mirror of https://github.com/kubernetes/kops.git
Merge pull request #12088 from hakman/calico-3.20.0
Update Calico to v3.20.0
This commit is contained in:
Kubernetes Prow Robot
GitHub
commit
1d42125c6c
|
|
@ -47,7 +47,7 @@ spec:
|
|||
k8s-addon: storage-aws.addons.k8s.io
|
||||
- id: k8s-1.16
|
||||
manifest: networking.projectcalico.org/k8s-1.16.yaml
|
||||
manifestHash: fd80f641a123f65d1c4a5c807648951e8dc1b3cfc684e959377036f9af8b2e4f
|
||||
manifestHash: 48be015e63a400fec69f63740009d2e8a3cff62de42fafb61735114697fa94c1
|
||||
name: networking.projectcalico.org
|
||||
selector:
|
||||
role.kubernetes.io/networking: "1"
|
||||
|
|
|
|||
|
|
@ -246,6 +246,11 @@ spec:
|
|||
Peers node to use the "next hop keep;" instead of "next hop self;"(default)
|
||||
in the specific branch of the Node on "bird.cfg".
|
||||
type: boolean
|
||||
maxRestartTime:
|
||||
description: Time to allow for software restart. When specified,
|
||||
this is configured as the graceful restart timeout. When not specified,
|
||||
the BIRD default of 120s is used.
|
||||
type: string
|
||||
node:
|
||||
description: The node name identifying the Calico node instance that
|
||||
is targeted by this peer. If this is not set, and no nodeSelector
|
||||
|
|
@ -535,7 +540,7 @@ spec:
|
|||
[Default: false]'
|
||||
type: boolean
|
||||
bpfExtToServiceConnmark:
|
||||
description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit
|
||||
description: 'BPFExtToServiceConnmark in BPF mode, controls a 32bit
|
||||
mark that is set on connections from an external client to a local
|
||||
service. This mark allows us to control how packets of that connection
|
||||
are routed within the host and how is routing intepreted by RPF
|
||||
|
|
@ -1090,16 +1095,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -1187,6 +1193,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -1295,16 +1321,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -1392,6 +1419,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
@ -1421,16 +1468,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -1518,6 +1566,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -1626,16 +1694,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -1723,6 +1792,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
@ -2347,6 +2436,11 @@ spec:
|
|||
host endpoints for every node. [Default: Disabled]'
|
||||
type: string
|
||||
type: object
|
||||
leakGracePeriod:
|
||||
description: 'LeakGracePeriod is the period used by the controller
|
||||
to determine if an IP address has been leaked. Set to 0
|
||||
to disable IP garbage collection. [Default: 15m]'
|
||||
type: string
|
||||
reconcilerPeriod:
|
||||
description: 'ReconcilerPeriod is the period to perform reconciliation
|
||||
with the Calico datastore. [Default: 5m]'
|
||||
|
|
@ -2447,6 +2541,12 @@ spec:
|
|||
of host endpoints for every node. [Default: Disabled]'
|
||||
type: string
|
||||
type: object
|
||||
leakGracePeriod:
|
||||
description: 'LeakGracePeriod is the period used by the
|
||||
controller to determine if an IP address has been leaked.
|
||||
Set to 0 to disable IP garbage collection. [Default:
|
||||
15m]'
|
||||
type: string
|
||||
reconcilerPeriod:
|
||||
description: 'ReconcilerPeriod is the period to perform
|
||||
reconciliation with the Calico datastore. [Default:
|
||||
|
|
@ -2581,16 +2681,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -2678,6 +2779,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -2786,16 +2907,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -2883,6 +3005,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
@ -2912,16 +3054,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -3009,6 +3152,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -3117,16 +3280,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -3214,6 +3378,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
@ -3360,6 +3544,8 @@ rules:
|
|||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- crd.projectcalico.org
|
||||
resources:
|
||||
|
|
@ -3447,6 +3633,13 @@ rules:
|
|||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- watch
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
|
|
@ -3694,7 +3887,7 @@ spec:
|
|||
- configMapRef:
|
||||
name: kubernetes-services-endpoint
|
||||
optional: true
|
||||
image: docker.io/calico/node:v3.19.1
|
||||
image: docker.io/calico/node:v3.20.0
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
|
|
@ -3704,6 +3897,7 @@ spec:
|
|||
failureThreshold: 6
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
name: calico-node
|
||||
readinessProbe:
|
||||
exec:
|
||||
|
|
@ -3712,12 +3906,16 @@ spec:
|
|||
- -felix-ready
|
||||
- -bird-ready
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- mountPath: /host/etc/cni/net.d
|
||||
name: cni-net-dir
|
||||
readOnly: false
|
||||
- mountPath: /lib/modules
|
||||
name: lib-modules
|
||||
readOnly: true
|
||||
|
|
@ -3757,7 +3955,7 @@ spec:
|
|||
- configMapRef:
|
||||
name: kubernetes-services-endpoint
|
||||
optional: true
|
||||
image: docker.io/calico/cni:v3.19.1
|
||||
image: docker.io/calico/cni:v3.20.0
|
||||
name: upgrade-ipam
|
||||
securityContext:
|
||||
privileged: true
|
||||
|
|
@ -3791,7 +3989,7 @@ spec:
|
|||
- configMapRef:
|
||||
name: kubernetes-services-endpoint
|
||||
optional: true
|
||||
image: docker.io/calico/cni:v3.19.1
|
||||
image: docker.io/calico/cni:v3.20.0
|
||||
name: install-cni
|
||||
securityContext:
|
||||
privileged: true
|
||||
|
|
@ -3800,7 +3998,7 @@ spec:
|
|||
name: cni-bin-dir
|
||||
- mountPath: /host/etc/cni/net.d
|
||||
name: cni-net-dir
|
||||
- image: docker.io/calico/pod2daemon-flexvol:v3.19.1
|
||||
- image: docker.io/calico/pod2daemon-flexvol:v3.20.0
|
||||
name: flexvol-driver
|
||||
securityContext:
|
||||
privileged: true
|
||||
|
|
@ -3908,7 +4106,7 @@ spec:
|
|||
value: node
|
||||
- name: DATASTORE_TYPE
|
||||
value: kubernetes
|
||||
image: docker.io/calico/kube-controllers:v3.19.1
|
||||
image: docker.io/calico/kube-controllers:v3.20.0
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
|
|
@ -3917,6 +4115,7 @@ spec:
|
|||
failureThreshold: 6
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
name: calico-kube-controllers
|
||||
readinessProbe:
|
||||
exec:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Pulled and modified from: https://docs.projectcalico.org/v3.19/manifests/calico-typha.yaml
|
||||
# Pulled and modified from: https://docs.projectcalico.org/v3.20/manifests/calico-typha.yaml
|
||||
|
||||
{{- if .Networking.Calico.BPFEnabled }}
|
||||
---
|
||||
|
|
@ -263,6 +263,11 @@ spec:
|
|||
Peers node to use the "next hop keep;" instead of "next hop self;"(default)
|
||||
in the specific branch of the Node on "bird.cfg".
|
||||
type: boolean
|
||||
maxRestartTime:
|
||||
description: Time to allow for software restart. When specified, this
|
||||
is configured as the graceful restart timeout. When not specified,
|
||||
the BIRD default of 120s is used.
|
||||
type: string
|
||||
node:
|
||||
description: The node name identifying the Calico node instance that
|
||||
is targeted by this peer. If this is not set, and no nodeSelector
|
||||
|
|
@ -550,6 +555,14 @@ spec:
|
|||
node appears to use the IP of the ingress node; this requires a
|
||||
permissive L2 network. [Default: Tunnel]'
|
||||
type: string
|
||||
bpfExtToServiceConnmark:
|
||||
description: 'BPFExtToServiceConnmark in BPF mode, controls a
|
||||
32bit mark that is set on connections from an external client to
|
||||
a local service. This mark allows us to control how packets of
|
||||
that connection are routed within the host and how is routing
|
||||
intepreted by RPF check. [Default: 0]'
|
||||
type: integer
|
||||
|
||||
bpfKubeProxyEndpointSlicesEnabled:
|
||||
description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
|
||||
whether Felix's embedded kube-proxy accepts EndpointSlices or not.
|
||||
|
|
@ -1083,16 +1096,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -1180,6 +1194,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -1288,16 +1322,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -1385,6 +1420,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
@ -1414,16 +1469,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -1511,6 +1567,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -1619,16 +1695,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -1716,6 +1793,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
@ -2300,6 +2397,11 @@ spec:
|
|||
host endpoints for every node. [Default: Disabled]'
|
||||
type: string
|
||||
type: object
|
||||
leakGracePeriod:
|
||||
description: 'LeakGracePeriod is the period used by the controller
|
||||
to determine if an IP address has been leaked. Set to 0
|
||||
to disable IP garbage collection. [Default: 15m]'
|
||||
type: string
|
||||
reconcilerPeriod:
|
||||
description: 'ReconcilerPeriod is the period to perform reconciliation
|
||||
with the Calico datastore. [Default: 5m]'
|
||||
|
|
@ -2400,6 +2502,12 @@ spec:
|
|||
of host endpoints for every node. [Default: Disabled]'
|
||||
type: string
|
||||
type: object
|
||||
leakGracePeriod:
|
||||
description: 'LeakGracePeriod is the period used by the
|
||||
controller to determine if an IP address has been leaked.
|
||||
Set to 0 to disable IP garbage collection. [Default:
|
||||
15m]'
|
||||
type: string
|
||||
reconcilerPeriod:
|
||||
description: 'ReconcilerPeriod is the period to perform
|
||||
reconciliation with the Calico datastore. [Default:
|
||||
|
|
@ -2528,16 +2636,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -2625,6 +2734,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -2733,16 +2862,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -2830,6 +2960,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
@ -2859,16 +3009,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -2956,6 +3107,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -3064,16 +3235,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -3161,6 +3333,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
@ -3294,12 +3486,14 @@ rules:
|
|||
- watch
|
||||
- list
|
||||
- get
|
||||
# Pods are queried to check for existence.
|
||||
# Pods are watched to check for existence as part of IPAM controller.
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
# IPAM resources are manipulated when nodes are deleted.
|
||||
- apiGroups: ["crd.projectcalico.org"]
|
||||
resources:
|
||||
|
|
@ -3381,6 +3575,14 @@ rules:
|
|||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
# EndpointSlices are used for Service-based network policy rule
|
||||
# enforcement.
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- watch
|
||||
- list
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- endpoints
|
||||
|
|
@ -3592,7 +3794,7 @@ spec:
|
|||
securityContext:
|
||||
fsGroup: 65534
|
||||
containers:
|
||||
- image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/typha:{{ or .Networking.Calico.Version "v3.19.1" }}
|
||||
- image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/typha:{{ or .Networking.Calico.Version "v3.20.0" }}
|
||||
name: calico-typha
|
||||
ports:
|
||||
- containerPort: 5473
|
||||
|
|
@ -3636,6 +3838,7 @@ spec:
|
|||
host: localhost
|
||||
periodSeconds: 30
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 10
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
|
|
@ -3645,6 +3848,7 @@ spec:
|
|||
port: 9098
|
||||
host: localhost
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -3711,7 +3915,7 @@ spec:
|
|||
# It can be deleted if this is a fresh installation, or if you have already
|
||||
# upgraded to use calico-ipam.
|
||||
- name: upgrade-ipam
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/cni:{{ or .Networking.Calico.Version "v3.19.1" }}
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/cni:{{ or .Networking.Calico.Version "v3.20.0" }}
|
||||
command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
|
|
@ -3738,7 +3942,7 @@ spec:
|
|||
# This container installs the CNI binaries
|
||||
# and CNI network config file on each node.
|
||||
- name: install-cni
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/cni:{{ or .Networking.Calico.Version "v3.19.1" }}
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/cni:{{ or .Networking.Calico.Version "v3.20.0" }}
|
||||
command: ["/opt/cni/bin/install"]
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
|
|
@ -3779,7 +3983,7 @@ spec:
|
|||
# Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
|
||||
# to communicate with Felix over the Policy Sync API.
|
||||
- name: flexvol-driver
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/pod2daemon-flexvol:{{ or .Networking.Calico.Version "v3.19.1" }}
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/pod2daemon-flexvol:{{ or .Networking.Calico.Version "v3.20.0" }}
|
||||
volumeMounts:
|
||||
- name: flexvol-driver-host
|
||||
mountPath: /host/driver
|
||||
|
|
@ -3790,7 +3994,7 @@ spec:
|
|||
# container programs network policy and routes on each
|
||||
# host.
|
||||
- name: calico-node
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/node:{{ or .Networking.Calico.Version "v3.19.1" }}
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/node:{{ or .Networking.Calico.Version "v3.20.0" }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
# Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
|
||||
|
|
@ -3947,6 +4151,7 @@ spec:
|
|||
periodSeconds: 10
|
||||
initialDelaySeconds: 10
|
||||
failureThreshold: 6
|
||||
timeoutSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
|
|
@ -3959,6 +4164,7 @@ spec:
|
|||
- -bird6-ready
|
||||
{{- end }}
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
{{- if .Networking.Calico.PrometheusMetricsEnabled }}
|
||||
ports:
|
||||
- containerPort: {{ or .Networking.Calico.PrometheusMetricsPort "9091" }}
|
||||
|
|
@ -3966,6 +4172,10 @@ spec:
|
|||
protocol: TCP
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
# For maintaining CNI plugin API credentials.
|
||||
- mountPath: /host/etc/cni/net.d
|
||||
name: cni-net-dir
|
||||
readOnly: false
|
||||
- mountPath: /lib/modules
|
||||
name: lib-modules
|
||||
readOnly: true
|
||||
|
|
@ -4081,7 +4291,7 @@ spec:
|
|||
priorityClassName: system-cluster-critical
|
||||
containers:
|
||||
- name: calico-kube-controllers
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/kube-controllers:{{ or .Networking.Calico.Version "v3.19.1" }}
|
||||
image: {{ or .Networking.Calico.Registry "docker.io" }}/calico/kube-controllers:{{ or .Networking.Calico.Version "v3.20.0" }}
|
||||
env:
|
||||
# Choose which controllers to run.
|
||||
- name: ENABLED_CONTROLLERS
|
||||
|
|
@ -4096,6 +4306,7 @@ spec:
|
|||
periodSeconds: 10
|
||||
initialDelaySeconds: 10
|
||||
failureThreshold: 6
|
||||
timeoutSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
|
|
@ -4134,3 +4345,4 @@ spec:
|
|||
---
|
||||
# Source: calico/templates/configure-canal.yaml
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue