|
|
@@ -0,0 +1,400 @@
|
|
|
+---
|
|
|
+kind: ClusterRole
|
|
|
+apiVersion: v1
|
|
|
+metadata:
|
|
|
+ name: calico-kube-controllers
|
|
|
+ namespace: kube-system
|
|
|
+rules:
|
|
|
+ - apiGroups:
|
|
|
+ - ""
|
|
|
+ - extensions
|
|
|
+ resources:
|
|
|
+ - pods
|
|
|
+ - namespaces
|
|
|
+ - networkpolicies
|
|
|
+ - nodes
|
|
|
+ verbs:
|
|
|
+ - watch
|
|
|
+ - list
|
|
|
+---
|
|
|
+kind: ClusterRoleBinding
|
|
|
+apiVersion: v1
|
|
|
+metadata:
|
|
|
+ name: calico-kube-controllers
|
|
|
+roleRef:
|
|
|
+ apiGroup: rbac.authorization.k8s.io
|
|
|
+ kind: ClusterRole
|
|
|
+ name: calico-kube-controllers
|
|
|
+subjects:
|
|
|
+- kind: ServiceAccount
|
|
|
+ name: calico-kube-controllers
|
|
|
+ namespace: kube-system
|
|
|
+---
|
|
|
+kind: ClusterRole
|
|
|
+apiVersion: v1
|
|
|
+metadata:
|
|
|
+ name: calico-node
|
|
|
+ namespace: kube-system
|
|
|
+rules:
|
|
|
+ - apiGroups: [""]
|
|
|
+ resources:
|
|
|
+ - pods
|
|
|
+ - nodes
|
|
|
+ verbs:
|
|
|
+ - get
|
|
|
+---
|
|
|
+apiVersion: v1
|
|
|
+kind: ClusterRoleBinding
|
|
|
+metadata:
|
|
|
+ name: calico-node
|
|
|
+roleRef:
|
|
|
+ apiGroup: rbac.authorization.k8s.io
|
|
|
+ kind: ClusterRole
|
|
|
+ name: calico-node
|
|
|
+subjects:
|
|
|
+- kind: ServiceAccount
|
|
|
+ name: calico-node
|
|
|
+ namespace: kube-system
|
|
|
+
|
|
|
+---
|
|
|
+# This ConfigMap is used to configure a self-hosted Calico installation.
|
|
|
+kind: ConfigMap
|
|
|
+apiVersion: v1
|
|
|
+metadata:
|
|
|
+ name: calico-config
|
|
|
+ namespace: kube-system
|
|
|
+data:
|
|
|
+ # Configure this with the location of your etcd cluster.
|
|
|
+ etcd_endpoints: "{{ calico_etcd_endpoints }}"
|
|
|
+
|
|
|
+ # Configure the Calico backend to use.
|
|
|
+ calico_backend: "bird"
|
|
|
+
|
|
|
+ # The CNI network configuration to install on each node.
|
|
|
+ cni_network_config: |-
|
|
|
+ {
|
|
|
+ "name": "k8s-pod-network",
|
|
|
+ "cniVersion": "0.1.0",
|
|
|
+ "type": "calico",
|
|
|
+ "etcd_endpoints": "__ETCD_ENDPOINTS__",
|
|
|
+ "etcd_key_file": "__ETCD_KEY_FILE__",
|
|
|
+ "etcd_cert_file": "__ETCD_CERT_FILE__",
|
|
|
+ "etcd_ca_cert_file": "__ETCD_CA_CERT_FILE__",
|
|
|
+ "log_level": "info",
|
|
|
+ "mtu": 1500,
|
|
|
+ "ipam": {
|
|
|
+ "type": "calico-ipam"
|
|
|
+ },
|
|
|
+ "policy": {
|
|
|
+ "type": "k8s",
|
|
|
+ "k8s_api_root": "https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__",
|
|
|
+ "k8s_auth_token": "__SERVICEACCOUNT_TOKEN__"
|
|
|
+ },
|
|
|
+ "kubernetes": {
|
|
|
+ "kubeconfig": "__KUBECONFIG_FILEPATH__"
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ etcd_ca: "/calico-secrets/etcd-ca"
|
|
|
+ etcd_cert: "/calico-secrets/etcd-cert"
|
|
|
+ etcd_key: "/calico-secrets/etcd-key"
|
|
|
+
|
|
|
+---
|
|
|
+
|
|
|
+# This manifest installs the calico/node container, as well
|
|
|
+# as the Calico CNI plugins and network config on
|
|
|
+# each master and worker node in a Kubernetes cluster.
|
|
|
+kind: DaemonSet
|
|
|
+apiVersion: extensions/v1beta1
|
|
|
+metadata:
|
|
|
+ name: calico-node
|
|
|
+ namespace: kube-system
|
|
|
+ labels:
|
|
|
+ k8s-app: calico-node
|
|
|
+spec:
|
|
|
+ updateStrategy:
|
|
|
+ type: RollingUpdate
|
|
|
+ rollingUpdate:
|
|
|
+ maxUnavailable: 1
|
|
|
+ selector:
|
|
|
+ matchLabels:
|
|
|
+ k8s-app: calico-node
|
|
|
+ template:
|
|
|
+ metadata:
|
|
|
+ labels:
|
|
|
+ k8s-app: calico-node
|
|
|
+ annotations:
|
|
|
+ scheduler.alpha.kubernetes.io/critical-pod: ''
|
|
|
+ spec:
|
|
|
+ nodeSelector:
|
|
|
+ projectcalico.org/ds-ready: "true"
|
|
|
+ hostNetwork: true
|
|
|
+ tolerations:
|
|
|
+ # Make sure calico/node gets scheduled on all nodes.
|
|
|
+ - effect: NoSchedule
|
|
|
+ operator: Exists
|
|
|
+ # Mark the pod as a critical add-on for rescheduling.
|
|
|
+ - key: CriticalAddonsOnly
|
|
|
+ operator: Exists
|
|
|
+ - effect: NoExecute
|
|
|
+ operator: Exists
|
|
|
+ serviceAccountName: calico-node
|
|
|
+ # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
|
|
|
+ # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
|
|
|
+ terminationGracePeriodSeconds: 0
|
|
|
+ containers:
|
|
|
+ # Runs calico/node container on each Kubernetes node. This
|
|
|
+ # container programs network policy and routes on each
|
|
|
+ # host.
|
|
|
+ - name: calico-node
|
|
|
+ image: {{ calico_node_image }}
|
|
|
+ env:
|
|
|
+ # The location of the Calico etcd cluster.
|
|
|
+ - name: ETCD_ENDPOINTS
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_endpoints
|
|
|
+ # Choose the backend to use.
|
|
|
+ - name: CALICO_NETWORKING_BACKEND
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: calico_backend
|
|
|
+ # Cluster type to identify the deployment type
|
|
|
+ - name: CLUSTER_TYPE
|
|
|
+ value: "origin,bgp"
|
|
|
+ # Disable file logging so `kubectl logs` works.
|
|
|
+ - name: CALICO_DISABLE_FILE_LOGGING
|
|
|
+ value: "true"
|
|
|
+ # Set noderef for node controller.
|
|
|
+ - name: CALICO_K8S_NODE_REF
|
|
|
+ valueFrom:
|
|
|
+ fieldRef:
|
|
|
+ fieldPath: spec.nodeName
|
|
|
+ # Set Felix endpoint to host default action to ACCEPT.
|
|
|
+ - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
|
|
|
+ value: "ACCEPT"
|
|
|
+ # Configure the IP Pool from which Pod IPs will be chosen.
|
|
|
+ - name: CALICO_IPV4POOL_CIDR
|
|
|
+ value: "{{ openshift.master.sdn_cluster_network_cidr }}"
|
|
|
+ - name: CALICO_IPV4POOL_IPIP
|
|
|
+ value: "{{ calico_ipv4pool_ipip }}"
|
|
|
+ # Disable IPv6 on Kubernetes.
|
|
|
+ - name: FELIX_IPV6SUPPORT
|
|
|
+ value: "false"
|
|
|
+ # Set Felix logging to "info"
|
|
|
+ - name: FELIX_LOGSEVERITYSCREEN
|
|
|
+ value: "info"
|
|
|
+ # Set MTU for tunnel device used if ipip is enabled
|
|
|
+ - name: FELIX_IPINIPMTU
|
|
|
+ value: "1440"
|
|
|
+ - name: ETCD_ENDPOINTS
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_endpoints
|
|
|
+ # Location of the CA certificate for etcd.
|
|
|
+ - name: ETCD_CA_CERT_FILE
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_ca
|
|
|
+ # Location of the client key for etcd.
|
|
|
+ - name: ETCD_KEY_FILE
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_key
|
|
|
+ # Location of the client certificate for etcd.
|
|
|
+ - name: ETCD_CERT_FILE
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_cert
|
|
|
+ # Auto-detect the BGP IP address.
|
|
|
+ - name: IP
|
|
|
+ value: ""
|
|
|
+ - name: FELIX_HEALTHENABLED
|
|
|
+ value: "true"
|
|
|
+ securityContext:
|
|
|
+ privileged: true
|
|
|
+ livenessProbe:
|
|
|
+ httpGet:
|
|
|
+ path: /liveness
|
|
|
+ port: 9099
|
|
|
+ periodSeconds: 10
|
|
|
+ initialDelaySeconds: 10
|
|
|
+ failureThreshold: 6
|
|
|
+ readinessProbe:
|
|
|
+ httpGet:
|
|
|
+ path: /readiness
|
|
|
+ port: 9099
|
|
|
+ periodSeconds: 10
|
|
|
+ volumeMounts:
|
|
|
+ - mountPath: /lib/modules
|
|
|
+ name: lib-modules
|
|
|
+ readOnly: true
|
|
|
+ - mountPath: /var/run/calico
|
|
|
+ name: var-run-calico
|
|
|
+ readOnly: false
|
|
|
+ - mountPath: /calico-secrets
|
|
|
+ name: etcd-certs
|
|
|
+ # This container installs the Calico CNI binaries
|
|
|
+ # and CNI network config file on each node.
|
|
|
+ - name: install-cni
|
|
|
+ securityContext:
|
|
|
+ privileged: true
|
|
|
+ image: {{ calico_cni_image }}
|
|
|
+ command: ["/install-cni.sh"]
|
|
|
+ env:
|
|
|
+ # The location of the Calico etcd cluster.
|
|
|
+ - name: ETCD_ENDPOINTS
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_endpoints
|
|
|
+ # The CNI network config to install on each node.
|
|
|
+ - name: CNI_NETWORK_CONFIG
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: cni_network_config
|
|
|
+ # Location of the CA certificate for etcd.
|
|
|
+ - name: CNI_CONF_ETCD_CA
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_ca
|
|
|
+ # Location of the client key for etcd.
|
|
|
+ - name: CNI_CONF_ETCD_KEY
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_key
|
|
|
+ # Location of the client certificate for etcd.
|
|
|
+ - name: CNI_CONF_ETCD_CERT
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_cert
|
|
|
+ volumeMounts:
|
|
|
+ - mountPath: /host/opt/cni/bin
|
|
|
+ name: cni-bin-dir
|
|
|
+ - mountPath: /host/etc/cni/net.d
|
|
|
+ name: cni-net-dir
|
|
|
+ - mountPath: /calico-secrets
|
|
|
+ name: etcd-certs
|
|
|
+ volumes:
|
|
|
+ # Used by calico/node.
|
|
|
+ - name: lib-modules
|
|
|
+ hostPath:
|
|
|
+ path: /lib/modules
|
|
|
+ - name: var-run-calico
|
|
|
+ hostPath:
|
|
|
+ path: /var/run/calico
|
|
|
+ # Used to install CNI.
|
|
|
+ - name: cni-bin-dir
|
|
|
+ hostPath:
|
|
|
+ path: {{ cni_bin_dir }}
|
|
|
+ - name: cni-net-dir
|
|
|
+ hostPath:
|
|
|
+ path: {{ cni_conf_dir }}
|
|
|
+ # Mount in the etcd TLS secrets.
|
|
|
+ - name: etcd-certs
|
|
|
+ secret:
|
|
|
+ secretName: calico-etcd-secrets
|
|
|
+
|
|
|
+---
|
|
|
+
|
|
|
+# This manifest deploys the Calico Kubernetes controllers.
|
|
|
+# See https://github.com/projectcalico/kube-controllers
|
|
|
+apiVersion: extensions/v1beta1
|
|
|
+kind: Deployment
|
|
|
+metadata:
|
|
|
+ name: calico-kube-controllers
|
|
|
+ namespace: kube-system
|
|
|
+ labels:
|
|
|
+ k8s-app: calico-kube-controllers
|
|
|
+ annotations:
|
|
|
+ scheduler.alpha.kubernetes.io/critical-pod: ''
|
|
|
+spec:
|
|
|
+ # The controllers can only have a single active instance.
|
|
|
+ replicas: 1
|
|
|
+ strategy:
|
|
|
+ type: Recreate
|
|
|
+ template:
|
|
|
+ metadata:
|
|
|
+ name: calico-kube-controllers
|
|
|
+ namespace: kube-system
|
|
|
+ labels:
|
|
|
+ k8s-app: calico-kube-controllers
|
|
|
+ spec:
|
|
|
+ # The controllers must run in the host network namespace so that
|
|
|
+ # it isn't governed by policy that would prevent it from working.
|
|
|
+ hostNetwork: true
|
|
|
+ tolerations:
|
|
|
+ # Mark the pod as a critical add-on for rescheduling.
|
|
|
+ - key: CriticalAddonsOnly
|
|
|
+ operator: Exists
|
|
|
+ - key: node-role.kubernetes.io/master
|
|
|
+ effect: NoSchedule
|
|
|
+ serviceAccountName: calico-kube-controllers
|
|
|
+ containers:
|
|
|
+ - name: calico-kube-controllers
|
|
|
+ securityContext:
|
|
|
+ privileged: true
|
|
|
+ image: {{ calico_url_policy_controller }}
|
|
|
+ env:
|
|
|
+ # The location of the Calico etcd cluster.
|
|
|
+ - name: ETCD_ENDPOINTS
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_endpoints
|
|
|
+ # Location of the CA certificate for etcd.
|
|
|
+ - name: ETCD_CA_CERT_FILE
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_ca
|
|
|
+ # Location of the client key for etcd.
|
|
|
+ - name: ETCD_KEY_FILE
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_key
|
|
|
+ # Location of the client certificate for etcd.
|
|
|
+ - name: ETCD_CERT_FILE
|
|
|
+ valueFrom:
|
|
|
+ configMapKeyRef:
|
|
|
+ name: calico-config
|
|
|
+ key: etcd_cert
|
|
|
+ # Choose which controllers to run.
|
|
|
+ - name: ENABLED_CONTROLLERS
|
|
|
+ value: policy,profile,workloadendpoint,node
|
|
|
+ volumeMounts:
|
|
|
+ # Mount in the etcd TLS secrets.
|
|
|
+ - mountPath: /calico-secrets
|
|
|
+ name: etcd-certs
|
|
|
+ volumes:
|
|
|
+ # Mount in the etcd TLS secrets.
|
|
|
+ - name: etcd-certs
|
|
|
+ secret:
|
|
|
+ secretName: calico-etcd-secrets
|
|
|
+
|
|
|
+---
|
|
|
+
|
|
|
+apiVersion: v1
|
|
|
+kind: ServiceAccount
|
|
|
+metadata:
|
|
|
+ name: calico-kube-controllers
|
|
|
+ namespace: kube-system
|
|
|
+
|
|
|
+---
|
|
|
+
|
|
|
+apiVersion: v1
|
|
|
+kind: ServiceAccount
|
|
|
+metadata:
|
|
|
+ name: calico-node
|
|
|
+ namespace: kube-system
|
Dan Osborne