  2915.                             listed HTTP Paths. Multiple paths are OR''d together.
  2916.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  2917.                             ONLY specify either a `exact` or a `prefix` match. The
  2918.                             validator will check for it.'
  2919.                           items:
  2920.                             description: 'HTTPPath specifies an HTTP path to match.
  2921.                               It may be either of the form: exact: <path>: which matches
  2922.                               the path exactly or prefix: <path-prefix>: which matches
  2923.                               the path prefix'
  2924.                             properties:
  2925.                               exact:
  2926.                                 type: string
  2927.                               prefix:
  2928.                                 type: string
  2929.                             type: object
  2930.                           type: array
  2931.                       type: object
  2932.                     icmp:
  2933.                       description: ICMP is an optional field that restricts the rule
  2934.                         to apply to a specific type and code of ICMP traffic.  This
  2935.                         should only be specified if the Protocol field is set to "ICMP"
  2936.                         or "ICMPv6".
  2937.                       properties:
  2938.                         code:
  2939.                           description: Match on a specific ICMP code.  If specified,
  2940.                             the Type value must also be specified. This is a technical
  2941.                             limitation imposed by the kernel's iptables firewall,
  2942.                             which Calico uses to enforce the rule.
  2943.                           type: integer
  2944.                         type:
  2945.                           description: Match on a specific ICMP type.  For example
  2946.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2947.                           type: integer
  2948.                       type: object
  2949.                     ipVersion:
  2950.                       description: IPVersion is an optional field that restricts the
  2951.                         rule to only match a specific IP version.
  2952.                       type: integer
  2953.                     metadata:
  2954.                       description: Metadata contains additional information for this
  2955.                         rule
  2956.                       properties:
  2957.                         annotations:
  2958.                           additionalProperties:
  2959.                             type: string
  2960.                           description: Annotations is a set of key value pairs that
  2961.                             give extra information about the rule
  2962.                           type: object
  2963.                       type: object
  2964.                     notICMP:
  2965.                       description: NotICMP is the negated version of the ICMP field.
  2966.                       properties:
  2967.                         code:
  2968.                           description: Match on a specific ICMP code.  If specified,
  2969.                             the Type value must also be specified. This is a technical
  2970.                             limitation imposed by the kernel's iptables firewall,
  2971.                             which Calico uses to enforce the rule.
  2972.                           type: integer
  2973.                         type:
  2974.                           description: Match on a specific ICMP type.  For example
  2975.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2976.                           type: integer
  2977.                       type: object
  2978.                     notProtocol:
  2979.                       anyOf:
  2980.                       - type: integer
  2981.                       - type: string
  2982.                       description: NotProtocol is the negated version of the Protocol
  2983.                         field.
  2984.                       pattern: ^.*
  2985.                       x-kubernetes-int-or-string: true
  2986.                     protocol:
  2987.                       anyOf:
  2988.                       - type: integer
  2989.                       - type: string
  2990.                       description: "Protocol is an optional field that restricts the
  2991.                         rule to only apply to traffic of a specific IP protocol. Required
  2992.                         if any of the EntityRules contain Ports (because ports only
  2993.                         apply to certain protocols). \n Must be one of these string
  2994.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  2995.                         \"UDPLite\" or an integer in the range 1-255."
  2996.                       pattern: ^.*
  2997.                       x-kubernetes-int-or-string: true
  2998.                     source:
  2999.                       description: Source contains the match criteria that apply to
  3000.                         source entity.
  3001.                       properties:
  3002.                         namespaceSelector:
  3003.                           description: "NamespaceSelector is an optional field that
  3004.                             contains a selector expression. Only traffic that originates
  3005.                             from (or terminates at) endpoints within the selected
  3006.                             namespaces will be matched. When both NamespaceSelector
  3007.                             and Selector are defined on the same rule, then only workload
  3008.                             endpoints that are matched by both selectors will be selected
  3009.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  3010.                             implies that the Selector is limited to selecting only
  3011.                             workload endpoints in the same namespace as the NetworkPolicy.
  3012.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  3013.                             that the Selector is limited to selecting only GlobalNetworkSet
  3014.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  3015.                             NamespaceSelector implies the Selector applies to workload
  3016.                             endpoints across all namespaces."
  3017.                           type: string
  3018.                         nets:
  3019.                           description: Nets is an optional field that restricts the
  3020.                             rule to only apply to traffic that originates from (or
  3021.                             terminates at) IP addresses in any of the given subnets.
  3022.                           items:
  3023.                             type: string
  3024.                           type: array
  3025.                         notNets:
  3026.                           description: NotNets is the negated version of the Nets
  3027.                             field.
  3028.                           items:
  3029.                             type: string
  3030.                           type: array
  3031.                         notPorts:
  3032.                           description: NotPorts is the negated version of the Ports
  3033.                             field. Since only some protocols have ports, if any ports
  3034.                             are specified it requires the Protocol match in the Rule
  3035.                             to be set to "TCP" or "UDP".
  3036.                           items:
  3037.                             anyOf:
  3038.                             - type: integer
  3039.                             - type: string
  3040.                             pattern: ^.*
  3041.                             x-kubernetes-int-or-string: true
  3042.                           type: array
  3043.                         notSelector:
  3044.                           description: NotSelector is the negated version of the Selector
  3045.                             field.  See Selector field for subtleties with negated
  3046.                             selectors.
  3047.                           type: string
  3048.                         ports:
  3049.                           description: "Ports is an optional field that restricts
  3050.                             the rule to only apply to traffic that has a source (destination)
  3051.                             port that matches one of these ranges/values. This value
  3052.                             is a list of integers or strings that represent ranges
  3053.                             of ports. \n Since only some protocols have ports, if
  3054.                             any ports are specified it requires the Protocol match
  3055.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  3056.                           items:
  3057.                             anyOf:
  3058.                             - type: integer
  3059.                             - type: string
  3060.                             pattern: ^.*
  3061.                             x-kubernetes-int-or-string: true
  3062.                           type: array
  3063.                         selector:
  3064.                           description: "Selector is an optional field that contains
  3065.                             a selector expression (see Policy for sample syntax).
  3066.                             \ Only traffic that originates from (terminates at) endpoints
  3067.                             matching the selector will be matched. \n Note that: in
  3068.                             addition to the negated version of the Selector (see NotSelector
  3069.                             below), the selector expression syntax itself supports
  3070.                             negation.  The two types of negation are subtly different.
  3071.                             One negates the set of matched endpoints, the other negates
  3072.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  3073.                             packets that are from other Calico-controlled \tendpoints
  3074.                             that do not have the label 鈥渕y_label鈥�. \n \tNotSelector
  3075.                             = \"has(my_label)\" matches packets that are not from
  3076.                             Calico-controlled \tendpoints that do have the label 鈥渕y_label鈥�.
  3077.                             \n The effect is that the latter will accept packets from
  3078.                             non-Calico sources whereas the former is limited to packets
  3079.                             from Calico-controlled endpoints."
  3080.                           type: string
  3081.                         serviceAccounts:
  3082.                           description: ServiceAccounts is an optional field that restricts
  3083.                             the rule to only apply to traffic that originates from
  3084.                             (or terminates at) a pod running as a matching service
  3085.                             account.
  3086.                           properties:
  3087.                             names:
  3088.                               description: Names is an optional field that restricts
  3089.                                 the rule to only apply to traffic that originates
  3090.                                 from (or terminates at) a pod running as a service
  3091.                                 account whose name is in the list.
  3092.                               items:
  3093.                                 type: string
  3094.                               type: array
  3095.                             selector:
  3096.                               description: Selector is an optional field that restricts
  3097.                                 the rule to only apply to traffic that originates
  3098.                                 from (or terminates at) a pod running as a service
  3099.                                 account that matches the given label selector. If
  3100.                                 both Names and Selector are specified then they are
  3101.                                 AND'ed.
  3102.                               type: string
  3103.                           type: object
  3104.                       type: object
  3105.                   required:
  3106.                   - action
  3107.                   type: object
  3108.                 type: array
  3109.               order:
  3110.                 description: Order is an optional field that specifies the order in
  3111.                   which the policy is applied. Policies with higher "order" are applied
  3112.                   after those with lower order.  If the order is omitted, it may be
  3113.                   considered to be "infinite" - i.e. the policy will be applied last.  Policies
  3114.                   with identical order will be applied in alphanumerical order based
  3115.                   on the Policy "Name".
  3116.                 type: number
  3117.               selector:
  3118.                 description: "The selector is an expression used to pick pick out
  3119.                   the endpoints that the policy should be applied to. \n Selector
  3120.                   expressions follow this syntax: \n \tlabel == \"string_literal\"
  3121.                   \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
  3122.                   \  ->  not equal; also matches if label is not present \tlabel in
  3123.                   { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
  3124.                   one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
  3125.                   ... }  ->  true if the value of label X is not one of \"a\", \"b\",
  3126.                   \"c\" \thas(label_name)  -> True if that label is present \t! expr
  3127.                   -> negation of expr \texpr && expr  -> Short-circuit and \texpr
  3128.                   || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
  3129.                   or the empty selector -> matches all endpoints. \n Label names are
  3130.                   allowed to contain alphanumerics, -, _ and /. String literals are
  3131.                   more permissive but they do not support escape characters. \n Examples
  3132.                   (with made-up labels): \n \ttype == \"webserver\" && deployment
  3133.                   == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
  3134.                   \"dev\" \t! has(label_name)"
  3135.                 type: string
  3136.               serviceAccountSelector:
  3137.                 description: ServiceAccountSelector is an optional field for an expression
  3138.                   used to select a pod based on service accounts.
  3139.                 type: string
  3140.               types:
  3141.                 description: "Types indicates whether this policy applies to ingress,
  3142.                   or to egress, or to both.  When not explicitly specified (and so
  3143.                   the value on creation is empty or nil), Calico defaults Types according
  3144.                   to what Ingress and Egress are present in the policy.  The default
  3145.                   is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
  3146.                   the case where there are   also no Ingress rules) \n - [ PolicyTypeEgress
  3147.                   ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
  3148.                   PolicyTypeEgress ], if there are both Ingress and Egress rules.
  3149.                   \n When the policy is read back again, Types will always be one
  3150.                   of these values, never empty or nil."
  3151.                 items:
  3152.                   description: PolicyType enumerates the possible values of the PolicySpec
  3153.                     Types field.
  3154.                   type: string
  3155.                 type: array
  3156.             type: object
  3157.         type: object
  3158.     served: true
  3159.     storage: true
  3160. status:
  3161.   acceptedNames:
  3162.     kind: ""
  3163.     plural: ""
  3164.   conditions: []
  3165.   storedVersions: []
  3166.  
  3167. ---
  3168. apiVersion: apiextensions.k8s.io/v1
  3169. kind: CustomResourceDefinition
  3170. metadata:
  3171.   name: networksets.crd.projectcalico.org
  3172. spec:
  3173.   group: crd.projectcalico.org
  3174.   names:
  3175.     kind: NetworkSet
  3176.     listKind: NetworkSetList
  3177.     plural: networksets
  3178.     singular: networkset
  3179.   scope: Namespaced
  3180.   versions:
  3181.   - name: v1
  3182.     schema:
  3183.       openAPIV3Schema:
  3184.         description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet.
  3185.         properties:
  3186.           apiVersion:
  3187.             description: 'APIVersion defines the versioned schema of this representation
  3188.               of an object. Servers should convert recognized schemas to the latest
  3189.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  3190.             type: string
  3191.           kind:
  3192.             description: 'Kind is a string value representing the REST resource this
  3193.               object represents. Servers may infer this from the endpoint the client
  3194.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  3195.             type: string
  3196.           metadata:
  3197.             type: object
  3198.           spec:
  3199.             description: NetworkSetSpec contains the specification for a NetworkSet
  3200.               resource.
  3201.             properties:
  3202.               nets:
  3203.                 description: The list of IP networks that belong to this set.
  3204.                 items:
  3205.                   type: string
  3206.                 type: array
  3207.             type: object
  3208.         type: object
  3209.     served: true
  3210.     storage: true
  3211. status:
  3212.   acceptedNames:
  3213.     kind: ""
  3214.     plural: ""
  3215.   conditions: []
  3216.   storedVersions: []
  3217.  
  3218. ---
  3219. ---
  3220. # Source: calico/templates/calico-kube-controllers-rbac.yaml
  3221.  
  3222. # Include a clusterrole for the kube-controllers component,
  3223. # and bind it to the calico-kube-controllers serviceaccount.
  3224. kind: ClusterRole
  3225. apiVersion: rbac.authorization.k8s.io/v1
  3226. metadata:
  3227.   name: calico-kube-controllers
  3228. rules:
  3229.   # Nodes are watched to monitor for deletions.
  3230.   - apiGroups: [""]
  3231.     resources:
  3232.       - nodes
  3233.     verbs:
  3234.       - watch
  3235.       - list
  3236.       - get
  3237.   # Pods are queried to check for existence.
  3238.   - apiGroups: [""]
  3239.     resources:
  3240.       - pods
  3241.     verbs:
  3242.       - get
  3243.   # IPAM resources are manipulated when nodes are deleted.
  3244.   - apiGroups: ["crd.projectcalico.org"]
  3245.     resources:
  3246.       - ippools
  3247.     verbs:
  3248.       - list
  3249.   - apiGroups: ["crd.projectcalico.org"]
  3250.     resources:
  3251.       - blockaffinities
  3252.       - ipamblocks
  3253.       - ipamhandles
  3254.     verbs:
  3255.       - get
  3256.       - list
  3257.       - create
  3258.       - update
  3259.       - delete
  3260.   # kube-controllers manages hostendpoints.
  3261.   - apiGroups: ["crd.projectcalico.org"]
  3262.     resources:
  3263.       - hostendpoints
  3264.     verbs:
  3265.       - get
  3266.       - list
  3267.       - create
  3268.       - update
  3269.       - delete
  3270.   # Needs access to update clusterinformations.
  3271.   - apiGroups: ["crd.projectcalico.org"]
  3272.     resources:
  3273.       - clusterinformations
  3274.     verbs:
  3275.       - get
  3276.       - create
  3277.       - update
  3278.   # KubeControllersConfiguration is where it gets its config
  3279.   - apiGroups: ["crd.projectcalico.org"]
  3280.     resources:
  3281.       - kubecontrollersconfigurations
  3282.     verbs:
  3283.       # read its own config
  3284.       - get
  3285.       # create a default if none exists
  3286.       - create
  3287.       # update status
  3288.       - update
  3289.       # watch for changes
  3290.       - watch
  3291. ---
  3292. kind: ClusterRoleBinding
  3293. apiVersion: rbac.authorization.k8s.io/v1
  3294. metadata:
  3295.   name: calico-kube-controllers
  3296. roleRef:
  3297.   apiGroup: rbac.authorization.k8s.io
  3298.   kind: ClusterRole
  3299.   name: calico-kube-controllers
  3300. subjects:
  3301. - kind: ServiceAccount
  3302.   name: calico-kube-controllers
  3303.   namespace: kube-system
  3304. ---
  3305.  
  3306. ---
  3307. # Source: calico/templates/calico-node-rbac.yaml
  3308. # Include a clusterrole for the calico-node DaemonSet,
  3309. # and bind it to the calico-node serviceaccount.
  3310. kind: ClusterRole
  3311. apiVersion: rbac.authorization.k8s.io/v1
  3312. metadata:
  3313.   name: calico-node
  3314. rules:
  3315.   # The CNI plugin needs to get pods, nodes, and namespaces.
  3316.   - apiGroups: [""]
  3317.     resources:
  3318.       - pods
  3319.       - nodes
  3320.       - namespaces
  3321.     verbs:
  3322.       - get
  3323.   - apiGroups: [""]
  3324.     resources:
  3325.       - endpoints
  3326.       - services
  3327.     verbs:
  3328.       # Used to discover service IPs for advertisement.
  3329.       - watch
  3330.       - list
  3331.       # Used to discover Typhas.
  3332.       - get
  3333.   # Pod CIDR auto-detection on kubeadm needs access to config maps.
  3334.   - apiGroups: [""]
  3335.     resources:
  3336.       - configmaps
  3337.     verbs:
  3338.       - get
  3339.   - apiGroups: [""]
  3340.     resources:
  3341.       - nodes/status
  3342.     verbs:
  3343.       # Needed for clearing NodeNetworkUnavailable flag.
  3344.       - patch
  3345.       # Calico stores some configuration information in node annotations.
  3346.       - update
  3347.   # Watch for changes to Kubernetes NetworkPolicies.
  3348.   - apiGroups: ["networking.k8s.io"]
  3349.     resources:
  3350.       - networkpolicies
  3351.     verbs:
  3352.       - watch
  3353.       - list
  3354.   # Used by Calico for policy information.
  3355.   - apiGroups: [""]
  3356.     resources:
  3357.       - pods
  3358.       - namespaces
  3359.       - serviceaccounts
  3360.     verbs:
  3361.       - list
  3362.       - watch
  3363.   # The CNI plugin patches pods/status.
  3364.   - apiGroups: [""]
  3365.     resources:
  3366.       - pods/status
  3367.     verbs:
  3368.       - patch
  3369.   # Calico monitors various CRDs for config.
  3370.   - apiGroups: ["crd.projectcalico.org"]
  3371.     resources:
  3372.       - globalfelixconfigs
  3373.       - felixconfigurations
  3374.       - bgppeers
  3375.       - globalbgpconfigs
  3376.       - bgpconfigurations
  3377.       - ippools
  3378.       - ipamblocks
  3379.       - globalnetworkpolicies
  3380.       - globalnetworksets
  3381.       - networkpolicies
  3382.       - networksets
  3383.       - clusterinformations
  3384.       - hostendpoints
  3385.       - blockaffinities
  3386.     verbs:
  3387.       - get
  3388.       - list
  3389.       - watch
  3390.   # Calico must create and update some CRDs on startup.
  3391.   - apiGroups: ["crd.projectcalico.org"]
  3392.     resources:
  3393.       - ippools
  3394.       - felixconfigurations
  3395.       - clusterinformations
  3396.     verbs:
  3397.       - create
  3398.       - update
  3399.   # Calico stores some configuration information on the node.
  3400.   - apiGroups: [""]
  3401.     resources:
  3402.       - nodes
  3403.     verbs:
  3404.       - get
  3405.       - list
  3406.       - watch
  3407.   # These permissions are only required for upgrade from v2.6, and can
  3408.   # be removed after upgrade or on fresh installations.
  3409.   - apiGroups: ["crd.projectcalico.org"]
  3410.     resources:
  3411.       - bgpconfigurations
  3412.       - bgppeers
  3413.     verbs:
  3414.       - create
  3415.       - update
  3416.   # These permissions are required for Calico CNI to perform IPAM allocations.
  3417.   - apiGroups: ["crd.projectcalico.org"]
  3418.     resources:
  3419.       - blockaffinities
  3420.       - ipamblocks
  3421.       - ipamhandles
  3422.     verbs:
  3423.       - get
  3424.       - list
  3425.       - create
  3426.       - update
  3427.       - delete
  3428.   - apiGroups: ["crd.projectcalico.org"]
  3429.     resources:
  3430.       - ipamconfigs
  3431.     verbs:
  3432.       - get
  3433.   # Block affinities must also be watchable by confd for route aggregation.
  3434.   - apiGroups: ["crd.projectcalico.org"]
  3435.     resources:
  3436.       - blockaffinities
  3437.     verbs:
  3438.       - watch
  3439.   # The Calico IPAM migration needs to get daemonsets. These permissions can be
  3440.   # removed if not upgrading from an installation using host-local IPAM.
  3441.   - apiGroups: ["apps"]
  3442.     resources:
  3443.       - daemonsets
  3444.     verbs:
  3445.       - get
  3446.  
  3447. ---
  3448. apiVersion: rbac.authorization.k8s.io/v1
  3449. kind: ClusterRoleBinding
  3450. metadata:
  3451.   name: calico-node
  3452. roleRef:
  3453.   apiGroup: rbac.authorization.k8s.io
  3454.   kind: ClusterRole
  3455.   name: calico-node
  3456. subjects:
  3457. - kind: ServiceAccount
  3458.   name: calico-node
  3459.   namespace: kube-system
  3460.  
  3461. ---
  3462. # Source: calico/templates/calico-node.yaml
  3463. # This manifest installs the calico-node container, as well
  3464. # as the CNI plugins and network config on
  3465. # each master and worker node in a Kubernetes cluster.
  3466. kind: DaemonSet
  3467. apiVersion: apps/v1
  3468. metadata:
  3469.   name: calico-node
  3470.   namespace: kube-system
  3471.   labels:
  3472.     k8s-app: calico-node
  3473. spec:
  3474.   selector:
  3475.     matchLabels:
  3476.       k8s-app: calico-node
  3477.   updateStrategy:
  3478.     type: RollingUpdate
  3479.     rollingUpdate:
  3480.       maxUnavailable: 1
  3481.   template:
  3482.     metadata:
  3483.       labels:
  3484.         k8s-app: calico-node
  3485.     spec:
  3486.       nodeSelector:
  3487.         kubernetes.io/os: linux
  3488.       hostNetwork: true
  3489.       tolerations:
  3490.         # Make sure calico-node gets scheduled on all nodes.
  3491.         - effect: NoSchedule
  3492.           operator: Exists
  3493.         # Mark the pod as a critical add-on for rescheduling.
  3494.         - key: CriticalAddonsOnly
  3495.           operator: Exists
  3496.         - effect: NoExecute
  3497.           operator: Exists
  3498.       serviceAccountName: calico-node
  3499.       # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
  3500.       # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
  3501.       terminationGracePeriodSeconds: 0
  3502.       priorityClassName: system-node-critical
  3503.       initContainers:
  3504.         # This container performs upgrade from host-local IPAM to calico-ipam.
  3505.         # It can be deleted if this is a fresh installation, or if you have already
  3506.         # upgraded to use calico-ipam.
  3507.         - name: upgrade-ipam
  3508.           image: docker.io/calico/cni:v3.17.1
  3509.           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
  3510.           envFrom:
  3511.           - configMapRef:
  3512.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
  3513.               name: kubernetes-services-endpoint
  3514.               optional: true
  3515.           env:
  3516.             - name: KUBERNETES_NODE_NAME
  3517.               valueFrom:
  3518.                 fieldRef:
  3519.                   fieldPath: spec.nodeName
  3520.             - name: CALICO_NETWORKING_BACKEND
  3521.               valueFrom:
  3522.                 configMapKeyRef:
  3523.                   name: calico-config
  3524.                   key: calico_backend
  3525.           volumeMounts:
  3526.             - mountPath: /var/lib/cni/networks
  3527.               name: host-local-net-dir
  3528.             - mountPath: /host/opt/cni/bin
  3529.               name: cni-bin-dir
  3530.           securityContext:
  3531.             privileged: true
  3532.         # This container installs the CNI binaries
  3533.         # and CNI network config file on each node.
  3534.         - name: install-cni
  3535.           image: docker.io/calico/cni:v3.17.1
  3536.           command: ["/opt/cni/bin/install"]
  3537.           envFrom:
  3538.           - configMapRef:
  3539.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
  3540.               name: kubernetes-services-endpoint
  3541.               optional: true
  3542.           env:
  3543.             # Name of the CNI config file to create.
  3544.             - name: CNI_CONF_NAME
  3545.               value: "10-calico.conflist"
  3546.             # The CNI network config to install on each node.
  3547.             - name: CNI_NETWORK_CONFIG
  3548.               valueFrom:
  3549.                 configMapKeyRef:
  3550.                   name: calico-config
  3551.                   key: cni_network_config
  3552.             # Set the hostname based on the k8s node name.
  3553.             - name: KUBERNETES_NODE_NAME
  3554.               valueFrom:
  3555.                 fieldRef:
  3556.                   fieldPath: spec.nodeName
  3557.             # CNI MTU Config variable
  3558.             - name: CNI_MTU
  3559.               valueFrom:
  3560.                 configMapKeyRef:
  3561.                   name: calico-config
  3562.                   key: veth_mtu
  3563.             # Prevents the container from sleeping forever.
  3564.             - name: SLEEP
  3565.               value: "false"
  3566.           volumeMounts:
  3567.             - mountPath: /host/opt/cni/bin
  3568.               name: cni-bin-dir
  3569.             - mountPath: /host/etc/cni/net.d
  3570.               name: cni-net-dir
  3571.           securityContext:
  3572.             privileged: true
  3573.         # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
  3574.         # to communicate with Felix over the Policy Sync API.
  3575.         - name: flexvol-driver
  3576.           image: docker.io/calico/pod2daemon-flexvol:v3.17.1
  3577.           volumeMounts:
  3578.           - name: flexvol-driver-host
  3579.             mountPath: /host/driver
  3580.           securityContext:
  3581.             privileged: true
  3582.       containers:
  3583.         # Runs calico-node container on each Kubernetes node. This
  3584.         # container programs network policy and routes on each
  3585.         # host.
  3586.         - name: calico-node
  3587.           image: docker.io/calico/node:v3.17.1
  3588.           envFrom:
  3589.           - configMapRef:
  3590.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
  3591.               name: kubernetes-services-endpoint
  3592.               optional: true
  3593.           env:
  3594.             # Use Kubernetes API as the backing datastore.
  3595.             - name: DATASTORE_TYPE
  3596.               value: "kubernetes"
  3597.             # Wait for the datastore.
  3598.             - name: WAIT_FOR_DATASTORE
  3599.               value: "true"
  3600.             # Set based on the k8s node name.
  3601.             - name: NODENAME
  3602.               valueFrom:
  3603.                 fieldRef:
  3604.                   fieldPath: spec.nodeName
  3605.             # Choose the backend to use.
  3606.             - name: CALICO_NETWORKING_BACKEND
  3607.               valueFrom:
  3608.                 configMapKeyRef:
  3609.                   name: calico-config
  3610.                   key: calico_backend
  3611.             # Cluster type to identify the deployment type
  3612.             - name: CLUSTER_TYPE
  3613.               value: "k8s,bgp"
  3614.             # Auto-detect the BGP IP address.
  3615.             - name: IP
  3616.               value: "autodetect"
  3617.             # Enable IPIP
  3618.             - name: CALICO_IPV4POOL_IPIP
  3619.               value: "Always"
  3620.             # Enable or Disable VXLAN on the default IP pool.
  3621.             - name: CALICO_IPV4POOL_VXLAN
  3622.               value: "Never"
  3623.             # Set MTU for tunnel device used if ipip is enabled
  3624.             - name: FELIX_IPINIPMTU
  3625.               valueFrom:
  3626.                 configMapKeyRef:
  3627.                   name: calico-config
  3628.                   key: veth_mtu
  3629.             # Set MTU for the VXLAN tunnel device.
  3630.             - name: FELIX_VXLANMTU
  3631.               valueFrom:
  3632.                 configMapKeyRef:
  3633.                   name: calico-config
  3634.                   key: veth_mtu
  3635.             # Set MTU for the Wireguard tunnel device.
  3636.             - name: FELIX_WIREGUARDMTU
  3637.               valueFrom:
  3638.                 configMapKeyRef:
  3639.                   name: calico-config
  3640.                   key: veth_mtu
  3641.             - name: IP_AUTODETECTION_METHOD
  3642.               value: "interface=eth0"
  3643.             # The default IPv4 pool to create on startup if none exists. Pod IPs will be
  3644.             # chosen from this range. Changing this value after installation will have
  3645.             # no effect. This should fall within `--cluster-cidr`.
  3646.             - name: CALICO_IPV4POOL_CIDR
  3647.               value: "10.244.0.0/16"
  3648.             # Disable file logging so `kubectl logs` works.
  3649.             - name: CALICO_DISABLE_FILE_LOGGING
  3650.               value: "true"
  3651.             # Set Felix endpoint to host default action to ACCEPT.
  3652.             - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
  3653.               value: "ACCEPT"
  3654.             # Disable IPv6 on Kubernetes.
  3655.             - name: FELIX_IPV6SUPPORT
  3656.               value: "false"
  3657.             # Set Felix logging to "info"
  3658.             - name: FELIX_LOGSEVERITYSCREEN
  3659.               value: "info"
  3660.             - name: FELIX_HEALTHENABLED
  3661.               value: "true"
  3662.           securityContext:
  3663.             privileged: true
  3664.           resources:
  3665.             requests:
  3666.               cpu: 250m
  3667.           livenessProbe:
  3668.             exec:
  3669.               command:
  3670.               - /bin/calico-node
  3671.               - -felix-live
  3672.               - -bird-live
  3673.             periodSeconds: 10
  3674.             initialDelaySeconds: 10
  3675.             failureThreshold: 6
  3676.           readinessProbe:
  3677.             exec:
  3678.               command:
  3679.               - /bin/calico-node
  3680.               - -felix-ready
  3681.               - -bird-ready
  3682.             periodSeconds: 10
  3683.           volumeMounts:
  3684.             - mountPath: /lib/modules
  3685.               name: lib-modules
  3686.               readOnly: true
  3687.             - mountPath: /run/xtables.lock
  3688.               name: xtables-lock
  3689.               readOnly: false
  3690.             - mountPath: /var/run/calico
  3691.               name: var-run-calico
  3692.               readOnly: false
  3693.             - mountPath: /var/lib/calico
  3694.               name: var-lib-calico
  3695.               readOnly: false
  3696.             - name: policysync
  3697.               mountPath: /var/run/nodeagent
  3698.             # For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the
  3699.             # parent directory.
  3700.             - name: sysfs
  3701.               mountPath: /sys/fs/
  3702.               # Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host.
  3703.               # If the host is known to mount that filesystem already then Bidirectional can be omitted.
  3704.               mountPropagation: Bidirectional
  3705.             - name: cni-log-dir
  3706.               mountPath: /var/log/calico/cni
  3707.               readOnly: true
  3708.       volumes:
  3709.         # Used by calico-node.
  3710.         - name: lib-modules
  3711.           hostPath:
  3712.             path: /lib/modules
  3713.         - name: var-run-calico
  3714.           hostPath:
  3715.             path: /var/run/calico
  3716.         - name: var-lib-calico
  3717.           hostPath:
  3718.             path: /var/lib/calico
  3719.         - name: xtables-lock
  3720.           hostPath:
  3721.             path: /run/xtables.lock
  3722.             type: FileOrCreate
  3723.         - name: sysfs
  3724.           hostPath:
  3725.             path: /sys/fs/
  3726.             type: DirectoryOrCreate
  3727.         # Used to install CNI.
  3728.         - name: cni-bin-dir
  3729.           hostPath:
  3730.             path: /opt/cni/bin
  3731.         - name: cni-net-dir
  3732.           hostPath:
  3733.             path: /etc/cni/net.d
  3734.         # Used to access CNI logs.
  3735.         - name: cni-log-dir
  3736.           hostPath:
  3737.             path: /var/log/calico/cni
  3738.         # Mount in the directory for host-local IPAM allocations. This is
  3739.         # used when upgrading from host-local to calico-ipam, and can be removed
  3740.         # if not using the upgrade-ipam init container.
  3741.         - name: host-local-net-dir
  3742.           hostPath:
  3743.             path: /var/lib/cni/networks
  3744.         # Used to create per-pod Unix Domain Sockets
  3745.         - name: policysync
  3746.           hostPath:
  3747.             type: DirectoryOrCreate
  3748.             path: /var/run/nodeagent
  3749.         # Used to install Flex Volume Driver
  3750.         - name: flexvol-driver-host
  3751.           hostPath:
  3752.             type: DirectoryOrCreate
  3753.             path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
  3754. ---
  3755.  
  3756. apiVersion: v1
  3757. kind: ServiceAccount
  3758. metadata:
  3759.   name: calico-node
  3760.   namespace: kube-system
  3761.  
  3762. ---
  3763. # Source: calico/templates/calico-kube-controllers.yaml
  3764. # See https://github.com/projectcalico/kube-controllers
  3765. apiVersion: apps/v1
  3766. kind: Deployment
  3767. metadata:
  3768.   name: calico-kube-controllers
  3769.   namespace: kube-system
  3770.   labels:
  3771.     k8s-app: calico-kube-controllers
  3772. spec:
  3773.   # The controllers can only have a single active instance.
  3774.   replicas: 1
  3775.   selector:
  3776.     matchLabels:
  3777.       k8s-app: calico-kube-controllers
  3778.   strategy:
  3779.     type: Recreate
  3780.   template:
  3781.     metadata:
  3782.       name: calico-kube-controllers
  3783.       namespace: kube-system
  3784.       labels:
  3785.         k8s-app: calico-kube-controllers
  3786.     spec:
  3787.       nodeSelector:
  3788.         kubernetes.io/os: linux
  3789.       tolerations:
  3790.         # Mark the pod as a critical add-on for rescheduling.
  3791.         - key: CriticalAddonsOnly
  3792.           operator: Exists
  3793.         - key: node-role.kubernetes.io/master
  3794.           effect: NoSchedule
  3795.       serviceAccountName: calico-kube-controllers
  3796.       priorityClassName: system-cluster-critical
  3797.       containers:
  3798.         - name: calico-kube-controllers
  3799.           image: docker.io/calico/kube-controllers:v3.17.1
  3800.           env:
  3801.             # Choose which controllers to run.
  3802.             - name: ENABLED_CONTROLLERS
  3803.               value: node
  3804.             - name: DATASTORE_TYPE
  3805.               value: kubernetes
  3806.           readinessProbe:
  3807.             exec:
  3808.               command:
  3809.               - /usr/bin/check-status
  3810.               - -r
  3811.  
  3812. ---
  3813.  
  3814. apiVersion: v1
  3815. kind: ServiceAccount
  3816. metadata:
  3817.   name: calico-kube-controllers
  3818.   namespace: kube-system
  3819.  
  3820. ---
  3821.  
  3822. # This manifest creates a Pod Disruption Budget for Controller to allow K8s Cluster Autoscaler to evict
  3823.  
  3824. apiVersion: policy/v1beta1
  3825. kind: PodDisruptionBudget
  3826. metadata:
  3827.   name: calico-kube-controllers
  3828.   namespace: kube-system
  3829.   labels:
  3830.     k8s-app: calico-kube-controllers
  3831. spec:
  3832.   maxUnavailable: 1
  3833.   selector:
  3834.     matchLabels:
  3835.       k8s-app: calico-kube-controllers
  3836.  
  3837. ---
  3838. # Source: calico/templates/calico-etcd-secrets.yaml
  3839.  
  3840. ---
  3841. # Source: calico/templates/calico-typha.yaml
  3842.  
  3843. ---
  3844. # Source: calico/templates/configure-canal.yaml
声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/凡人多烦事01/article/detail/328409
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号