From 1cc7072be15a26e3e138850b6d2a73b6aa310d06 Mon Sep 17 00:00:00 2001 From: actions Date: Tue, 3 Aug 2021 20:10:11 +0000 Subject: [PATCH] Update rke2 calico config for Windows support (#124) Signed-off-by: Manuel Buil --- .../rke2-calico/rke2-calico-crd-v1.0.008.tgz | Bin 0 -> 36049 bytes assets/rke2-calico/rke2-calico-v3.1908.tgz | Bin 0 -> 4725 bytes .../rke2-calico-crd/v1.0.008/Chart.yaml | 5 + ...d.projectcalico.org_bgpconfigurations.yaml | 141 ++ .../kdd/crd.projectcalico.org_bgppeers.yaml | 106 ++ ...crd.projectcalico.org_blockaffinities.yaml | 59 + ...projectcalico.org_clusterinformations.yaml | 62 + ...projectcalico.org_felixconfigurations.yaml | 561 ++++++++ ...ojectcalico.org_globalnetworkpolicies.yaml | 769 ++++++++++ ...d.projectcalico.org_globalnetworksets.yaml | 51 + .../crd.projectcalico.org_hostendpoints.yaml | 106 ++ .../kdd/crd.projectcalico.org_ipamblocks.yaml | 79 ++ .../crd.projectcalico.org_ipamconfigs.yaml | 54 + .../crd.projectcalico.org_ipamhandles.yaml | 54 + .../kdd/crd.projectcalico.org_ippools.yaml | 97 ++ ...ico.org_kubecontrollersconfigurations.yaml | 230 +++ ...crd.projectcalico.org_networkpolicies.yaml | 750 ++++++++++ .../crd.projectcalico.org_networksets.yaml | 49 + .../operator.tigera.io_imagesets_crd.yaml | 75 + .../operator.tigera.io_installations_crd.yaml | 1242 +++++++++++++++++ ...operator.tigera.io_tigerastatuses_crd.yaml | 104 ++ .../rke2-calico/v3.1908/Chart.yaml | 7 + .../v3.1908/templates/_helpers.tpl | 10 + .../v3.1908/templates/certs/certs-node.yaml | 13 + .../v3.1908/templates/certs/certs-typha.yaml | 23 + .../templates/crs/custom-resources.yaml | 24 + .../v3.1908/templates/ipamconfig.yaml | 7 + .../00-namespace-tigera-operator.yaml | 13 + .../tigera-operator/01-imagepullsecret.yaml | 15 + .../02-configmap-calico-resources.yaml | 27 + .../02-podsecuritypolicy-tigera-operator.yaml | 47 + .../02-role-tigera-operator.yaml | 253 ++++ .../02-rolebinding-tigera-operator.yaml | 12 + .../02-serviceaccount-tigera-operator.yaml | 5 + .../tigera-operator/02-tigera-operator.yaml | 85 ++ .../templates/validate-install-crd.yaml | 31 + .../rke2-calico/v3.1908/values.yaml | 49 + index.yaml | 20 + 38 files changed, 5235 insertions(+) create mode 100755 assets/rke2-calico/rke2-calico-crd-v1.0.008.tgz create mode 100755 assets/rke2-calico/rke2-calico-v3.1908.tgz create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_bgpconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_bgppeers.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ippools.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_networksets.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_imagesets_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_installations_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_tigerastatuses_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/_helpers.tpl create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/certs/certs-node.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/certs/certs-typha.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/crs/custom-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/ipamconfig.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/00-namespace-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/01-imagepullsecret.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-configmap-calico-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-role-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-rolebinding-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/templates/validate-install-crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1908/values.yaml diff --git a/assets/rke2-calico/rke2-calico-crd-v1.0.008.tgz b/assets/rke2-calico/rke2-calico-crd-v1.0.008.tgz new file mode 100755 index 0000000000000000000000000000000000000000..236e170e6e123066a1b9517ca63dba5ebc049f0c GIT binary patch literal 36049 zcmZ5{W0>Z^v+vmEj&0kvXUDc}+xCua?AW$#+qUuEJ^y>obMJHVp;KL5=~OD6N>Wun zf@ml-p#RzcR6sO_l1hxml5*^_o?L83ENYA<%50We%3SOUYHI9q>NZw}b|#)GzwP-X zO>Jy}uD-3^aa-#t;XWJv!3Vx;6uBA9JrYHErsDF#$xY4GNUh=|H@Rr0>KV7wv2b62 z@PPQ1-mboP^Fpcf?Sp&Zq^R5$zWXuC=G)LWh$pUMAXMI z6<%=h@bGeae4qgW+}xD_z}Z_>5ks6lK0!_wCl|k`=hN`~{bbRhx_&}YS(fl)vZcr} zrbIk`RZrXQn27QZiE^flqxj0G{)ntZR2jriE|jfBl7&%fj80eYk_kOJmElxcP|X@v z#r|BHS#kr5@FMFzaj#D$#l7(X2^EGng4cx+`)fMc-cpy*|$eZC*bL^1WV6*?`%Hlvx2eu1|~f zxw;H@{Y$2_@XJGn+qQ_=F|pEEoo;h2GiswWn;G!%!EU3lk)^pt256z6x>zhBxDTZ= z+6H~Pl&J+46uXcdtIas1?1|Q01%`?5!Kx7J$F#jm4jmkeB=U?xDFeSdHRt*?!M`m2Uo#xI!}R-`R{r%%%rE-0%0puE*xW)J-k?<|tBz zl$eq}G>yR2vcn^OA}LdFn9+_q)|Dm`Df{?FZz(P9Pu8{wpKh6JQA2M2SaCP06GpAf z#HT~F?c`A$qA0H2jk>Dj$qy)~UEwJ->dV)3qBWj-&AuQxWtpffqhg{~#VCgzVH#q2CJH zqG3ia!1nE?;?+UPwvjLSMpaP)+4?ukc>+E@!rlrDSuW-v+b{_(j9_W|+R|ANQxpKa4Ernphm0VJ*I_hko}s-Zn0HjjcBQgVwC2PG2DirzzvbZsOJTjLu<$o^CjZ%Q2j5Eg~kXDqBnptqQA_XPvJAve*ha zDevITY#R}Xs3XwN(Tt@(k4^&HV>Ym`zOf`sl6(@Z!h7dhd+!hC)H1<}1jprGF3PXy zMLq-x%l37;ZuMMX$sgiFp$dF%gq~sMsjzkr+^)|I-s@MVXm@oV{2fLu9;YxKgX69> z!l>j+5N&uxi_^K4+aHJ{K6Er_6?)jsSrPM^Z0j?}E7ytOjT^$Z;ISgoT`C(pQwtqW zSCH*onrV=sWL&$%^3a>NJpurnn&0gLcK!bVoO=1-xUkQx-pN#>?5u9D49$(GRRic% zkuKzR=90UXesB!!q{J$V6BA{5PXqbF`}U!T90*7CzYVK~qx_DlY+S|V^}D_9tv=Z> z-#$DjqSD8P*|b@Pr%$+*Vj}5L0Hr^H`X0oXqMaNeGe?<;pJef=FJd`-go2n@^?w6T z+nORx&7?U%GIV@j=>>nZTefznI3A=&uILsgSA%9yFx;!psGpGMrz|?-&BoC(%%wnb zHpe#rkSoUS-osA|1HpzA$HTw=)Q=2L70dprZmg>?a{jsJZTU;RYGe9d9ycrtnupdJ z%$K@GRd7rmxZG3+UHl4;o-Vgj-_1tD5G6zIv9!O@WRcV`mXwmNBTK(4aMTjzfoov$ z@4kZewMC4I_5Lum(qihA$m1{Bodq*(ZjQ)~!~znp|FYJ8#mduvIrVPPYBJ9OZ)XqOT}Gah7l!J*`SC$wrRPN=e;&+uA}RKhG@Xtz1x8hT z8U7Y`6&5FxXT#P9uYf`<)BZ=)VgGyb9S1x~DG)kn{-Y8DG5SA$$KWRIPTCXS@-ceJuVJ`8PIsiXRhpp{v z1c~--ekC3QS~F%!;K!i25cb5cU$=F!^!Jd`;6YVKwV{2j5qE$936)Wu?-|QOYp;J~ zcf*^6JxZOxPa`}JU*70CKxss!Xq~~I`^uj}f`aW6FkV%3Sk(XX%9X2N3J{s{aBAF5 z;R2T)-Z1xv$9gwF*=*@X<9P=o@9uwN|FsKos6C0nTYo=||7Dw%l}uTb)V#$p(|R2V zZ_gp4R*v4)JiCx#t9G$J(#SKi;2y=$mOqaEY4Jn57-!iX4A@k*?G2TZS_MYFD$<-t znc|W$a_Ti1&>ZAe83vLu3bd@>=&M+3+*;DpY=-*mL&3np*hB=$*`Rl+S(;W{pzwCn z8neEeSX1y`VXEeOasRuHNM2- z@Xm{Pvt`)zU+;V{+8I4kJ^QA6)}adS{6O7;$<$n#m|kV|M~CkmN`{$~MmpX{5Qd7bMq@Kja>4nc!b0++>0_ zsh3%f4zSq%{&eS==!$zrOyoypWL3AwQ{zIAgvs{2gDuK2F4WGy|83wIB>DCn2ak$cw*fLnslw63kn^{e-fA4pzxa-i0 zzi!b=cm!UEtR)TtEI9a(oE~o;wz0V4jfwj$5-r(hQFw8^bPlu-1Dv@DvEl)FwxAmb z4oNqHPa(@}Nab>NU`>RbBY4R$Uu3k*f4SW^HPyMz@X4RvG;*V>637<$NqFM-vhXuw z_he*n$QSW3r%a?RaA`_iGtLQ}&t2vl;m3e;kxG<8>3^MKn~?h1CPLp}FqTAb6+nH7 zBXs#zF!uYtZTicXUM|}I_?ZbnafwQb@vpHn^m2VFY@XmS-Xnd&!l`5!Sc>{rgleGN zy*auA^$87;y8CC=i)wAad_^sq08KYo({RCqNs%eGcUY%&lHO(szJPmf zdCdl;o&D$oVKPS#)`m?_MC>~?A)j8Dki=&2_m1}e{9ZzdsJHdHnGx(?U^Req^WEsZ zT&%7c9m?$z1lYxfR_T)VZ%;*gko~&4oZ$3B6>fCf?2$Z*A#WETpvv=V%I_dJ~oty2a!2H@o9O_-l8j;zv+GrHp56yKF8N&qIPlB z<7zcR-WezR6B!4+-kB714gN9mLmQ&K+5vh6+5CL>m6b63w1E>6TPdZh25u;h` z!WZtM!x3Pbk4R_yf~za9Z1omH(ZYh1ZHfZwoXc3bJw{ZMVJ&i-F3CPbc|s8$JZF@U z!#2hvwD>UA>4U6xA7g-HEx_fl;Sg<|-2w6r-$}pxp;&U&Any2AhN0Mm3_AN$S&`CB<%rkp?y;DGZDzYtVf)@& zPgAcKp2Apxf{TBL{t#OFKu8&Xj)EV@1n}>@{F9GTZvZ4S zUOE8cQ6(MZnp-g4j{xH&HlTO=faMM#8R;$!0g(sS1?c-!FA%u<$qRhlC1=%@>bnaN zpoP~+8v7h~Va{1Ni^KZPNvg^#?vNpk?fmk1ncd_MgQm$q)8l8H2HHF=d^8r0oIttT zj{hSYd7Z(CJg;I7&H4OG?9>^*ofO!wSTId2DV0m^sYX)^h*IF^dHQ`hxM1P!`LG{E z7vQ|-R9ma+QZYT8B<8N`&}KH`$rfu=3Xd6(UNq(>Q%ra&pqspkN#R)+grDp@dH`Y8 zQ*-h@@OIiQ<4HE16g|8HyzcDj_Y$FEa+_rRRmDf7yCVdICTmi4Z7)8|5$MhtJ}1GM zr+d_?$=#bETsO9Lr%EN56)iT)E4eG*dwB*t=+Z{`k0PPLf@BE|{f)sfW9}U1fZI73 zR{N{|m!uj0UHAClyf6A2mdRn&bF=m<)+V=NS*5_ks}lX5)+ z3y5PV8d<}u|CLJJuIK^|hlMFx`KxP4#G#a2>m+1)Y%se7X-Wfy!>!b;Ujy#D`YxJ` zMvfFrrxPO&b0l#hD1iJy54GK_G8e40bCwLfe%l>+9KBBEeXBnyOWL&Q(a`M;N+u~| zo;Tg^@850`lO&qowB{#BJgji2I0^^{wg>c9*=?amAm5DLDypuQPg@7B|xM@4|$j6rd&2KfD)w%nL|Bg72gUb z3K(A^ecU-_tS;%IpmK^G+alR^4Gvc+jWSHI)sdD9eJyscY{jHHd4j-|`GffBBk)Zx z>OtqPCf-prat#ZKe)s}xv!&K`9cSy>sScoS^TbY7-AL}Eo+xfMItp3im+;SP&lgch zmx=5V2JXXHajv+jh@zXN^ZgQ=anPpbgUn`1y4p4ot}{U_@-bToA=b;DgDs*dRi?T^ zcE*HU9TFtq)S^28g@7%@M)3Fi_Pg!#4G9kU$T1yhu0X(VnHL;#n?jG4ZGavrSkr{Y z-Llo1Cv?FP(ox7{u5{rt^Jac-pc_q*ntO=X69Ka+AZML3o>+>qo?eaV;-b2T0p~yL zxk?RnNu8k+;Zl7#JZV<8)Si}2si0(hTFGG3Nqg;I?ee79Zij?G)B%@3wJlzeWRWDrPTGK% z1c!=ZQo$ZIuc`?_ncvt;0B7dRLNcG^WN=-Zxc>0o_V7MEncz0BG~@Ozwf2GQVc*`i z6Jhc1tDQ%v`(a-QREkaLeX4|zoG|abj#p*;Sb8}dm6CPzlWYj?Nejq9b_~aJHbvcn z?y6mtc7}Lrm1japaU*Js{hLLf_OV6C%1Yqrq9@$JcDH)sO~ zvU9t8KqV55{|(#3UZjozKX1#y2%38=-Y_LLQ_@2Up2y|iWu?qiY7z&+<(w^!V+yhJfV=f^$szs<6tqH5G zW5;N&Gn@TmOV`#3lZAu;VP4lvW@LMJ#^jN)HuJ0$tLueQI}`CIK92r5oyqM1R=n+Wrb4D)3vw7FKaOB|tDr(5dLZy8 zKWL9BQ|xL=l5;2pCM_CXv@S{9EW%P zO82gm!3tFjKeXDMLT|A;I@B4ZI<%P|Q2LN_K6HSaL2qnNCb zJ?gBwKN(TO?_0bkay_*&h}q#U;5dhxsW|WE71LaIueuW74eyH&^^oYX!-jY(oW~#7 zn@&XEQU#%5C5&d{!czz0jVAKB^PX$X(2{|dUgJ4oB)5@7?$J=6KC(UAN670DlY#iU z9Sivj0=Jss50T;*4}BiyK=96>ta#a^jpdl`&tEmEZU7y-R4Ox6EO|+OcT~K zaPxgYEHTOpX--TUUTf|BJp4_0_|PSEzw0y1fa>pxS3Ha~%Z}CXTk+bD;JrEX6pLFi54YJ>N`;C^7Gx^>-C;-^l*qb4 zQ+8(sM-8`t1Gx4ANy(fr2{TFc$nP4hHfnTI$O2{xu-IaED?E`%|Hl02nT;^l zD>@XhctfwEV}i~_qaAZwTn)L68dhsui9^>XCA3}j>B;`^f-HQ{9Dh$geRpQ%_4>Zv zK&&@}Ov7i8sen0cw^+(ZUv}*fg%8Bah&1Q;_C?PtUDeIO>_b0|yIKZ9k{Y^PcR>hW z@i{2vuV_i1lYVH0Yu0rMF zH!h16(Qa`gm)&+GF)iA+-8^Xe=-T-+wforjR-`sG^xgzt%(?TUD0#T^N~SJY^k~k< z?vkk>9&^B1pfHJH(^M31Z93?=n2$Guu~IWHUMH1wuzf2#r`~ZLM;<3q7?HCeYwH0Di8}Cd7X5fzzw`u+@ zr76v1K5Kk0Fz;^%&(oSB;Zsks$5&E@l1W99D8s8Nugl!0win4zh0dg!SznjP-S z8ZnfNKy{x`;A=<0I#lZ^4C0c&ncsz+_}ny{@VzTC_N)zSj_;?@mcyl}CFT?qM2+4U zW#(o21cK3rwLbv>PS4+8mzN}8tLKwx3|qbO3JQ<@zUXa^pK9-k;vXm)i8|BSj}RJT z+j{sw9tch`h^L)dC#|&+Ox=In_bC?$LetA?9$aY44M}_(MoRjz4UXdnIb8W0AZ9pCj!_ zS(JdaXJ=6E>@qBOiEd^m&gkr>5CGLvv@mz--UeZHD%Z(ShGtUMaJsB5Z~8V3wH0VB z9xuD*$leNvi0~YZJpe1ds59IFKr`^iTwpWImQ12_nFomayo8rg?EpT^~Hny zlOMtyIfRi`;he4V33Pw!sMf5Ef)`i-6K0m6J>CF+LuOJ6chHPoRv|)tN~&89{7Amk z)Xv!VOeUE;=0<7M{FtbWAnfGo{|mgw?}iY~*Qxx1kolvdO`637T3I|W&&(^6czHDv??R}>oSA;2Rj{3>m1{;33gm}T zL%%8h*D0@im7s|9vc*cy>N@c>h=sE;Z6yV|klu-P8?6w1xIx7Z@YB5)82 z)Wy%w{ty4l$ry!ZA^wc!?CUEcpcQ;*zdtkM_}-7QnH@p}9XF(az86b5 z+Gb06z#~0lzZ%q7n_gk5Cpwb+Mqlyhku)|TOh_b~x{`sW{&_=^vXI$Jk0z5yGN`&K zi59ah8kMBC(Ce!;dp5j3o}hxyGTw*%*}w~d#Y8tqPTf`eHQL~$n9+! z=!s3)trB?+eC*9cUMNEJ>*Mw=2kY~93e(67Kv2hX_9W_@jBt=UXyR|5UpC_Waj+x0BsG2?8o8+Ul*o6j5c z()`>E`ZpIb6Ux!HokYVwq))$Tq>+Xh>!`-K$jN$<1p_igWkOsecGoxi=rz=MLtLPw zcbI;^-UPsK2VnitKojT~U~3)~{oc2b(5Kw}Ze{H-e%4r`yOXc1b`BgkHArvYr2{=Y zwY9HCg8PM?L=6L8r%GorM!Ieczxyw70nX$jw*$%NRbM#n9(#l3YP0!MTHZ%+jN-dq zi5CEFVwL?E5<3oP@B!Zzw1CUpFV|>`?ytyrSjkO06{-bNUKl=d_GD++CO4J&iYlcV zM4~Y?xqQK(?_%=Td?zVy`A_u!wk;Jl+2f^xd z)(W9RY~3-5gcFFRFz1|vZ455|ml!!Ps^H=;(B{A?y@%`=5{}Sn3PsC%+XYX1q5IA& zvJP&J42M2X+>X7sMs6byNYWPYTZlF^l2?2BkK#_8xq#To%;RiQZ$I2-na~@}Ek_C2`UPDKr_-vOt$Us?x`D!Yh); zI8(k`T=HcotcA`$$A)JQsao@w^)7F8s_ym`H!*mbOB>!U+Ux#lWTxsPQIM*4$>;C~ zLDykZw9i8zN~>ZhL=Oi;Jw!4ui6gWJG?{M~_!#!WXNHmkSig5 z-A_BZIN|Oz0+EFJx4xo%+zs<#)zq7>j{KudEP>nJ9^FE{bn2%Zx7ofFr+xPazH{^n zCF}xJcE3D=ucY?}^;g&V9Kx*%p;L9Euj3S*?7cVKVrL%>#AGmv%&|fesHD+gJ3OZq z6DEvJm>6M2_zh#cqd44C#@1t~^s_32U9eGEFO^(^V+v*0wMYGB7g_Hu|I$z<(Yy{2 zD^3tM%At+M-!;7AT~GBv3T*0DI?Hy)OM#3pbNxzvY01g3?@No)b;LCDL!tJCW|?gF zUZPJ&QI2sZT9wZ;@if`P6I?}Fx!{bqyJAV>W+UI~NxO)nW&{`(K62=o5OiOz(rUBn zx?xzKevxD%>Nw{y-yOfbajNgG!(u!;SbuhQyJ1Al*Ck(%ICkwQu(>m{Jp?E=(1OPq z?CG&7lFpHY#HlE{yH{BFUdW<%N^QEY!(AZCl`!AZo$gpB11486O{kJJPBRVWK4^SE zHx@nT=&y-Mq>wSW$Zu&Q1!FI9AJw@A6}ieQnY>AK*m!lVF-wC8XA^LYGT){8a|?bt zBJ^w>gIrTDA0WExR+rbKlWXOBVM0?`GgT_qx?of5a9uaBBy`<|mP(8W0p4E%AhiN< zQJFC$^iz_R$SRPe~195u{vMkC>lbu0tTi7~&?`t5xNg`@OTo_feghp30u?kv~(Ic|Gi zhuSLhVveA4D%|z{Zw_q4PB^|fB`Zz6c>6YFhIGv1g<9sQuxhITfbR-ETu5$2PtcWm zDao{gRdHYX)301Dk)>gFa<0~RPTFoyU7crxhoj5wd?ejbE=}~^4z$qWRARXjb&Eq2tuHTz}T*5 z5bP%XOUgQiWw;lLn%zgh+C6Xy6Sr?EA-gPU262lP{E*I&aH_FtIrTeL=!~)9&8H-r zE3Iqaglm$^VqDC(;=W7q5+pm{zOhPhf6x|U!??2)wC`KLY^~zkID1l?hSbw4qy~Mt zyZQwOhUkGFjDn-=#&L{N=*Py7NE{yGC62}-u?L3#?(?Pxmazj|tDwHyI3~}-5@n}Z zu^kSS^f-XijiQ5jkDLN!fBSl;yu9WSqmzjvvV@@;QJ*R|u$(tG+C(RNelDuir{^2s%@<5~NQ1q+9|z4P z!N6Z?q9kRKp@JZt|EMTxf4!W9JBr!RF%veM3V6xZkO;-DDn7xEQB|;Bfa?jZ)QX(~ z?e6Os4a9`Q4%bCMjjmDLB88-yODIt#^Xkia8_4Iv7hzl}BTNKVGn8Hq0dPBnyfmdW z56TF^JxBUU#+*Mxwf3&xp8;R{&!3Nzt3!&-24+0l(w{p=K{GEktaXpNQ$CP1`n#7t zASJqC=`3&4Qaaqbn6T>*@N8b%N)Zs^O%aCr&X8wSk2qzBGa(%P9HaiTYe_ZjD!J)i zuZ*!_@1}p_X1vxkwMUD?Avei*B0>S3!#G}< z%RpG#I)f*pXC{Xc&*Myk)$r&LMy5NngX0|`^&gyy{(w+^gkpB6^k>>Pg zU_Ua41Uk}^mZ|@XJsFc^WaAG%y(|az2#UVCarrM-)LD;p)`Pe%Tdw(n3RxCtKe1ES z7+b3f-xrBG*cPo0F#=)n)I>&#wJ_q;hQRc6>&!lrtwsD5B@^sfk~dghn( z$AgnK34?Vl4Na$eA$f)FHUZr40!;{5XQttUQVTB+N+$>bhOwYmC2R}f_un>Tt5cAc zBBK6jb9c#;Vj&spKGOYc&iGFBoV#Udx{VO=30TH|4E+6zVs%$6Q=oiaK;XV7>}!(h zYl;5CeW6<5s++40&Al&Kl;}Xy7iP~J9&s-=EyYaS zqc>nuIjd-hBI|%ARS-J?LgXrDmYf)TV&e7FVueN^H2dPdHY6SX^SE6A!7m6u5h?iI zMGVav>)V5GE;kDA#*OMdx1!>RWkMsJalETe@mpC@@Xu|bi=<}+VGHK?0$x?px!}a< zi{KnOJd|az1ny}RqzceB0lS2K+?9@SFT|FXA{iKeIF~PNM1BmpE1WfX0SG0t*1{(ZR>vKm0f9mGyna!WQI3uW|KsFtg6)!@9o`lyi|L$27c2%8?&&JmQkX<#* z%n$vn2OxAx&EPO|*y=6q-{@b4qoIB=pK6p)M{94F$4wLE>yZ~RIO$qi2y{`&hU|ZJmw|nAzR*SUMAP?AiZ35dnSm1Zr3)ZDl{F2oCV~WDorxKrpe`zqGq>l({0C z@--ZF;w*mrpAWkfg-i4xx`O_{5e5vcG{W%M=vfOxL5l;$nFxgPjoZaWA$>|n4J*{&iaUTz4Wd3B6{Z{1 zeaJ|d>1-q{g5=E{wUq>Y$oZ;Ry3X?pbOh=;lZ$#o;CO*g%UQY@G3cW{Szm)f98fEX zXsubh&t+z<%zmnVD`R#ODw|8>Ij0WE5vdF(2Zx-Lb)!8W80FJE7Ze}B!UlyE-4N`R zM%w7VsCRZkfl3AvR^Huj>zjLBicB z&=v7M7>TJClri5$L_0RD(1#hgV3CJOrgS?-d~dhGX|@kh)|j^Zz{Y%u^iEWO-ccnH z6*4z2-CHI!4ev&CYk?cdq&jvpV$5a|Ia++eiB;Kj-;3wa??0Lk(cLgVDkv}k!dMa4}MI;qK^VP^1@ZP!r1l0bA%-3iajMxB{WJb_)>4FJhgyjv>nS-W%iP~;yckUc- zG2Prao}yq(1K%6Cy6^Y8V{-Hjn`~D^Aujpr|ZK^X0#tvOy&F8JF zA~p2KO53d)J)s#voFCSlguZ&$bHe*m5wcriEafKBZ9IwW;pbh*wTFz6gx6QfRR6s| z*8&n9tsKohH74B~8VW-1?FSD9*t^pv%4h64>qY*pq*J(#OpJmCI;$oKi1I}DQ$EPQ zHzjg2m!*@db(rjv!m0DMlWcibEh`U|+j#tOlTV?G2f=QON|I8vR?X5=4jhf^bw~JV0=f9O8vjY*?ofz3LJo(^?i2@#>3RGzx|#KDAoc zWXKb3T=uGuRad?DQ)f##cCEz?OOaA3X@XNh4m?{!-UE+xgNmBI6@K{R%n7>U-%px= zDgu7g4KK#r5mDdGRlQU&4v+@{XEMl2>X6lG!K8C&zNywGq8GzW%#%7?Lhcp9`S?S^ zHR|&C^H=nZgVr2@2{x)8KT+8K!v!81_ftxvl08d34 z_65$1O#>_Wwdu^qu7y0b^6(ygR5W^l&d# z$7!-&*QmjrM$P>Ny62h6?cnqyCKl89;rlWRl=*xAB!Ce$HZQrg#z%|i^R}Zd;^XGK z#}o-;kNDwo-m7$p_Vaf4XNesEwz=Buoa6QVFw;*u`i`-W{Z0O~1unei;V3R1;#-`^ zMH22zRWL?nqDvgkQaQHVnYC(uX4Dt*8>iu-O=w5A`&~cI$QJ4_-9FbRfQUZ;mh(M; z#OLk>;85Lvpt%?_%9=*aq|k#N&<-79kEwu2TXoYFN^2rlWAXy(@wqk5d5n<6&9vvv zVT=zXuh+cwlo9^ozd_&2^;p5`6`>xX!iaiC5;#!m*O}jo{PR3#cYn#A{$h?AsePv0 zz+@>RTnFjCeyB#$T`p@b!K?M$`ALpxU*wfZMrH6`=0k{-2eD*DZlN4jy20=-2ek3Fj27ipHh0w4$P6N+ZK2SiIOX(B=X zsAT#qZ{%;>ABEqwrvawvN)6uf81gUbia`e+Z&6;Tavv}iJ3-PTT|)mwTVFTOL$72v z({A+23Qdkmi(d>Qzc<>Ilf?KNO&-EOdM0_UdR@+Y$DQvsyVBT$2@4Y{ z0DFh$gqTK3y4`9DS&vuk#^pF{qOX`GBjYCez_OT!D3;HEv^V8#}dT@V~%{oNov*Mclj(@Bv>jyiqLmlFL zQTJTi>i3-&gZ>>pwy~g7jaIfs_TZn*t<}AUZ+sB6u2nv-Ox~>e2(t|?!KTmQ6V#aW zAbKZ)s8fT=M@w%Uu{wSP!aV zFVM^Gv-=)0iqSqf8G1?745x%UYn63#_(bIWPZvHX&rZSsH8ptA<3|AYY_ zJiKc|?pDmj1OF!NXZg<#zTz%S#e?(XKWF189)RT)*(loe+bH^v2DM*s{}~_5LGt*C zy$Sgrwf+hIn*w~5`9C)KpKJVQo_N-8I6Hue!zaPk4`4mF>Hiz*g*IaQ-{N%1cw0Z9 z|IGQ%xPZ&sySuGdnA-4V%Peu%tjrS&9NM+vz8DtWl>#2#!E7g`l;=tKN$4AJ z(yL32L7vUhV>FDNsgW`uIOl^i=pg77!L2&qASXWjBCw=OiBuoM^-jJsTg1ENX1FJr z)70Ngf|&c4qB|_1EJAsi3q!1lG-F$s~)ouLeh05T4FWOhmu<_X7BSEH`x+N|=ixswfX3G(c_8&hC4E zs?J#~JN?4!^EOwhRAmho=0lS-t+4X7MUsy+CDSgQ3=6CI1d596ol**=l#;Hl55^>aPB;wJ6=R7O%TZVCJGldx** zkfYGjh^;i)PWJCW@O!FAr{oZujkq0=4z#LyPAw_i-@g;S^j zhmkRgof2h0X0la(th4>HVmf-h;m`eK;sNe5fK7jq`S?Q8_$& z)<7}$Eyq$ciqjztV*I~wdBf+?$^Q$NH-4^O#?V73kp~Kt!LH)#_;gl(5&ap<%X-Wo z6F-;I7#{}B8FkoM`Bw z&x1&y_KO2}Go?ziEy_xE6J|2*tk^Fw zLe18}FNq!eB~rr6LvTCN5jZaIr>MVNbe`Y&%a{Umt~95ci%%;9`QHY5nP9y-0p{T7x^{fxa3<}>BgMzzh)Rob_-NVEH6pops8aepZoJw9fZ~nK#dn`??=WfK zZ>x1+?^K;Da+s>I{L_G!n2XQVRgNJ04lGxL{Yw4YL@Tuc zo9$4fJj%gD8k=wLJ4~&8#w^)tjm4)*Hs0MaOE$7hPqNyKHW8zscu~9|;CFo@IKkQ; zq(J;0AXN$ThfuC-7c=K;_x}F;{&x<5ho2kot@mG5JIYUO6qdr|=N}SBD~FwHjo$_>J%+;j2p8^qMZjWi@f{G~{6+!=0FN7pYMC(B4p z=E>(DWZ6aIF1{aIG_ZX1Au55%TOyR?xBWl?70gwugS#@j4k+i4^KXcitK%&In(Z* z{p#!KWwxob8_DdNxN$K?2VTtX$t;$zH3e_elyAd%(|6bU_wpuqmkG9wAVvZtHqvPo z>gz-w_KZ%IbQv`p=ytZ9;~F-h=+;=tu&jU8^`br6c85`V*LN8ZG`h;^Bh~kvj0nHB za#L|AhL>n>-0*T%)BWz;ZvD4z@H~R)11d7<4&X7@N7bHY@Fbn4zDW$$soAoa`jIDo z$j^fMU2&%CW`%1qP%LC-_`Z(3 z6}_Q*uk3=#b7iH8rT)bGMH4ScL#y(#750H<$_y$cj^4(J2X>M&yBDBH2(3MZr|GYR$ zc6mM23F79$`kL9yB~BN_DUQE+=eRH^eNzE3*j_3YYe@KtY~@QwO`XHf%J%9_Ovjs8 z9ya?CD!;K9mhqka)H-72+*y*RUfz-_P2!?X zwPX9%Z@}{Wc~$1m>vD9OMDWk6GjE;wcGfVC5WVAP}MSW>Z^8TvwvU#B_be%nIVW4PkXrdI}vx6r+*DUu-U~IZ` z(%n4WUfe`V*nI4_U zEmBd6oxWC7vgT#cV(%#H-P{TZR0Q`a_?RjCXO@?eBY|Hy!z?wqh`MgqZinYs?UqQ; zRWzSpkvGx%Lw*XyOc+GnIv*EIGS3}1@vb$)p^TLE40Ki!m3QFasN6^X(%$Lm zZ+Bfl^|wl>@U^LBMsOW7FCgYL@j;(-IGceRtdAaWtFGT&KIvZ@rw{+Id+NcT@pZ~{ zcn;nNd&Wfwd=Q-vb!LW|08FyGNeG4@yhjN3(-JCJ48$WDNT#L4%M%@#k$4)H2wKnF zm($|dN%Mg$kj4CLUI7}Grv;s1{lxH4W>;sRS%V zN}C1~8TBhR)qvH$;UqNUD!lP4R`w0U;`4D86m$E~lN1mx{7mxRnR7*Hh%EA$-oiM zw5TByp}OJn{=K-FL5W?!EjOdoOGa5fUHB&@eYZ+E<9bVNp^+1$v78N6Y=Hi zkV4Cj8?+t>PI@x=bO+&O2F}=p$I;Dqkf=jQ{e@UwNLZb@e44n5oKtrgy^EeFTAqbS zhLI*mi|L*vg+ia$oOMn&jAlYfs~!RQuBMjHChlKnecJ-&l2ghK?;vcgsAc4hgSanH zkT_$}8~_GHtDV$Mrk2yFFEueJCu=@eC$_l_s#-}HtiO344h=DrwO+=rxpwig>6nv7DUnb!BY0N=Ir3A|-^4}{LwRjj zRdI0++ma~9uAvQP{n}()ktB3m%(1H=5lrj)d#ycQ_dq1=xz}$-LWBFVx3Rw7PCk$B zF^n*%hH&@2_--+OoZYnOA_J?hw$I#yzOL#1)b=@Pt4+y>Qm<5hb8~*4om7;6T@T)l z?{B*6jIg=_ z7gfeRA`g!$y~9;!-r2i}+*(<>yo_zfs-!8yhUeaU2Ra%$MhN9@VHd8AI$Se?geaSV z)g)qk2&0~h)J^Yw%G0j+B{lv@rH6{3TZG|D%(L5`9;k{7f`EOvA|)9^K_L-W&H z>+Vs`OkYz>U6Z3`Vrj3YvSqoc_vy1n-!8QXhM)JjF%xBk9#FDURQC{+ouIIY3aO~c z`m9JTo!>tBQ&lpP`99c?C9|od4}{ zVkkc|MHJ`7ew5qN702!WEk)8{fv2$y z=FKG)J1i<}?ID`OReugG;P0^3wjcQ{o&8$Kl{cSTI0z{M!)QFS+}TfPnz$_fbkVAU ze5;Kx43VDTBe~8tgIuHAM>Y4(mF6bd@CT}quT7j8F>bIO8h~?%yt2rSpDm$tu_dR* zG#Xq;H=$nEmaxYq{uwyTY=5(!<=+3f8Wc2YlBh5lt2|4p=|kS)LmDL8MOj!7j>lX( ztKl@{?y=N8R<=o6y!@EZ?@9U#YjPDQgLVx4-DZvXVRd23KTL)ts-hIN7QCj2`j;yM zptaw>fFt*1)~WY_QyrZK7y7KCr%MurEUfL;5G0Uc(;8tDT!->ipj$yx$rnTt;B1Va z7bKch9jyS{Ey%Pua>)-q-l~!=1^{hoJNVI8^7hK^!a6y6WAL18lUTa8le8Lxj^H|l`4?tBnH5V?JIE1iQ!A}CCjFGVRh1A z#vR`i$ni(hy#{IO+=a8W8w=!3`wQX1zMTb+lFz{=k}twP18B8pyLqO|6;PA4pGJCC z7KCoOc`|aJ$6%)GN;o1LFc8hSDWOurq6{)v=Gd}4zQ96JPx9aB4v#Z5+>%Lwb8e_ zu$6%^Xl8CmH4q*i9mMx&s=&-h&?KB8$uN0Rm&r4E^|=tfaDC{s^n$lSEsDI<3 zV&i2+&s41hfuU=CTaxwDFN*uNA!PmB-2$3?F<5f+DQZMg=YSL{!(XqH&ZHc!f81Gi z$b`~ebdW?(7(C8>2ZoIrnM&b#K#?1nqxQ2$V9fR8DD5poWTGj_=*Ph8#8sAc9y;(&n874;KxxrRRTAXV+>T@9-MzwKSe$Fxo8gOn=^n z-`FI&01KNy(pEWW`%Vy=;kcZYE8NTGZ9`qPx|ERj`sXK;3`j zS^MxeH+8P#wuH)|A1(M1RopcgY?mamZc@8hVU#wcoAI^^<}L? z^df2QFy`OeAAAnx5eg!cI0XQM^o8r;i_qv5BJGJRIaBM6vMsht*$?pmXv-V%y?t4S zcC9YW!6CEbgtQV%rE;$zF|T9qT5)Uc1Jz^RbtGyG@n)^_DpGh~E&5Z@i~1jW*0oSK zO8GFfNqlL~OR-E417Gqi2Mrz?TwY`HnDO{{7> zy**XS>so6H{g#Tge0<^gxq0|{5baE9@2K3$fMY$iec_TNSgE#g#!YEH>6!ib^Z0B& z&OwOfC6k%M+D*Z-ZV`9ZROg4a>n0{{2f(?L8I7Qii)GFaKkvG8pB*-#9l$hB^O&bd zGv}A8GkBk{n#Se*rIo!6WruLnZo461n=|BXe#F3G*jBz6MaK9?%%g8SRL6*>{TCqBHc5a$vw#86~DwH^?P7x&W ze;IU|>i@x@Q{tF0Rt=@!-*gy4)JA^Kcm_$IW}BzdXb@fJ;42?%0WtT@FZw*Ce7a)f zLP04qiC;=xP=#gS7$B z^WKx5q-}GZs#tJ0UAY?V?cE(naa&AA6Qh0m!l3So~l0 zd5Tv8-=IsAu|CP+`~8r%$#>2ZR1JE#m$vl)+@O6RbGwonI+_Ce**`>H2>D=j!goU`dh1#X%mA>Lw;Qj@OmedB`|DE9=3efvw+{Dm z*)sh#j@E zoXRll-PPITw<6$S{K?{90 zp1P{jeOGI`X3r4{x;?;-&90Ukh;!URIG|Vw<~@M@UHM`0G*83#yzA>^`gqKYScgzy zK)L{a3Q4Kg|KR7Ru%Iu4l9rhgW1|htoa*sxhrCVY;(B7ds<%z=#K`9PE>nSAhUj}b zrEEn?AZ`_OprAn%eUV|ERwBkpMf5lMJ{6V<3f5y49aG(rAAY-_m=wxUUNQ7uqX2sr z>?mc8@~&9vIHWG500!4bG}ufT?NC0-OKf!ht5pn#mNF>4>eo93m>!TTq2V zwFqu(tBiN6LdEK#BG3g>3?lW!x?9!@k;JKXkxeG?E)q}0;m<#BPHkpLH=8{Fs^y#= zL>Elo;PJq=qB{hl4Zb2aIn7muyZj5CGd9y^Q z`bn5EF>j&|&WryR!tz}5$m>UKy8L@Al&Fdxu`7#l71Y%D$#o4v7=4_WK`>|OeQEal z(!^o&?&Y6+t3Non0?$2-n~{gV~Qr3PlMq|_U)9mboy^ydBg@o|S!C`OFDMwfN1k`I-y zK(u-}*dyAO^V945Plf#(BY5-oQq0ex_tMw?y@oe%z1#N(ppWRln|=QaVjGY3HWGiF z`3GPB-S*8cSotqe|Lp(ITDM7E;JWV)=D%BfKXLIkzJ8m}W!5Z7f~S#F-;|3*_ao@G z^H{c<^*Q0g{j0zKdNkgYjd(Eo|3c4tm;bu*f55qid1XK=`(JkU{WD}|;ZwfG;8M%Nzy-@%=K?t!`GGx6Ww>f7x9&gc2;sCdNfm*XL>vux%A8iSu}ZYl5k zGO0ae^@W)9r)_d_qhf|fYLDN7NcGfR&EY-P13z78fj{S3J6B+55MQ|BpQU%DXTXbC z7-bG3u>1FbsSWbC9df6|p(Yt$@g?ItwI^D4LN4PG0k1>ngn00;kHnG6C({nBpnChJ z5{IQR@MZ^Os<&X#gUC)3BCH3M%W#dipq{oYivHRZ^(D##rM!Y;U!#Ux#WSJ6WR`Bz)tu zJtZ=kx42Sen_s7Kc@9J{5s}RzSVUm;|Gp)8RJb664PaXaGao zr{vrFvyaKhUy0%qk&O>?@~yQ5j+H<44zVDvJ-`Dr^ymXQt1bSq>8;4**?v(=cxMnB z>wIbizoD0Mj)VL_4Jh=<*!bKg!A4qqk4e%6%L$bnmO&72IEAg!&P;`h$m8y_qa$g= zR-$3Z(krTwTgEZrf+cZ9OZlgzW55-vW|RMN*D;888VK44rPRx*0EFuhYica)W0Dcc z70)NA8=r&829rtt^#zbo@S2$}pTsKTDj_~hlMJ?t-hI#p5{I3dTUx8%V3)Ums}&Yyt(B>kH_%Yz&tA*JW$?6@-pF9UKl^?i5vP3HGHn zfN;ETG zzWQ%c2JRsRw(&Cw9rM>o@#Q8qnSj`vN=>o*d+DFYPrUmJm6S;~|41v%-sVfu^ESjv zDNnv=m0)n+FrHL7d0RaJRYHo|iM;PcYL7OYAvj)Z;|;?zJjFU0ynZw({QmS{7=1Z8 zr`h{?gQPQ3l5s8UlX%}MLp@|rhsfpk*j_mV^{$lXtI57flU>OvOyS8+B(sB*Nv#&9 zEYOwlu-L5Mnaq^GQOLUqj5Vv$S_K^u<&rdJzB&ndz<0uPRp%fYg-jOYejkI$t6hsC zykD03EUdyrj1ZH;*)(@hM`Irfx|2JYhVaAc?rs2fY=69V6;toz5ki!-R|;m?gTcfS z4d;RvV?LFpV?R+MrK`9SUqBgj%j{6a3x86-M<;%ZWAl}Tz~WC(D#rQVv%I3n6$f|& zdt$e*x3}=eOdf?;kmqe4T~iNGRAg%^pg_CM5<4Mt#*K}?oLN08dt1_Pp_oz70YS|p zYAGX2bsjQgLAsL&Qgr2dxh_Bg&}bU{cN;;Dl?FkHi*SX0A5`#}JEz4oNPGb$kb*g` zXezw!WR;Yf)m*eE=q;+bJ={#P`OMtB5VIj93k3--QUd6-B&^qMfAG&{w~SZ*$m9ia zRyMC*6kMlQX1!U^`sb7Br#{=m*D*Qp@82Gd9?JXQx*Z(eoHxEX`|gHccGTK@&u8)l zpve2}) zj~@ELW{*Q@-%@_+$1qIbkoq!Wy9e!A!LyHa2s{}d(StAu+|r>kxYZSsUCo-wVu_OyDJE%E1`F^;E4{2?|ur8 zC&zkw?z|8inb1<&aE(yMCb!G_o5axLz#Tf?dWfjG1sNJ-fWRAy<&DRud{Muu4?~#* zklSu}9QaP6pv&2S=lK~vRZifgzs>aDcsW4~mHC($=W!&7uq+vHQ><1~E5wL4dzakVVu$vI=chyeY`Ce1Qz?Wy0zvx zjbs9|DJ61;8XIiGdws}2-1JvKRJp})r~S${vPcIDn5TC~rDEvOYOrs+<+5vp(I(E*Vk z+|$%zC|mD2JV`wmaJ~EKZHn9R<({^^^9`5U76hN6`qqm7UL4Q(_`W-+Ko9)*=FHYB`_TK< zP%;mg>fJKT>ISaR1(iu8iA7Uly1Pu zZcNJBhAxDTFqaYOFAKN3_FmwRqVJe8QcXeTIhAEvL+7D(IwYay;)pN z4Rr`(iGIb{l&*d$aygbcbe#&JgZH4#fla1NweVRNMKkT7OVWsPa1)2xY}^X(bZR{< zZWHuWy{Pcs^_X(^r;ldw_tvfw6@mjHF?kj#Udy}8t=tT(%xM()hAaim7*l*zpA%O6 zGJ~x89!|Ve^&h?8BhphdV++P_S<25S9Ri+yrr$&l1`wJ&jqe9oECM4HxCq%NaGBFI zvCHi(84K08j^S#CiEh_~$Wz(h)BZ1tXH66Qjc4Fp4$ydQ1vUmN0ASaLU#UEzz@yxF ziTD;n2|aw zG@OPI4O)4g;;opg8GNeY!!C1Y=SnV#oZ9x{;5!H;z zD*HnL1k|=rKKx~EYm`H{qlus0{Fz<$Mce(f`y_8n>xvvb^pyXqjU_QKG+3Lj;rOJ{ zr;$Ojpckwqpj09zH1cDUt{yO`G#9Ie?iO~XA}!?OB%LOke;hvsKX^F+`SO12s3HK* zxFWzDk4#K){Zwoc;kn9r2FX>w&Av4ckx+8lv~lt$1L``NyL%^*EL{r!#BtkJprJ(w zPrwwwMt?g|mXa1>S;V}<`D8qGd9BA{Q)#mnE0h^)O5QH@{)wMqk$hoDmo2tg-}_Tm9(wgRqB?cKY|rz_WF*7{U?~_0c^cMuu!IqiDwL{oS+oP(dWFJbW~jGl3QOw zHO)FWB8{Q;ND>Ny0Av`3Mq%fv5uAhq+LrWu~UfYmQ zvj3J*37N!QE+AZW>bD5#Ag67vnqPc7Y`LeGY*_6R>9r>B%)!qs$$NIg2J_gxOBeZerF`rl+gn7F)=qw&_aL(8<|` zXu7_G|C=4hPXH=2k(gGbJd4UK-AL+81-ciRp9t)Wzv^Qu{Ri>SbP<#B6mmb;9TqD0 zaDuTj`GI$tSp$o!!K(CF&@7oh{dFbz#9ey{cw1v7HNI+UopQ3HGG&uKKE8|31Fjr7 zH{Dg+hs-jNmMZz+5|EB#bcwDRxbU`HSr*@sBDeRP)a3(Vs^%ki$A0EyMT43QSJ$p8 z6kmT;12Id8mPJc)lPcSWq<5xBAU&~EQm@Vp52&`1C>#n&5TOG z%pLl&7h#Kf%UOhfBgb;;+<+vUC9~;C?LD0%CQ!69BFDkeq|0Nyz_q-r{#5BG3N`s= zNr<)aFVh{ny7+XWryw2eZgMPgm<+0x-^;yRnPmxxWQt?L$pA2|<#WcfxZ%tg03WC3 zeZG({>~T};O!;Wpyer{IE4)?3=^B!QlS8Bp2he7@7906wLc^fxT|VoUUbj?#R)>Nb z!Ew#KhuMxt`(%Hw=BAgHTUP6g;Lt4ihCM%9CmNA*C1CzC?;pEb0V_Wz3Tq)#w!(A} z=g7e}{^Ig+c?e}{a}Uie7S6QN-_pzZ9+$UXELSFr1Dh0Zf##2FW}E~ zZGL-ufj05dRnoi)p%{QX=3;8s!jaq?(rgG|2-A9x7UZ81VW$43EdJ!0XM;{}n_ulYee^ ze{(KYV1u{qi(qR+4y}hZOJ%rsJJ>GEO+9UaceoUsV2r}T(?g@is`;ATIn2B{jBXaH z%5rm<%P`lFS4`gBXf#WL=uW42rV!=!n*X`iCjZxkV86Y*3{+B-Hq7i9`Z78C~hl=B@>;A~U!2 z>c!^kX;EsmP2MS(In^q=v(sAz#g-1w^E@l9P#zPO%0SkpDJmtbQlYImI>^PN<45R< zb(lpE6|;uCB>6ZCjdVqeA&!K){R=tCoRbc7clg49`CU?#MtmI+q#z!~pBgocUKoMF zCFS(kRj~5=m<@-P|< z+m7=%8(ho}_KIg5>JMA?j`B{FzpGNe)fvf}l+bh@#F(*GL4wy9DQYIt(OWUHu!^%YoZhjw{d>nEBkXl(5c zsy&y|73w^amexb#(H%7U=)=voO)@2LGA*&d04qb5&#J6CVFQKbH~(5=p7gQy!7F_~ zy4+~3DlS^ir9nxXS!p%#*SM9UbBvZu3eX)2GXm@|!4y4y#>y8&dg(K#>&?dTX7lUo zef8icF>vkM0?OCR{bsY*?ucIx7w6)-+xPM9@Nn>S`eUd0Su{&;|J!HXcUsmrhQ!hS zX0sb?wG9-=nmr1wj_0;tlsr2@=%E~mg_c7w8!K;ahbZtg7j|2TE=Dn4SuC6asVU_~ zEYZ$2Xe%h(=W!q*XT`X&;5O`-z#hG}VqaGK8)wgw&Z-S)JW>m?lF^PpdZ4R75N+PY zzG~-{M%k;ydUe4g95acCh2GPi*dSrj<`0TGqeWKl7J!sV0Oki5{FaWZV7~7FsXH}I zXNm&TilMpI6K;R=@YZ~hARUwD-+TQl@k&`px{nxl){iUy35ZEDf9nAMR6~R)$Q=K) z+%*o|EF?6nhHSM1sIfM)KLGhTNb59CDVcni`M~QE75ezB8`4fwPkqqtG3b*5+7VI7 zwznyzyG}kPX9hZZ?NzBCQ=fBtXfd>kQ})1+~A8u zcz(}Gq#Gk%o|9~$>M_8(X*ry;FJ!Lfan)H{c9VM3A=VR&??~HNCSp039p;e)pr3wM z78Dj`g0IB~EP7Ji^(DVUfBhxd5T4*DPK0fa0hu2UjxubaJuHCD?KVwOI`5=TclD5wc6q83>Yj6 zx6`&*9yK9UuD6w3!(6c{Uo^KXLb&yzq0I9!+Qaq(OI5y0EfQ%Ui~{l9PtWixEG%xg zNk{~WAZcgO=2+dS@@n^zpKcYU%?(uKh#~D?1+zNX^OsIlb{;tKa7_oDr;rp19muc7 zuWB~Z{iV=V9RX3vNbwt}AJ*5QP4Jr`iR%q59%6JBWD!*SN?l|tI-klBNTuL$WNg(g zl0ICFE~bS0KF#o=e`4d@OPiVMtshWWCG{yK{czTY?fJeJr(op{dXqlLse`LMT|`N{ zYY7a8?x`QU#Hg8w-*1@tbKIvC;ii^=>lN~uH^~WPuQrhNB4%G|q19s&GJo%2*_FvW zr2G~Uv?~(KvS5h*1GMQuipQnFm&SEfy-*2%vo?b%d1l>pncT0jqQb%=X(r`V(+*A< z5?ClL^sxYHs?5vtnhU0o5OFS@EQBC&^D}8c%XWj(!r4=9Ad!?!jz(|b)U+W z@Wo=`4mLht$~UpM=<)dVlK7W++f-jF=Q87h4G6++FROBJe(txWskTpSOD_KY@6yDZ z`jVGtk+}*p;X@xni~u!{S`E8;zPELu@2LtO!t!$&!iGGn_}~^sZTKGLm@&o&BH4sI z3%Qirc|Z$1{U#NL4dO|RUOej21qOl$bws+L*XWXt1y!W;M7e7ryrh*7{PoSQpr3(Y z{*(zKcQs4ivEwF1Ewj~3(nF4^MU9fyF2ul3rBP}eaE*9<7q4?Y?1%7E$-Q%~aq*&2 zgG1mIe=3oNOAcb|(@z6IrGX}@?Cmq$pwkXO;oYiJaV5%d)ch_@|4_x~`iwY1Hi%IS zG8%zVN~iXU)1u-VQhKWFy;RgmmyDSVSA)?TOeaQ^+UIo7W4NU#Q%PIzLqc11_x{yT zVx1U=JOA-T5N=gmLAjVO(68Gyk5oI^EgsTgi*jJ%vj|$N=tmuyEXTj0@(B-d3p}4w z$HkxCG(BAg%ynE~L~h#m)0`~Tlh0eEmneH$X39c<@Rh>>ud*S10|MKxW0!2PY)kD= z(Jm%E&32k;z{--3I`kGU_M{T3M;!w3vS*4CDJD)>Zru9m@3LUt*;J>FOR{fVAW=5P zn_Ly(t1=>8#bIBYvhl2;gp4C}mW`zJ_XfJ`YuwB4t}kc43>x}EvU-!?e7F&L>2dqL zO?FF_X*Dm76mRb!xtKtp(m>;72$Y_a#-oX6LNJG%kBY@vOH-CT#5_rv&hoej_xj=% zl~VD{t%fe5jwIqDv#xk)(}?i883hXK3|MH4jl|o3>w+|w8dl=aY4-7Rnk^^TZ0#?7 zalg#8LmIIgYwg{!-O*&eHY>k-Y zxAx#+%(zexkfJImTLr|lko7O2Gf5BV5AK_<#`$v+Mve2E`9B~)<)P|O#_&k;=_Hhd z)~;EJ^7ZXfLgkMjaCGq(Fv!Qsdx#XF*+`ulx91}=R|G`wA~BCGtkgSRIGu(z+Eyw& z7-dARFd(jS;wqJJdA&YvX7_h5J$P`)?Iv5kx!gz$3E4CWnH2MA2~uSTBovOJSH?#n zH@+s*7a*gl%OA8ThBd3u#Mym0aOGVIPkY->m>tp3c_kn>70IXEW zD&x-l3MTjoE!YO!{HUBIwyTsCbL6pQZ(W|v^l+p{YmXGV2?dhWEP>@!5k+W{h<K7r+4z2UqrntIljdook#Jq`cJwcS9%-4o9PAZVV2S@yxTto zpSt}z6P&9H2JD(F|9kc8R^m^Chy z*(e$DxF!;WV%k?4Gzq5zl5o5Q&7E&RQkh*`RJm{fpd;RM1s7Agf+nP59t&FNrdFt% z7~p+UO*R23uQSFoOmg2riL~K}g6b8>C7GcDwum^{l*y1nWh4Z}6Am)c^s2z^SrrqU ztWj^tLpq94Me@py1EFw7tqYRCAExKo;1)7E#*|hpSrHDPAm;yKq~!`_|Hjfvkot%9 zgpl^h5){k(8HZKJZ2iGmDCyvyeGqaS!@7z*db#cK-oPNdX9@43qsiAG}6W zmx`qa8$HZLK6o$mF?I%Uj?q$QIqcRWk9r`f3GV?E8w~8jbII4-ZONwf9_;1}Hm)-| zXWH$NhrE~3_Dep-?0so_@tTJH9F6co=Rgjfh-}pBZ24E zz#70rUTZz$NIr3V+@}WmSk{R=yKd4c_`NVAqV5URYmp*3;#LRQISL-~f3HJQ zLCWqTW-5^scm@i8AyA)GLZDjomGC}ouI*M%z=u*bMIn%qAexMpH}(_&z`46&>~V|j zj8G;nS`d5hcb~W{0{AzyYsVC^yW|XlQCz5y6hNndE(zX8RYTCv>zWEivtcwHj`9lnR&ChQ!I9=+CF#nnr z35V1qaRg`|dlos?W|>yU(f>Xz^Z^A1YCfq^=90<+8JIKNhXsMM6}+wFAUPH)_mx(k z3)f$4jVpoZx>v*lbI5p~hA*%jKAm|=^#9y)po+=*qmG^h9|OHEEka&+UMYV}!yCs| zP5m?f9B8faS5iS*U+xMt&PMR(rBakz8yYSeFe&*s9x##p7iFnkNd`{E?;i|32wh;A zEMPen&=D|+=F&LEi8*lST+(7xzbZ8Isd;q?e{rz$5P6yYLQcVIHogcE00_m(oZunk zq-KmVKhd2SSNKQ?nTCs`E!MSo#}vl4;72ZkC)ToU1j?@iX`kHpfDD;|ZVCP-UJ>BJ z+nEAutM|XM&gI57ziIvNPhlIY0{fFj9+)y1o$^|o179IsebwL-s(*)xm|`ld8qDa{ zwnK{s3Ob}_ z9rc!SEQU)MWTY>Tg_U<}Rt1NU% zSs-eYETJMoi0YGeMq?+`B&V3j0J@nLR3mMWvuJxgxKOTMY>Vo%q7g?8c9? zC2#PlOlJJ+;kj6=%*P-PY4= z*TP;HJ%#(l3B%>9A${Ipd=?ZZ)F*Z}`Sz_D1G3C*KHZhYFkY9+i)eE5OKl<($M zlh<|4k=Z8En;E&?tn!yQldAS80v85fns}&{pJ`ke7=%V;rg<)>aUBz&;eM!{-y{2d zxw>P@Xdt=q_r>1PY%gK!_YUC4=K+DTa^#2XFkF!Fy5-7Gth}Nh1SV~zThJWZ^2v*N zlv5)h31(HfbUZ+45SSN1QKJtbwdH{!4M4$cvU9nbaG>B-zYvh5?uAkH<-H7sxcTaj&LNvse#^R1RovybgD2Jf5fYx37ga)a&0_V|-}-iT)-%NK z_{Yx*l5fwh#|R0x`Co2Aq`?{fwZ&)fReG?>L<7#SpWeCXY?as)h8#ypnW(Zv48}wx z4b=}UVr~LO^6!bbWIMG37q*gF%O&Z zbTjQMF-g#$R)3Hwd=jROP^y2%b)3MMW82)Pwh2)21-}k!Z;hi=XG}S6Ex8oLk{15LhI$gkdTsoQ^y!M8TAi6w_Ui^tNGJpVoSW#d!abl=y%E=?ztBbxa`T%Ls6Nc!d><+%HWPtK5>^O-2I3 ze`~mzagg$o7HjegeS25Ags7<`MAM>{LN<>w;nlAOHSjmyi%A_r+Uaq-@EQ2XirEQz zU6brwI0vioZ`hQS?=P$L{)#%yL$1R*^Y5HsWRA^%5sCfM^AGy4 zo2;`Pl>BQfD(ATVt>N0y?sV8p-L$eo3wI&ICwTLie$sm5f4x}+ZeHo%^;5hEyoycz zg#DnzZx74fADbNjy;}5afX83MLVTnWqv%mgVU-h(d|!)_=8=7RPCS;k0dmKCs0ux6tatLpKsQy6rR00b`Zf zc74*BqW{S1CckS}bq8h-1Vj%(S(;iS`#azL!xAqq%{9*pE8lt%=`|sf7V=ZxfT3?Lf$em5Z>x|>Ks_aJ1W{@{l+Cp4&JWFVi?Ys7|RvIH}BO| zyJYBOUTghT7njR);LlvWoeZ6Bl+5YSpL^DuRNb~&;sY1<~gdNEO&Qf^dSruB(ItPKB*Uo^%pDSS%oNYwf zE4P^dtk~+@*NxBQUtWrl5_)^LNvLzSMS@a<%G)bEMnf|og#;@AAS5e9vbN$K4)Zz7 zC%d>vP+EV~=<&~nzb&(22;UdmW@KZ>RFkVooe-p9I)2qv2cn>sWgY@LYt@OWqTI2& zUSmNsZ6C5gfEr}0i-+01k0fAOQIS$dmK^wAe?KhRB?ewUJ#SBwZGU_$e#t4l?2iXt z!}&0Ozn<;r`+k2`EYs7|%laOHcX!gCePDe*uYY;EzB!S^2L@h$xg<4aS$49^v5Vl5 zR8e+c3<)TOiQ^-y&Kak32b39%G=q^?nXKXEm6+y_%F(=r%gpmejJt+W02!*TWvPF^ z4z6iGyMX>dkI|2aP34|mx zWv*}vLDz%g2%(|`^jvRak7<$w3b{V!6O{=KtmGn2m)oUw51C0Z1xjQH;sBEmlN1kC zWMi*t>frXbyK1g*GJ=s*te?(~5jN(KbzQm1agViY7208qM|DIR@>k{6%XJG6Qartz zzx1BfWML@0gNA8IiTG}J&z221f3c~h6&OvF6((IOR#zT*^tSU~mh!T&vNw;n*bKJO zDI+Dz3@aeZu`h*t?2KBVrDgE!e`>9PK@lY4wMbaVFf7_a&=o^i5@i5~o1;Cj?{cNa zYQ!bCEfiAJS57HmMB3-ARe#&Noz0Nx4%J6Rxm-UIdCWG0n```48ZRP?W^GgrqAIh8 zoNYd?$G`*_vI9-gEgA&Wb=q7WT3FNvQR`jACYcuIEl0u1=tLpyv);LqQZ{cy@T5n5 z>lFP~&@Lh*eT>eFVw6RIdW6fK%{1dNSHTm4jya_`TgKoghN98Q^K7{}yXAx|VjRR| zPlOtrJDJs^qcfIT#%&bB1uqo1JaS#DC<8V&y3|XDC{S&JFRmqJDJfS`ji>e_+7HJ% ziblI9R)&8QRX7Q7L^6=*HTdM7ulW<60Hqe7CsdX--^9&@!B*vgJRPl%01-jAKOtPe z89_V|*m%TcQZnV!_-?;a+uQ(ZLEd_oKI0+)L)Pv%A_{-MrdwENc9OCER0%sX0*N^~ z4Zmb+)o85%25X>=s)r|p5oJxVyfO9QXjZW?U#tOGF(vZ%N^a$S1-JS zNQg-Anie;Z@S%+SO0J%d3L{cnkRW`p<54CiS*Py*x*8U5I+YSx{>G_`u6ZGs`kiIs zl#(=Yyk{pC@9L9pCq+x-Py0I>6fGKm{@iH+p!VOosDz;f|H>g%2tlt+2`o@ASSnmV z|JIT_aGt4MkGi`R*OKy_QE+LE>dvQ%69N?xIp`=xF|lBo5HfA9Me!ODQAep;gq|wP zvPJMY0ETlEb@9p(ofrI7Ph*$`*x{0otwaA9_7oq^X?}kqymmDi*4{0Ihsy)~job`c zr+5hbUr5^klEnze=*7<1?htMBkwMC4wa_B|0V39DQ;bnAq#FLa}wxoBm%4~XVC zkIR@^RX?Jo$5!TC?Rk_WX-=CD+L0s{74l~aNp(UEpS80M?fIL(T@^A&15>i1_c8m` zTlkB~6tp&wgbvkd{e`S2j$4>!*UrP~epLcp=;eVz4r5cP%Z0I1R-8=_b&byCrHHRn z3$p)6{FQzFmi8S|d5W!&uADDLIQyd6Kc!LL?U%i7vV)cPKkQbj6KY1>tL$fTFjkD)KA7Uq2JtO&G$P9}8# zYVLL-bAft{h#3q?Q#q;(Yv4T04U=tzS8m1?{hJ>tY20WWQtSP6OX=<TiOd4&nVUnX|~JNz>CUQhpPW(tz?>Sm0(ag<^lcJKcQ-U%W0a!ZlB z94|Jc6m<*=QoYu<{Ru5}J)xPs^=Yh~`%`lIk>=}+J%z-95vo$h4`|Qh!`T;yY80Tv z{lnQ8W)QX;RTq=rx}D3qD2x+%8D$;lEdK5P*|cnjG|&afh*9HGeQ%}S5%~4 zlY)Kd(!e}1)$vRn63H8NKpn5;t|%c7>Tqq=DqH~>Lm^=-Rc4M9qbVWkY4fG*janU$ zE3^95_)3y7T1oP6I4GjzSG*WWn!e+rHZolLLWO^r&v-ljapI zX(Cz4E2$20YC8k!pd5ESfP^YjYxhSo7*kSDxlq2kd z9E01gnM6l~h-76R6(K=%beMKLW5yZJQ3q_zVOoo)yZP(1RNTJ~z}i7iWLLNFj#JVC>f^3nMmN#7~TG}&@eRXlIh4@U6J{U zmD-`X3$Jk028UN_d^yxy&+vrgtn|iJ`JVN7W=W5W?Y3ilc3jHap!+vZ3{qM9nJ7)X zMe7JOul5t2b=>_)e9yt)djSz5ev=nOXX_33?atP_v-R$5 zJ@51Xqpi2q3(&*3wbS!&=p*i;0NAYg*d^U|ce)75m*7U#1z!=6{r=?sY!)M-+W^dy ztw84EC2HdMlt-K5ER5ZX#LjDsxZDJ z%-%a}YVPjWrATY6=AcUyD%FA*Si$;~q9m96ij{QElDcG00oqP|%;8v$P^5I=y%Wz% zx4$b6h#6df&)L9m_ET@>%noJYBx>0277T(xD?qb`?*~2+=+W#mGW%x?KwU{%em1-HySknGlRQnX-cv%?oPCt6 zz|av35qA$)&2z}jFhyfe7zDy_QQXU!q$!mY)?85t>6Q~qY_Z$P6)UFK^@1&Go~5h= z;^x&iv+2X>?4C}FByB;P_C@iYvfb1hu1Zm_pOS$VNUOE*wGIQa@Nvc~`KtHT54@5s z4bf%?wGc0${6_mrr8g3xblP*o@3}|FjZq=@lp1x*-NC{9xyb6=jMk)c%2_eUuf)I% z6DDb*wrPJo3g8trj30b%jAjvorgp7btHS2 zE7p`Lvi$8;&9vzKj%2iwdSJKaxg`UN&}B)B3ff(Ao9crdnDgckiQK0KT@M@FAmCe- ztXNLXrYzR1IKDW0_i*0&xO*yd7GAfclgBdBy>EvUHx>{bK*LzpMS{ytoyD9O#^HMh zM=Q3BnD!Y;bq-q*EKiDD>jkev&vJ@~0q*o}C@CF_PoOC@C3Dr&vNE|Ekgrw3Sct2F z|7vMh25k)X?A{4R4S?#iwvwT&HrS|%$lSt9F_9nm$PG^u9QG*ADx>x-@*3rS6q=Ig$~!E{B~#dW12uP4-0Q_#D$r=9UhD3vjh+?$I# zdb^Rcs!|8)m`=X2W!Vk^MMqMevDA>z^&h|#wN|aao1&2Hqxaf10)K{9{%n9wq{X7- zY^i?&jw8x#qN5eEomm-DG#*wiSJqh5F2UyYP(7~{8#|G{myKM za@zW`t+U$t>^4fHr6NL{`&CC2>!B-;$-n|0Y*zKPxcSNhT@<{5@ZE6?^E&Zq?>n#9 d-E;TcJ$KLD^WXCPzW@LL|No!CmOTIn1OQsSEC~Pr literal 0 HcmV?d00001 diff --git a/assets/rke2-calico/rke2-calico-v3.1908.tgz b/assets/rke2-calico/rke2-calico-v3.1908.tgz new file mode 100755 index 0000000000000000000000000000000000000000..910f20fd70e26c26e2fe12dbb2d93c2f3d1429ee GIT binary patch literal 4725 zcmV-*5{m5~iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKBfZ{xPsaKFC(6$hRHX6B-jmu$TT`oYblZE!n@k>qWk`)NQ+ z$2M;$QYEP*ZYKZz0T;=VEH7D_PVZx)Xe^TF@NhXRmyy@l47Bs#}4B6TV4DO?{)io{a$~+`%SmE*FWfe1KpP;qd8?t6ZuW|*=^N3 z_cuv|bD@c*f~!FbAR?MDF%2W4HN%jK4krn!ltefHO{XYHAX1b>3)vzm{S~F6f)C)P z-y&(c_}mM7{|tLUzZIj3Bu%x=KIKXi#uVro!j(k_IXajK3CDINwoIb~D6P%bO$BrJ zyVhSlaQ`K#%>OrpWvE_W0Bqp@-eGTv{|~x{JN|!-L=!T_QO4LMMiR9e!2Lt3MIE17 zxnRYD;93ecVua(BV1{9Hi4njx&Ii!uBE~=phT(NKM#)j5GV;TN2C0ER@bWii+snvR5E$`uE|i9XNtR8T%0zzJW}GwntsRhb`K z`1OB&8J_u~h{kdNy>7VQ54&Nv(>wG9V6pugV&aFa&#YyfRZcr-)VF0v&~ z=-mL?36)Yvj6HV;?N+N5q12X0GnkH8Gr0DLDf7QXk_digWN-^W&(j&%vaT7eA2J>@ z9JE?*;8^epon~&eSov<`zOKssmis=>Cok{F0DRXv^_~=v01LIy3wuYQ861gIs}lBpj0I*nmKYXK1xK#`(Rp}i-QNcgL{t@fD9d0*mYM3C z>V5$&X>yrOCiD*49ozZNQll%dxSxms^WPz;U@d9 zyT4!K|D(O5?vDRoBU%2Z6CivJV!;}A>O(X2AY?7q8U#QUaG`-y23{^0G`CdGM5f_= zBzQzLymvlD1KtlS$}IK|A1vaBhpLa+Yh606`re} zr#OJ~l>DAyD@S4A!bs`?+~0%5-!m#PhIW!EZH3Z;c1vozp;PuJe1Y-dKJo~x9J$7M zXf4={Sgi1ZrgHJr}s3S6f*Q(M?*%`_Lql~(TWt*Ci1NwZ5|W7;hLEkiy_0c?{0 zdxv%Z|LEYTzmxy3k-m2M?*zVct3Hvmt`C+~fQ1htvR(lcGCy}$;Y(|s9Cb{P*RG4v zYAJjH%46gj_8%TvK@hYasl|L3{!}&QNp8?%i;|}(G6&tD$%=xfsxnX4N?lej-zl?g z(hB)6RVT`n7D*sciA+Y%i3@L%{|84k`@i4a>+j;fuacbD&N-h5jurf>} z2tyU&b`g!GR@e7p(R{7pY9D;`I`2Z`YN&+4q3uE1@C7DR7L%G|JU;z+QH)5fm3Bm9 zSsjqP`l`W*Sf(^eTdmT>QumwNDz)AhG+5%1 zFQCQ0Nx~N9K;Jh0b*Z9e`A<`lMAqhdiQT|W@!!3@y8VB+*E`zD|JO)mR)}OArc(R| zBkfj1DCD%n4Wr>FXNWiOg5OOE+^X>`vAhd%f4`6}#db+pt>x^(rj3$j=;fMU3v>Mq zQZxV89F0!58x(FxP>=d=ln|Tv|DbnNv;X!FcJbfWNsXTASw7cI&S}jD1*jY$@>?wU zd$Sd>yvq)4ks?p6YVij4HGF6 z*B>DPnX;L;)OAW?;AS9R(1Ld)Nf`z%P!n($9}1MW5C-tYRs$%nlcv$})!h2|$zt=t zrc2bmu)LVwz{27q);kF%LI!$fj742kSeS?I8$b$%1He0tk`opfd}E@}*T@}Lj~;ai zHh|tgzY7m~VXxZ_yPf`brILPkFYJcB-kvGg&-KOEuPwHg|EY)-Mwz5~o(e{z`SyO` z2KnFb_3H8e!~Oo=PX50}a`AtTPZj@07E+Z95-zk86h>%b><$oeI8TvZ8W8Z|460( z^s*OY|Lxp4{}GE@eoJIL9G$+i!fmKjmUxAdnxR)lOaAKGw-NU&h4I{}P#2^J5+{^9 z)k`L5v`?lm^sU!$95X@_)0F8%e#SmOD{VU_{E77d63PeAwG)((y8#>?9PAzVYNw;) z#SmJ!(~qSw&G=CLe}&Rbugr`Fc=st&`off)34S4j9Rr2GP@dgY>e)I&KDXsrnlem~ zYr=k#B1=^>%6Bf;cu2m68O6ay@7J}Tu}hCjTkC&gHa$M{YtwrD-|Ox7yEXm4w>$s!N~x?;<(Nbv z$@EM}`iD0FzEhPQ(PJm$F9h2rHf#ix7v3bLWqE0`+U|N*;Rh{B3V%=)S;qVD$yky3#6G5#UOZzR zFZIb;%|-dLX}+oZ9ec2Y{(-WwhXt*TtAk>RL67M0Sub==bK0lV1kU^ zMdj<4OXIVk<9SWdG!=p=|7Cn6f902mCWqJ4C5@GK2t_K zODa%*PHh{xPf}XZ^fh`bMCHvob?D;}#d{M>MAxfmiiD6c<=YU%ki5e3dVx*sH}IR$ z{4(R*=zUs>%X|yBSj3Zalfil8rm8;*wtBE^ae0e;rM=>is*cf3*~S&#JWMY|M3F)H zL=vTC7U@hj&*hfNak1jgR}F6>Vmg__(v! zCT`72F%~~i1%k7AmD?henoels&IqTOOoeiGr^8WHV$%@8~MKZ{$uL1~ax$vTJb8nrgvz;|!dBE;A`DwFilj4ffihXUyaoNc% z+e0O3vxK*faTT8~59TAslBOiFFNmyDm^Mxb!{088HRU3NpisLwVdJEZ3+dO;@PEX( zV+wP{HjLdaE=f}eN=3Zri!+AG3;D@rQ)L${pU_7* zG>z=`f~0J#xT?Ns^As#bwk!gy60;_%Epn<<85!$>4yAHP2q#k; zNjEaoUl~~~JW7~11qN0Uv2ywUoe%ImGd(K)>%%9H4FhjH|JOgL#eWZad%N?0uacI+ zx<9x%ZfzYH-W+1O|*HE0EpANjK$+|Y$p*KEzMIT>UYu3xhaV$qY+W= zJW6r%#{wtDY5ApuZ8bspYW9GoE&x<1T8G7@l{7=?$f!jlV!W(SY{4rB$AlUHqddFw z<+}QyYVMij&z2UimKJ5@mrmV7r;T9wBdVL>R7KvOtr?1@V_E<%hDR0HCp*Sy4~AKf zuT$KPV*Hu-j7r&{TtP@pB;W*u?Rv{26Fw> z7Vm-H-xo_}<;#X)ejTg?Im#Hz$vd5#2|bdikn2*tNF)j2@t~9irTxcJwu=#dvWE@o z)m=YshzuAV=kH=eCFLizDsz*k#9(!=#&&Lq>@Yg+EMY-@)7i+;Kc5Xhom`HF z$0s%1_KwXUKd4ZL9i4x)kWD~8N|6j|1ppI@EcVuYW0~tm&efr5r?Kht(aFW|>ilA5 z`-7#)Ztla?=}#vY!_Ni2)3ej7&!?Y;Kb?I3_2lC6^!%(D`~Cg;cO5GW3i-|Qc;tH< zpGev`B96X=jLA)P739ImB@kh^{Rpe9lhUcuYS&jTxjeL8r73M(VlQ$FvrJXPJ(4^X z<5eZhzt`|d#5jQNez)6N9>$ee^JYEOiyDD@-~O@99~~VvG`|5m5_D;1Tgc=AW+vd4X~;tt7S>5=k=mVEu*t$v27OFYk;99mzS#k*%wKg?f)CXXzW&! zTaS^9|Frj?_WB3)`~Thk?*8xVq&HqJPc^(}$l*N`;yO#Ay)Ne0hIT2~)`qtE@52Y^ z+WWC@?8C`#CnDo<@mABKz&_LC3frq*9O?Y<)2Q-zeA^v1e*&5jqI@be6VY}4D#;UZ z_;EVr6Cso5bmd26^zJ3bq;j{;8LlsZ=@Ru5(HI;4#9Jy)L~%MAezLRm40t!T&p_}q zac@ID5y40Z_C(-+Wn(;EY;(WFDtU?ZvF*xee1fZUYOIl`!j??Sr@*^^n&{GQY%asQ zhY!N??W}M(I`wfBRjNrRFeB<;IM3UAuf?U7lusf2;OqUr8cCHZ)?r@Y%by@<`tr{) zeEt^RI(x^+UXQav(R=*8sA9WTp=9y?=0*PN_~N6xN^N(5`80%)J@l4atNsGDl&Df+ zcaIDRL^C3FemC1!bytw6a)qH)9UHq>`uMBW]:port` + or `:` for IPv4. If optional port number is not set, + and this peer IP and ASNumber belongs to a calico/node with ListenPort + set in BGPConfiguration, then we use that port to peer. + type: string + peerSelector: + description: Selector for the remote nodes to peer with. When this + is set, the PeerIP and ASNumber fields must be empty. For each + peering between the local node and selected remote nodes, we configure + an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, + and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The + remote AS number comes from the remote node's NodeBGPSpec.ASNumber, + or the global default if that is not set. + type: string + sourceAddress: + description: Specifies whether and how to configure a source address + for the peerings generated by this BGPPeer resource. Default value + "UseNodeIP" means to configure the node IP as the source address. "None" + means not to configure a source address. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml new file mode 100755 index 0000000..4f03208 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml @@ -0,0 +1,59 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BlockAffinity + listKind: BlockAffinityList + plural: blockaffinities + singular: blockaffinity + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BlockAffinitySpec contains the specification for a BlockAffinity + resource. + properties: + cidr: + type: string + deleted: + description: Deleted indicates that this block affinity is being deleted. + This field is a string for compatibility with older releases that + mistakenly treat this field as a string. + type: string + node: + type: string + state: + type: string + required: + - cidr + - deleted + - node + - state + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml new file mode 100755 index 0000000..c0c4149 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml @@ -0,0 +1,62 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: ClusterInformation + listKind: ClusterInformationList + plural: clusterinformations + singular: clusterinformation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ClusterInformation contains the cluster specific information. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterInformationSpec contains the values of describing + the cluster. + properties: + calicoVersion: + description: CalicoVersion is the version of Calico that the cluster + is running + type: string + clusterGUID: + description: ClusterGUID is the GUID of the cluster + type: string + clusterType: + description: ClusterType describes the type of the cluster + type: string + datastoreReady: + description: DatastoreReady is used during significant datastore migrations + to signal to components such as Felix that it should wait before + accessing the datastore. + type: boolean + variant: + description: Variant declares which variant of Calico should be active. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml new file mode 100755 index 0000000..1756e24 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml @@ -0,0 +1,561 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: FelixConfiguration + listKind: FelixConfigurationList + plural: felixconfigurations + singular: felixconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Felix Configuration contains the configuration for Felix. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FelixConfigurationSpec contains the values of the Felix configuration. + properties: + allowIPIPPacketsFromWorkloads: + description: 'AllowIPIPPacketsFromWorkloads controls whether Felix + will add a rule to drop IPIP encapsulated traffic from workloads + [Default: false]' + type: boolean + allowVXLANPacketsFromWorkloads: + description: 'AllowVXLANPacketsFromWorkloads controls whether Felix + will add a rule to drop VXLAN encapsulated traffic from workloads + [Default: false]' + type: boolean + awsSrcDstCheck: + description: 'Set source-destination-check on AWS EC2 instances. Accepted + value must be one of "DoNothing", "Enabled" or "Disabled". [Default: + DoNothing]' + enum: + - DoNothing + - Enable + - Disable + type: string + bpfConnectTimeLoadBalancingEnabled: + description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, + controls whether Felix installs the connection-time load balancer. The + connect-time load balancer is required for the host to be able to + reach Kubernetes services and it improves the performance of pod-to-service + connections. The only reason to disable it is for debugging purposes. [Default: + true]' + type: boolean + bpfDataIfacePattern: + description: BPFDataIfacePattern is a regular expression that controls + which interfaces Felix should attach BPF programs to in order to + catch traffic to/from the network. This needs to match the interfaces + that Calico workload traffic flows over as well as any interfaces + that handle incoming traffic to nodeports and services from outside + the cluster. It should not match the workload interfaces (usually + named cali...). + type: string + bpfDisableUnprivileged: + description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled + sysctl to disable unprivileged use of BPF. This ensures that unprivileged + users cannot access Calico''s BPF maps and cannot insert their own + BPF programs to interfere with Calico''s. [Default: true]' + type: boolean + bpfEnabled: + description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. + [Default: false]' + type: boolean + bpfExtToServiceConnmark: + description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit + mark that is set on connections from an external client to a local + service. This mark allows us to control how packets of that connection + are routed within the host and how is routing intepreted by RPF + check. [Default: 0]' + type: integer + bpfExternalServiceMode: + description: 'BPFExternalServiceMode in BPF mode, controls how connections + from outside the cluster to services (node ports and cluster IPs) + are forwarded to remote workloads. If set to "Tunnel" then both + request and response traffic is tunneled to the remote node. If + set to "DSR", the request traffic is tunneled but the response traffic + is sent directly from the remote node. In "DSR" mode, the remote + node appears to use the IP of the ingress node; this requires a + permissive L2 network. [Default: Tunnel]' + type: string + bpfKubeProxyEndpointSlicesEnabled: + description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls + whether Felix's embedded kube-proxy accepts EndpointSlices or not. + type: boolean + bpfKubeProxyIptablesCleanupEnabled: + description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF + mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s + iptables chains. Should only be enabled if kube-proxy is not running. [Default: + true]' + type: boolean + bpfKubeProxyMinSyncPeriod: + description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the + minimum time between updates to the dataplane for Felix''s embedded + kube-proxy. Lower values give reduced set-up latency. Higher values + reduce Felix CPU usage by batching up more work. [Default: 1s]' + type: string + bpfLogLevel: + description: 'BPFLogLevel controls the log level of the BPF programs + when in BPF dataplane mode. One of "Off", "Info", or "Debug". The + logs are emitted to the BPF trace pipe, accessible with the command + `tc exec bpf debug`. [Default: Off].' + type: string + chainInsertMode: + description: 'ChainInsertMode controls whether Felix hooks the kernel''s + top-level iptables chains by inserting a rule at the top of the + chain or by appending a rule at the bottom. insert is the safe default + since it prevents Calico''s rules from being bypassed. If you switch + to append mode, be sure that the other rules in the chains signal + acceptance by falling through to the Calico rules, otherwise the + Calico policy will be bypassed. [Default: insert]' + type: string + dataplaneDriver: + type: string + debugDisableLogDropping: + type: boolean + debugMemoryProfilePath: + type: string + debugSimulateCalcGraphHangAfter: + type: string + debugSimulateDataplaneHangAfter: + type: string + defaultEndpointToHostAction: + description: 'DefaultEndpointToHostAction controls what happens to + traffic that goes from a workload endpoint to the host itself (after + the traffic hits the endpoint egress policy). By default Calico + blocks traffic from workload endpoints to the host itself with an + iptables "DROP" action. If you want to allow some or all traffic + from endpoint to host, set this parameter to RETURN or ACCEPT. Use + RETURN if you have your own rules in the iptables "INPUT" chain; + Calico will insert its rules at the top of that chain, then "RETURN" + packets to the "INPUT" chain once it has completed processing workload + endpoint egress policy. Use ACCEPT to unconditionally accept packets + from workloads after processing workload endpoint egress policy. + [Default: Drop]' + type: string + deviceRouteProtocol: + description: This defines the route protocol added to programmed device + routes, by default this will be RTPROT_BOOT when left blank. + type: integer + deviceRouteSourceAddress: + description: This is the source address to use on programmed device + routes. By default the source address is left blank, leaving the + kernel to choose the source address used. + type: string + disableConntrackInvalidCheck: + type: boolean + endpointReportingDelay: + type: string + endpointReportingEnabled: + type: boolean + externalNodesList: + description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes + which may source tunnel traffic and have the tunneled traffic be + accepted at calico nodes. + items: + type: string + type: array + failsafeInboundHostPorts: + description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow incoming traffic to host endpoints + on irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all inbound host ports, use the value + none. The default value allows ssh access and DHCP. [Default: tcp:22, + udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + failsafeOutboundHostPorts: + description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow outgoing traffic from host endpoints + to irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all outbound host ports, use the value + none. The default value opens etcd''s standard ports to ensure that + Felix does not get cut off from etcd as well as allowing DHCP and + DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, + tcp:6667, udp:53, udp:67]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + featureDetectOverride: + description: FeatureDetectOverride is used to override the feature + detection. Values are specified in a comma separated list with no + spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". + "true" or "false" will force the feature, empty or omitted values + are auto-detected. + type: string + genericXDPEnabled: + description: 'GenericXDPEnabled enables Generic XDP so network cards + that don''t support XDP offload or driver modes can use XDP. This + is not recommended since it doesn''t provide better performance + than iptables. [Default: false]' + type: boolean + healthEnabled: + type: boolean + healthHost: + type: string + healthPort: + type: integer + interfaceExclude: + description: 'InterfaceExclude is a comma-separated list of interfaces + that Felix should exclude when monitoring for host endpoints. The + default value ensures that Felix ignores Kubernetes'' IPVS dummy + interface, which is used internally by kube-proxy. If you want to + exclude multiple interface names using a single value, the list + supports regular expressions. For regular expressions you must wrap + the value with ''/''. For example having values ''/^kube/,veth1'' + will exclude all interfaces that begin with ''kube'' and also the + interface ''veth1''. [Default: kube-ipvs0]' + type: string + interfacePrefix: + description: 'InterfacePrefix is the interface name prefix that identifies + workload endpoints and so distinguishes them from host endpoint + interfaces. Note: in environments other than bare metal, the orchestrators + configure this appropriately. For example our Kubernetes and Docker + integrations set the ''cali'' value, and our OpenStack integration + sets the ''tap'' value. [Default: cali]' + type: string + interfaceRefreshInterval: + description: InterfaceRefreshInterval is the period at which Felix + rescans local interfaces to verify their state. The rescan can be + disabled by setting the interval to 0. + type: string + ipipEnabled: + type: boolean + ipipMTU: + description: 'IPIPMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + ipsetsRefreshInterval: + description: 'IpsetsRefreshInterval is the period at which Felix re-checks + all iptables state to ensure that no other process has accidentally + broken Calico''s rules. Set to 0 to disable iptables refresh. [Default: + 90s]' + type: string + iptablesBackend: + description: IptablesBackend specifies which backend of iptables will + be used. The default is legacy. + type: string + iptablesFilterAllowAction: + type: string + iptablesLockFilePath: + description: 'IptablesLockFilePath is the location of the iptables + lock file. You may need to change this if the lock file is not in + its standard location (for example if you have mapped it into Felix''s + container at a different path). [Default: /run/xtables.lock]' + type: string + iptablesLockProbeInterval: + description: 'IptablesLockProbeInterval is the time that Felix will + wait between attempts to acquire the iptables lock if it is not + available. Lower values make Felix more responsive when the lock + is contended, but use more CPU. [Default: 50ms]' + type: string + iptablesLockTimeout: + description: 'IptablesLockTimeout is the time that Felix will wait + for the iptables lock, or 0, to disable. To use this feature, Felix + must share the iptables lock file with all other processes that + also take the lock. When running Felix inside a container, this + requires the /run directory of the host to be mounted into the calico/node + or calico/felix container. [Default: 0s disabled]' + type: string + iptablesMangleAllowAction: + type: string + iptablesMarkMask: + description: 'IptablesMarkMask is the mask that Felix selects its + IPTables Mark bits from. Should be a 32 bit hexadecimal number with + at least 8 bits set, none of which clash with any other mark bits + in use on the system. [Default: 0xff000000]' + format: int32 + type: integer + iptablesNATOutgoingInterfaceFilter: + type: string + iptablesPostWriteCheckInterval: + description: 'IptablesPostWriteCheckInterval is the period after Felix + has done a write to the dataplane that it schedules an extra read + back in order to check the write was not clobbered by another process. + This should only occur if another application on the system doesn''t + respect the iptables lock. [Default: 1s]' + type: string + iptablesRefreshInterval: + description: 'IptablesRefreshInterval is the period at which Felix + re-checks the IP sets in the dataplane to ensure that no other process + has accidentally broken Calico''s rules. Set to 0 to disable IP + sets refresh. Note: the default for this value is lower than the + other refresh intervals as a workaround for a Linux kernel bug that + was fixed in kernel version 4.11. If you are using v4.11 or greater + you may want to set this to, a higher value to reduce Felix CPU + usage. [Default: 10s]' + type: string + ipv6Support: + type: boolean + kubeNodePortRanges: + description: 'KubeNodePortRanges holds list of port ranges used for + service node ports. Only used if felix detects kube-proxy running + in ipvs mode. Felix uses these ranges to separate host and workload + traffic. [Default: 30000:32767].' + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + logFilePath: + description: 'LogFilePath is the full path to the Felix log. Set to + none to disable file logging. [Default: /var/log/calico/felix.log]' + type: string + logPrefix: + description: 'LogPrefix is the log prefix that Felix uses when rendering + LOG rules. [Default: calico-packet]' + type: string + logSeverityFile: + description: 'LogSeverityFile is the log severity above which logs + are sent to the log file. [Default: Info]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + logSeveritySys: + description: 'LogSeveritySys is the log severity above which logs + are sent to the syslog. Set to None for no logging to syslog. [Default: + Info]' + type: string + maxIpsetSize: + type: integer + metadataAddr: + description: 'MetadataAddr is the IP address or domain name of the + server that can answer VM queries for cloud-init metadata. In OpenStack, + this corresponds to the machine running nova-api (or in Ubuntu, + nova-api-metadata). A value of none (case insensitive) means that + Felix should not set up any NAT rule for the metadata path. [Default: + 127.0.0.1]' + type: string + metadataPort: + description: 'MetadataPort is the port of the metadata server. This, + combined with global.MetadataAddr (if not ''None''), is used to + set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. + In most cases this should not need to be changed [Default: 8775].' + type: integer + mtuIfacePattern: + description: MTUIfacePattern is a regular expression that controls + which interfaces Felix should scan in order to calculate the host's + MTU. This should not match workload interfaces (usually named cali...). + type: string + natOutgoingAddress: + description: NATOutgoingAddress specifies an address to use when performing + source NAT for traffic in a natOutgoing pool that is leaving the + network. By default the address used is an address on the interface + the traffic is leaving on (ie it uses the iptables MASQUERADE target) + type: string + natPortRange: + anyOf: + - type: integer + - type: string + description: NATPortRange specifies the range of ports that is used + for port mapping when doing outgoing NAT. When unset the default + behavior of the network stack is used. + pattern: ^.* + x-kubernetes-int-or-string: true + netlinkTimeout: + type: string + openstackRegion: + description: 'OpenstackRegion is the name of the region that a particular + Felix belongs to. In a multi-region Calico/OpenStack deployment, + this must be configured somehow for each Felix (here in the datamodel, + or in felix.cfg or the environment on each compute node), and must + match the [calico] openstack_region value configured in neutron.conf + on each node. [Default: Empty]' + type: string + policySyncPathPrefix: + description: 'PolicySyncPathPrefix is used to by Felix to communicate + policy changes to external services, like Application layer policy. + [Default: Empty]' + type: string + prometheusGoMetricsEnabled: + description: 'PrometheusGoMetricsEnabled disables Go runtime metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + prometheusMetricsEnabled: + description: 'PrometheusMetricsEnabled enables the Prometheus metrics + server in Felix if set to true. [Default: false]' + type: boolean + prometheusMetricsHost: + description: 'PrometheusMetricsHost is the host that the Prometheus + metrics server should bind to. [Default: empty]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. [Default: 9091]' + type: integer + prometheusProcessMetricsEnabled: + description: 'PrometheusProcessMetricsEnabled disables process metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + removeExternalRoutes: + description: Whether or not to remove device routes that have not + been programmed by Felix. Disabling this will allow external applications + to also add device routes. This is enabled by default which means + we will remove externally added routes. + type: boolean + reportingInterval: + description: 'ReportingInterval is the interval at which Felix reports + its status into the datastore or 0 to disable. Must be non-zero + in OpenStack deployments. [Default: 30s]' + type: string + reportingTTL: + description: 'ReportingTTL is the time-to-live setting for process-wide + status reports. [Default: 90s]' + type: string + routeRefreshInterval: + description: 'RouteRefreshInterval is the period at which Felix re-checks + the routes in the dataplane to ensure that no other process has + accidentally broken Calico''s rules. Set to 0 to disable route refresh. + [Default: 90s]' + type: string + routeSource: + description: 'RouteSource configures where Felix gets its routing + information. - WorkloadIPs: use workload endpoints to construct + routes. - CalicoIPAM: the default - use IPAM data to construct routes.' + type: string + routeTableRange: + description: Calico programs additional Linux route tables for various + purposes. RouteTableRange specifies the indices of the route tables + that Calico should use. + properties: + max: + type: integer + min: + type: integer + required: + - max + - min + type: object + serviceLoopPrevention: + description: 'When service IP advertisement is enabled, prevent routing + loops to service IPs that are not in use, by dropping or rejecting + packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled", + in which case such routing loops continue to be allowed. [Default: + Drop]' + type: string + sidecarAccelerationEnabled: + description: 'SidecarAccelerationEnabled enables experimental sidecar + acceleration [Default: false]' + type: boolean + usageReportingEnabled: + description: 'UsageReportingEnabled reports anonymous Calico version + number and cluster size to projectcalico.org. Logs warnings returned + by the usage server. For example, if a significant security vulnerability + has been discovered in the version of Calico being used. [Default: + true]' + type: boolean + usageReportingInitialDelay: + description: 'UsageReportingInitialDelay controls the minimum delay + before Felix makes a report. [Default: 300s]' + type: string + usageReportingInterval: + description: 'UsageReportingInterval controls the interval at which + Felix makes reports. [Default: 86400s]' + type: string + useInternalDataplaneDriver: + type: boolean + vxlanEnabled: + type: boolean + vxlanMTU: + description: 'VXLANMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + vxlanPort: + type: integer + vxlanVNI: + type: integer + wireguardEnabled: + description: 'WireguardEnabled controls whether Wireguard is enabled. + [Default: false]' + type: boolean + wireguardInterfaceName: + description: 'WireguardInterfaceName specifies the name to use for + the Wireguard interface. [Default: wg.calico]' + type: string + wireguardListeningPort: + description: 'WireguardListeningPort controls the listening port used + by Wireguard. [Default: 51820]' + type: integer + wireguardMTU: + description: 'WireguardMTU controls the MTU on the Wireguard interface. + See Configuring MTU [Default: 1420]' + type: integer + wireguardRoutingRulePriority: + description: 'WireguardRoutingRulePriority controls the priority value + to use for the Wireguard routing rule. [Default: 99]' + type: integer + xdpEnabled: + description: 'XDPEnabled enables XDP acceleration for suitable untracked + incoming deny rules. [Default: true]' + type: boolean + xdpRefreshInterval: + description: 'XDPRefreshInterval is the period at which Felix re-checks + all XDP state to ensure that no other process has accidentally broken + Calico''s BPF maps or attached programs. Set to 0 to disable XDP + refresh. [Default: 90s]' + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml new file mode 100755 index 0000000..4360dda --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml @@ -0,0 +1,769 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkPolicy + listKind: GlobalNetworkPolicyList + plural: globalnetworkpolicies + singular: globalnetworkpolicy + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + applyOnForward: + description: ApplyOnForward indicates to apply the rules in this policy + on forward traffic. + type: boolean + doNotTrack: + description: DoNotTrack indicates whether packets matched by the rules + in this policy should go through the data plane's connection tracking, + such as Linux conntrack. If True, the rules in this policy are + applied before any data plane connection tracking, and packets allowed + by this policy are marked as not to be tracked. + type: boolean + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + namespaceSelector: + description: NamespaceSelector is an optional field for an expression + used to select a pod based on namespaces. + type: string + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + preDNAT: + description: PreDNAT indicates to apply the rules in this policy before + any DNAT. + type: boolean + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress rules are present in the policy. The + default is: \n - [ PolicyTypeIngress ], if there are no Egress rules + (including the case where there are also no Ingress rules) \n + - [ PolicyTypeEgress ], if there are Egress rules but no Ingress + rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are + both Ingress and Egress rules. \n When the policy is read back again, + Types will always be one of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml new file mode 100755 index 0000000..00a2980 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml @@ -0,0 +1,51 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkSet + listKind: GlobalNetworkSetList + plural: globalnetworksets + singular: globalnetworkset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs + that share labels to allow rules to refer to them via selectors. The labels + of GlobalNetworkSet are not namespaced. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GlobalNetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml new file mode 100755 index 0000000..4824531 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml @@ -0,0 +1,106 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: HostEndpoint + listKind: HostEndpointList + plural: hostendpoints + singular: hostendpoint + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HostEndpointSpec contains the specification for a HostEndpoint + resource. + properties: + expectedIPs: + description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. + If \"InterfaceName\" is not present, Calico will look for an interface + matching any of the IPs in the list and apply policy to that. Note: + \tWhen using the selector match criteria in an ingress or egress + security Policy \tor Profile, Calico converts the selector into + a set of IP addresses. For host \tendpoints, the ExpectedIPs field + is used for that purpose. (If only the interface \tname is specified, + Calico does not learn the IPs of the interface for use in match + \tcriteria.)" + items: + type: string + type: array + interfaceName: + description: "Either \"*\", or the name of a specific Linux interface + to apply policy to; or empty. \"*\" indicates that this HostEndpoint + governs all traffic to, from or through the default network namespace + of the host named by the \"Node\" field; entering and leaving that + namespace via any interface, including those from/to non-host-networked + local workloads. \n If InterfaceName is not \"*\", this HostEndpoint + only governs traffic that enters or leaves the host through the + specific interface named by InterfaceName, or - when InterfaceName + is empty - through the specific interface that has one of the IPs + in ExpectedIPs. Therefore, when InterfaceName is empty, at least + one expected IP must be specified. Only external interfaces (such + as \"eth0\") are supported here; it isn't possible for a HostEndpoint + to protect traffic through a specific local workload interface. + \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; + initially just pre-DNAT policy. Please check Calico documentation + for the latest position." + type: string + node: + description: The node name identifying the Calico node instance. + type: string + ports: + description: Ports contains the endpoint's named ports, which may + be referenced in security policy rules. + items: + properties: + name: + type: string + port: + type: integer + protocol: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + required: + - name + - port + - protocol + type: object + type: array + profiles: + description: A list of identifiers of security Profile objects that + apply to this endpoint. Each profile is applied in the order that + they appear in this list. Profile rules are applied after the selector-based + security policy. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml new file mode 100755 index 0000000..6c333a0 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml @@ -0,0 +1,79 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMBlock + listKind: IPAMBlockList + plural: ipamblocks + singular: ipamblock + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMBlockSpec contains the specification for an IPAMBlock + resource. + properties: + affinity: + type: string + allocations: + items: + type: integer + # TODO: This nullable is manually added in. We should update controller-gen + # to handle []*int properly itself. + nullable: true + type: array + attributes: + items: + properties: + handle_id: + type: string + secondary: + additionalProperties: + type: string + type: object + type: object + type: array + cidr: + type: string + deleted: + type: boolean + strictAffinity: + type: boolean + unallocated: + items: + type: integer + type: array + required: + - allocations + - attributes + - cidr + - strictAffinity + - unallocated + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml new file mode 100755 index 0000000..3d85b16 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMConfig + listKind: IPAMConfigList + plural: ipamconfigs + singular: ipamconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMConfigSpec contains the specification for an IPAMConfig + resource. + properties: + autoAllocateBlocks: + type: boolean + maxBlocksPerHost: + description: MaxBlocksPerHost, if non-zero, is the max number of blocks + that can be affine to each host. + type: integer + strictAffinity: + type: boolean + required: + - autoAllocateBlocks + - strictAffinity + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml new file mode 100755 index 0000000..5c875cc --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMHandle + listKind: IPAMHandleList + plural: ipamhandles + singular: ipamhandle + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMHandleSpec contains the specification for an IPAMHandle + resource. + properties: + block: + additionalProperties: + type: integer + type: object + deleted: + type: boolean + handleID: + type: string + required: + - block + - handleID + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ippools.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ippools.yaml new file mode 100755 index 0000000..7e41753 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_ippools.yaml @@ -0,0 +1,97 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPPool + listKind: IPPoolList + plural: ippools + singular: ippool + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec contains the specification for an IPPool resource. + properties: + blockSize: + description: The block size to use for IP address assignments from + this pool. Defaults to 26 for IPv4 and 112 for IPv6. + type: integer + cidr: + description: The pool CIDR. + type: string + disabled: + description: When disabled is true, Calico IPAM will not assign addresses + from this pool. + type: boolean + ipip: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + properties: + enabled: + description: When enabled is true, ipip tunneling will be used + to deliver packets to destinations within this pool. + type: boolean + mode: + description: The IPIP mode. This can be one of "always" or "cross-subnet". A + mode of "always" will also use IPIP tunneling for routing to + destination IP addresses within this pool. A mode of "cross-subnet" + will only use IPIP tunneling when the destination node is on + a different subnet to the originating node. The default value + (if not specified) is "always". + type: string + type: object + ipipMode: + description: Contains configuration for IPIP tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling + is disabled). + type: string + nat-outgoing: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + type: boolean + natOutgoing: + description: When nat-outgoing is true, packets sent from Calico networked + containers in this pool to destinations outside of this pool will + be masqueraded. + type: boolean + nodeSelector: + description: Allows IPPool to allocate for a specific node by label + selector. + type: string + vxlanMode: + description: Contains configuration for VXLAN tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. VXLAN + tunneling is disabled). + type: string + required: + - cidr + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml new file mode 100755 index 0000000..aa23fd9 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml @@ -0,0 +1,230 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: kubecontrollersconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: KubeControllersConfiguration + listKind: KubeControllersConfigurationList + plural: kubecontrollersconfigurations + singular: kubecontrollersconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: KubeControllersConfigurationSpec contains the values of the + Kubernetes controllers configuration. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host endpoints. + Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation of + host endpoints for every node. [Default: Disabled]' + type: string + type: object + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: 9094]' + type: integer + required: + - controllers + type: object + status: + description: KubeControllersConfigurationStatus represents the status + of the configuration. It's useful for admins to be able to see the actual + config that was applied, which can be modified by environment variables + on the kube-controllers process. + properties: + environmentVars: + additionalProperties: + type: string + description: EnvironmentVars contains the environment variables on + the kube-controllers that influenced the RunningConfig. + type: object + runningConfig: + description: RunningConfig contains the effective config that is running + in the kube-controllers pod, after merging the API resource with + any environment variables. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace + controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host + endpoints. Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation + of host endpoints for every node. [Default: Disabled]' + type: string + type: object + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which + logs are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: + 9094]' + type: integer + required: + - controllers + type: object + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml new file mode 100755 index 0000000..8e4bd8b --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml @@ -0,0 +1,750 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkPolicy + listKind: NetworkPolicyList + plural: networkpolicies + singular: networkpolicy + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress are present in the policy. The default + is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including + the case where there are also no Ingress rules) \n - [ PolicyTypeEgress + ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, + PolicyTypeEgress ], if there are both Ingress and Egress rules. + \n When the policy is read back again, Types will always be one + of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_networksets.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_networksets.yaml new file mode 100755 index 0000000..4bb0e21 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/calico/kdd/crd.projectcalico.org_networksets.yaml @@ -0,0 +1,49 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkSet + listKind: NetworkSetList + plural: networksets + singular: networkset + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: NetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_imagesets_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_imagesets_crd.yaml new file mode 100755 index 0000000..d09ae1c --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_imagesets_crd.yaml @@ -0,0 +1,75 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: imagesets.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: ImageSet + listKind: ImageSetList + plural: imagesets + singular: imageset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ImageSet is used to specify image digests for the images that + the operator deploys. The name of the ImageSet is expected to be in the + format `-`. The `variant` used is `enterprise` if the + InstallationSpec Variant is `TigeraSecureEnterprise` otherwise it is `calico`. + The `release` must match the version of the variant that the operator is + built to deploy, this version can be obtained by passing the `--version` + flag to the operator binary. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageSetSpec defines the desired state of ImageSet. + properties: + images: + description: Images is the list of images to use digests. All images + that the operator will deploy must be specified. + items: + properties: + digest: + description: Digest is the image identifier that will be used + for the Image. The field should not include a leading `@` + and must be prefixed with `sha256:`. + type: string + image: + description: Image is an image that the operator deploys and + instead of using the built in tag the operator will use the + Digest for the image identifier. The value should be the image + name without registry or tag or digest. For the image `docker.io/calico/node:v3.17.1` + it should be represented as `calico/node` + type: string + required: + - digest + - image + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_installations_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_installations_crd.yaml new file mode 100755 index 0000000..a327924 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_installations_crd.yaml @@ -0,0 +1,1242 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: installations.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: Installation + listKind: InstallationList + plural: installations + singular: installation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Installation configures an installation of Calico or Calico Enterprise. + At most one instance of this resource is supported. It must be named "default". + The Installation API installs core networking and network policy components, + and provides general install-time configuration. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Specification of the desired state for the Calico or Calico + Enterprise installation. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration options + for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip forwarding + will be enabled for containers in the CNI configuration. Default: + Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the Calico + CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create if + none exist. At most one IP pool of each address family may be + specified. If omitted, a single pool will be configured if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the main + IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the IP + Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector that + will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + linuxDataplane: + description: 'LinuxDataplane is used to select the dataplane used + for Linux nodes. In particular, it causes the operator to add + required mounts and environment variables for the particular + dataplane. If not specified, iptables mode is used. Default: + Iptables' + enum: + - Iptables + - BPF + type: string + mtu: + description: MTU specifies the maximum transmission unit to use + on the pod network. If not specified, Calico will perform MTU + auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a CertificateSigningRequest + to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. + This feature requires that you bring your own CSR signing and approval + process, otherwise pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate a + key pair that is associated with the X.509 certificate request. + Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature of + the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to accommodate + for clusters with multiple signers. Must be formatted as: `/`.' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management that + will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For CNI + Plugin Calico, this field defaults to Calico. * For CNI + Plugin GKE, this field defaults to HostLocal. * For CNI + Plugin AzureVNET, this field defaults to AzureVNET. * For + CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only if the + CNI plugin is set to Calico, for all other values of the + CNI plugin the plugin binaries and CNI config is a dependency + that is expected to be installed separately. \n Default: + Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in the + Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider AKS, + this field defaults to AzureVNET. * For KubernetesProvider EKS, + this field defaults to AmazonVPC. * If aws-node daemonset exists + in kube-system when the Installation resource is created, this + field defaults to AmazonVPC. * For all other cases this field + defaults to Calico. \n For the value Calico, the CNI plugin + binaries and CNI config will be installed as part of deployment, + for all other values the CNI plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. Node, Typha, and KubeControllers + are supported for installations. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of limits + and requests for compute resources such as cpu and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control plane + nodes on which to run Calico components. This is globally applied + to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which are + then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates any + taint that matches the triple using the matching + operator . + properties: + effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match all + values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod + can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, it + is not set, which means tolerate the taint forever (do not + evict). Zero and negative values will be treated as 0 (evict + immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path for + FlexVolume. If not specified, FlexVolume will be enabled by default. + If set to 'None', FlexVolume will be disabled. The default is based + on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to be + specified. If specified then the specified value will be used as + the image path for each image. If not specified or empty, the default + for each image will be used. A special case value, UseDefault, is + supported to explicitly specify the default image path will be used + for each image. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + imagePrefix: + description: "ImagePrefix allows for the prefix part of an image to + be specified. If specified then the given value will be used as + a prefix on each image. If not specified or empty, no prefix will + be used. A special case value, UseDefault, is supported to explicitly + specify the default image prefix will be used for each image. \n + Image format: `//:` + \n This option allows configuring the `` portion of + the above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images to + be pulled. + items: + description: LocalObjectReference contains enough information to + let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider of + the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to automatically + determine the current provider. If the specified value is not empty, + the Operator will still attempt auto-detection, but will additionally + compare the auto-detected value to the specified value to confirm + they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node serves + prometheus metrics on. By default, metrics are not enabled. If specified, + this overrides any FelixConfiguration resources which may exist. + If omitted, then prometheus metrics may still be configured through + FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if type + = "RollingUpdate". --- TODO: Update this to follow our convention + for oneOf, whatever we decide it to be. Same as Deployment `strategy.rollingUpdate`. + See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that can + be unavailable during the update. Value can be an absolute + number (ex: 5) or a percentage of total number of DaemonSet + pods at the start of the update (ex: 10%). Absolute number + is calculated from percentage by rounding up. This cannot + be 0. Default value is 1. Example: when this is set to 30%, + at most 30% of the total number of nodes that should be + running the daemon pod (i.e. status.desiredNumberScheduled) + can have their pods stopped for an update at any given time. + The update starts by stopping at most 30% of those DaemonSet + pods and then brings up new DaemonSet pods in their place. + Once the new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times during + the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for component + Docker images. If specified, all images will be pulled from this + registry. If not specified then the default registries will be used. + A special case value, UseDefault, is supported to explicitly specify + the default registries will be used. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity characteristics + for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling rules + for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects (i.e. + is also a no-op). + properties: + preference: + description: A node selector term, associated with the + corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha serves + prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico or + TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + status: + description: Most recently observed state for the Calico or Calico Enterprise + installation. + properties: + computed: + description: Computed is the final installation including overlaid + resources. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration + options for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip + forwarding will be enabled for containers in the CNI configuration. + Default: Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the + Calico CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create + if none exist. At most one IP pool of each address family + may be specified. If omitted, a single pool will be configured + if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the + main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the + IP Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: + IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector + that will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + linuxDataplane: + description: 'LinuxDataplane is used to select the dataplane + used for Linux nodes. In particular, it causes the operator + to add required mounts and environment variables for the + particular dataplane. If not specified, iptables mode is + used. Default: Iptables' + enum: + - Iptables + - BPF + type: string + mtu: + description: MTU specifies the maximum transmission unit to + use on the pod network. If not specified, Calico will perform + MTU auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a + CertificateSigningRequest to the certificates.k8s.io/v1beta1 + API in order to obtain TLS certificates. This feature requires + that you bring your own CSR signing and approval process, otherwise + pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate + a key pair that is associated with the X.509 certificate + request. Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature + of the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to + accommodate for clusters with multiple signers. Must be + formatted as: `/`.' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management + that will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For + CNI Plugin Calico, this field defaults to Calico. * + For CNI Plugin GKE, this field defaults to HostLocal. + * For CNI Plugin AzureVNET, this field defaults to AzureVNET. + * For CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only + if the CNI plugin is set to Calico, for all other values + of the CNI plugin the plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in + the Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider + AKS, this field defaults to AzureVNET. * For KubernetesProvider + EKS, this field defaults to AmazonVPC. * If aws-node daemonset + exists in kube-system when the Installation resource is + created, this field defaults to AmazonVPC. * For all other + cases this field defaults to Calico. \n For the value Calico, + the CNI plugin binaries and CNI config will be installed + as part of deployment, for all other values the CNI plugin + binaries and CNI config is a dependency that is expected + to be installed separately. \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. Node, Typha, and KubeControllers + are supported for installations. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the + component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of + limits and requests for compute resources such as cpu + and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of + compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control + plane nodes on which to run Calico components. This is globally + applied to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which + are then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates + any taint that matches the triple using + the matching operator . + properties: + effect: + description: Effect indicates the taint effect to match. + Empty means match all taint effects. When specified, allowed + values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match + all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to + the value. Valid operators are Exists and Equal. Defaults + to Equal. Exists is equivalent to wildcard for value, + so that a pod can tolerate all taints of a particular + category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of + time the toleration (which must be of effect NoExecute, + otherwise this field is ignored) tolerates the taint. + By default, it is not set, which means tolerate the taint + forever (do not evict). Zero and negative values will + be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path + for FlexVolume. If not specified, FlexVolume will be enabled + by default. If set to 'None', FlexVolume will be disabled. The + default is based on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to + be specified. If specified then the specified value will be + used as the image path for each image. If not specified or empty, + the default for each image will be used. A special case value, + UseDefault, is supported to explicitly specify the default image + path will be used for each image. \n Image format: `//:` + \n This option allows configuring the `` portion + of the above format." + type: string + imagePrefix: + description: "ImagePrefix allows for the prefix part of an image + to be specified. If specified then the given value will be used + as a prefix on each image. If not specified or empty, no prefix + will be used. A special case value, UseDefault, is supported + to explicitly specify the default image prefix will be used + for each image. \n Image format: `//:` + \n This option allows configuring the `` portion + of the above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images + to be pulled. + items: + description: LocalObjectReference contains enough information + to let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider + of the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to + automatically determine the current provider. If the specified + value is not empty, the Operator will still attempt auto-detection, + but will additionally compare the auto-detected value to the + specified value to confirm they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node + serves prometheus metrics on. By default, metrics are not enabled. + If specified, this overrides any FelixConfiguration resources + which may exist. If omitted, then prometheus metrics may still + be configured through FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if + type = "RollingUpdate". --- TODO: Update this to follow + our convention for oneOf, whatever we decide it to be. Same + as Deployment `strategy.rollingUpdate`. See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that + can be unavailable during the update. Value can be an + absolute number (ex: 5) or a percentage of total number + of DaemonSet pods at the start of the update (ex: 10%). + Absolute number is calculated from percentage by rounding + up. This cannot be 0. Default value is 1. Example: when + this is set to 30%, at most 30% of the total number + of nodes that should be running the daemon pod (i.e. + status.desiredNumberScheduled) can have their pods stopped + for an update at any given time. The update starts by + stopping at most 30% of those DaemonSet pods and then + brings up new DaemonSet pods in their place. Once the + new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times + during the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for + component Docker images. If specified, all images will be pulled + from this registry. If not specified then the default registries + will be used. A special case value, UseDefault, is supported + to explicitly specify the default registries will be used. \n + Image format: `//:` + \n This option allows configuring the `` portion of + the above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity + characteristics for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling + rules for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects + (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha + serves prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico + or TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + imageSet: + description: ImageSet is the name of the ImageSet being used, if there + is an ImageSet that is being used. If an ImageSet is not being used + then this will not be set. + type: string + mtu: + description: MTU is the most recently observed value for pod network + MTU. This may be an explicitly configured value, or based on Calico's + native auto-detetion. + format: int32 + type: integer + variant: + description: Variant is the most recently observed installed variant + - one of Calico or TigeraSecureEnterprise + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_tigerastatuses_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_tigerastatuses_crd.yaml new file mode 100755 index 0000000..abfe29c --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.008/templates/operator.tigera.io_tigerastatuses_crd.yaml @@ -0,0 +1,104 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: tigerastatuses.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: TigeraStatus + listKind: TigeraStatusList + plural: tigerastatuses + singular: tigerastatus + scope: Cluster + versions: + - additionalPrinterColumns: + - description: Whether the component running and stable. + jsonPath: .status.conditions[?(@.type=='Available')].status + name: Available + type: string + - description: Whether the component is processing changes. + jsonPath: .status.conditions[?(@.type=='Progressing')].status + name: Progressing + type: string + - description: Whether the component is degraded. + jsonPath: .status.conditions[?(@.type=='Degraded')].status + name: Degraded + type: string + - description: The time the component's Available status last changed. + jsonPath: .status.conditions[?(@.type=='Available')].lastTransitionTime + name: Since + type: date + name: v1 + schema: + openAPIV3Schema: + description: TigeraStatus represents the most recently observed status for + Calico or a Calico Enterprise functional area. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: TigeraStatusSpec defines the desired state of TigeraStatus + type: object + status: + description: TigeraStatusStatus defines the observed state of TigeraStatus + properties: + conditions: + description: Conditions represents the latest observed set of conditions + for this component. A component may be one or more of Available, + Progressing, or Degraded. + items: + description: TigeraStatusCondition represents a condition attached + to a particular component. + properties: + lastTransitionTime: + description: The timestamp representing the start time for the + current status. + format: date-time + type: string + message: + description: Optionally, a detailed message providing additional + context. + type: string + reason: + description: A brief reason explaining the condition. + type: string + status: + description: The status of the condition. May be True, False, + or Unknown. + type: string + type: + description: The type of condition. May be Available, Progressing, + or Degraded. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + required: + - conditions + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1908/Chart.yaml b/charts/rke2-calico/rke2-calico/v3.1908/Chart.yaml new file mode 100755 index 0000000..44a8800 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/Chart.yaml @@ -0,0 +1,7 @@ +annotations: + catalog.cattle.io/namespace: tigera-operator +apiVersion: v2 +appVersion: v3.19.1-2 +description: Installs the Tigera operator for Calico +name: rke2-calico +version: v3.1908 diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/_helpers.tpl b/charts/rke2-calico/rke2-calico/v3.1908/templates/_helpers.tpl new file mode 100755 index 0000000..3ac4a1c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/_helpers.tpl @@ -0,0 +1,10 @@ +{{/* generate the image name for a component*/}} +{{- define "tigera-operator.image" -}} +{{- if .Values.global.systemDefaultRegistry -}} +{{- $_ := set .Values.tigeraOperator "registry" .Values.global.systemDefaultRegistry -}} +{{- end -}} +{{- if .Values.tigeraOperator.registry -}} + {{- .Values.tigeraOperator.registry | trimSuffix "/" -}}/ +{{- end -}} +{{- .Values.tigeraOperator.image -}}:{{- .Values.tigeraOperator.version -}} +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/certs/certs-node.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/certs/certs-node.yaml new file mode 100755 index 0000000..5830c2a --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/certs/certs-node.yaml @@ -0,0 +1,13 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +apiVersion: v1 +kind: Secret +metadata: + name: node-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.node.cert" .Values.certs.node.cert | b64enc }} + key.key: {{ required "must set certs.node.key" .Values.certs.node.key | b64enc }} + common-name: {{ required "must set certs.node.commonName" .Values.certs.node.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/certs/certs-typha.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/certs/certs-typha.yaml new file mode 100755 index 0000000..4463e89 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/certs/certs-typha.yaml @@ -0,0 +1,23 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +kind: ConfigMap +apiVersion: v1 +metadata: + name: typha-ca + namespace: tigera-operator +data: + caBundle: | +{{ required "must set certs.typha.caBundle" .Values.certs.typha.caBundle | indent 4}} +--- + +apiVersion: v1 +kind: Secret +metadata: + name: typha-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.typha.cert" .Values.certs.typha.cert | b64enc }} + key.key: {{ required "must set certs.typha.key" .Values.certs.typha.key | b64enc }} + common-name: {{ required "must set certs.typha.commonName" .Values.certs.typha.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/crs/custom-resources.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/crs/custom-resources.yaml new file mode 100755 index 0000000..7e97770 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/crs/custom-resources.yaml @@ -0,0 +1,24 @@ +{{ if .Values.installation.enabled }} +{{ $installSpec := omit .Values.installation "enabled" }} +{{ $secrets := list }} +{{ range $name := keys .Values.imagePullSecrets -}} +{{ $item := dict "name" $name }} +{{ $secrets = append $secrets $item }} +{{ end }} +{{ $_ := set $installSpec "imagePullSecrets" $secrets }} +{{ $defaultRegistry := get $installSpec "registry" }} +{{ $finalRegistry := coalesce .Values.global.systemDefaultRegistry $defaultRegistry }} +{{ $_ := set $installSpec "registry" $finalRegistry }} +{{ $defaultipPools := get .Values.installation.calicoNetwork "ipPools" | first }} +{{ $defaultCIDR := get $defaultipPools "cidr" }} +{{ $finalCIDR := coalesce .Values.global.clusterCIDR $defaultCIDR }} +{{ $_ := set $defaultipPools "cidr" $finalCIDR }} + +apiVersion: operator.tigera.io/v1 +kind: Installation +metadata: + name: default +spec: +{{ $installSpec | toYaml | indent 2 }} + +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/ipamconfig.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/ipamconfig.yaml new file mode 100755 index 0000000..64dbc6e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/ipamconfig.yaml @@ -0,0 +1,7 @@ +apiVersion: crd.projectcalico.org/v1 +kind: IPAMConfig +metadata: + name: rancher-config +spec: + strictAffinity: {{ .Values.ipamConfig.strictAffinity }} + autoAllocateBlocks: {{ .Values.ipamConfig.autoAllocateBlocks }} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/00-namespace-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/00-namespace-tigera-operator.yaml new file mode 100755 index 0000000..b7e260e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/00-namespace-tigera-operator.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: tigera-operator + annotations: +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/node-selector: "" +{{- end }} + labels: + name: tigera-operator +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/run-level: "0" +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/01-imagepullsecret.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/01-imagepullsecret.yaml new file mode 100755 index 0000000..b90407c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/01-imagepullsecret.yaml @@ -0,0 +1,15 @@ +{{- $envAll := . }} +{{- if .Values.imagePullSecrets -}} + +{{range $key, $value := .Values.imagePullSecrets -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $key }} + namespace: tigera-operator +data: + .dockerconfigjson: {{ $value | b64enc }} +type: kubernetes.io/dockerconfigjson +{{- end -}} + +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-configmap-calico-resources.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-configmap-calico-resources.yaml new file mode 100755 index 0000000..2270813 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-configmap-calico-resources.yaml @@ -0,0 +1,27 @@ +{{- if eq .Values.installation.kubernetesProvider "openshift" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: calico-resources + namespace: tigera-operator +data: + # To create Calico resources before Calico components are started add + # an entry here and the contents of the resource under the entry. + # The resources here should all be projectcalico.org/v3. + # Multiple resources/entries can be added to this ConfigMap. + # + # If you need to remove a resource that was added to this ConfigMap + # you should remove it from here or else it will be re-created. + # + # example-global-network-set.yaml: | + # apiVersion: projectcalico.org/v3 + # kind: GlobalNetworkSet + # metadata: + # name: a-name-for-the-set + # labels: + # role: external-database + # spec: + # nets: + # - 198.51.100.0/28 + # - 203.0.113.0/24 +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml new file mode 100755 index 0000000..97e5c04 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml @@ -0,0 +1,47 @@ +{{ if ne .Values.installation.kubernetesProvider "openshift" }} +# This should not be rendered for an OpenShift install. +# OpenShift uses SecurityContextConstraints instead. +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: tigera-operator + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'hostPath' + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + # Assume that persistentVolumes set up by the cluster admin are safe to use. + - 'persistentVolumeClaim' + hostNetwork: true + hostPorts: + - min: 0 + max: 65535 + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-role-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-role-tigera-operator.yaml new file mode 100755 index 0000000..70b68b2 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-role-tigera-operator.yaml @@ -0,0 +1,253 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tigera-operator +rules: + - apiGroups: + - "" + resources: + - namespaces + - pods + - podtemplates + - services + - endpoints + - events + - configmaps + - secrets + - serviceaccounts + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + # Need to update node labels when migrating nodes. + - 'get' + - 'patch' + - 'list' + # We need this for Typha autoscaling + - 'watch' + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - rolebindings + - roles + verbs: + - create + - get + - list + - update + - delete + - watch + - bind + - escalate + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - statefulsets + verbs: + - create + - get + - list + - patch + - update + - delete + - watch + - apiGroups: + - apps + resourceNames: + - tigera-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - operator.tigera.io + resources: + - '*' + verbs: + - create + - get + - list + - update + - patch + - delete + - watch + - apiGroups: + - crd.projectcalico.org + resources: + - felixconfigurations + verbs: + - patch + - apiGroups: + - crd.projectcalico.org + resources: + - ippools + - kubecontrollersconfigurations + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - apiregistration.k8s.io + resources: + - apiservices + verbs: + - list + - watch + # Needed for operator lock + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - update + - delete + - watch +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + # When running in OpenShift, we need to update networking config. + - apiGroups: + - config.openshift.io + resources: + - networks/status + verbs: + - get + - list + - update + - apiGroups: + - config.openshift.io + resources: + - networks + - infrastructures + verbs: + - get + - list + - patch + - watch + # On OpenShift, we need to modify SCCs. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - create + - get + - list + - update + - delete + - watch + # The following rule is only for operator certification purposes. + # The operator normally runs in a namespace with openshift.io/run-level=0 which bypasses SCC. + # However in certification tests, the operator is run in a normal namespace so this + # rule is needed for host networking and hostPath volume access. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - hostaccess + verbs: + - use + # Need these permissions for the calicoctl init container. + - apiGroups: + - crd.projectcalico.org + resources: + - bgpconfigurations + - bgppeers + - felixconfigurations + - kubecontrollersconfigurations + - globalnetworkpolicies + - globalnetworksets + - hostendpoints + - ippools + - networkpolicies + - networksets + verbs: + - create + - apiGroups: + - crd.projectcalico.org + resources: + - ipamblocks + verbs: + - list + # For AWS security group setup. + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - create + - update + - list + - watch +{{- else }} + # Add the appropriate pod security policy permissions + - apiGroups: + - policy + resources: + - podsecuritypolicies + resourceNames: + - tigera-operator + verbs: + - use + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - get + - list + - watch + - create + - update +# Add the permissions to monitor the status of certificatesigningrequests when certificate management is enabled. + - apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + verbs: + - list +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-rolebinding-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-rolebinding-tigera-operator.yaml new file mode 100755 index 0000000..5689683 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-rolebinding-tigera-operator.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tigera-operator +subjects: +- kind: ServiceAccount + name: tigera-operator + namespace: tigera-operator +roleRef: + kind: ClusterRole + name: tigera-operator + apiGroup: rbac.authorization.k8s.io diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml new file mode 100755 index 0000000..14cd955 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tigera-operator + namespace: tigera-operator diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-tigera-operator.yaml new file mode 100755 index 0000000..e705255 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/tigera-operator/02-tigera-operator.yaml @@ -0,0 +1,85 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tigera-operator + namespace: tigera-operator + labels: + k8s-app: tigera-operator +spec: + replicas: 1 + selector: + matchLabels: + name: tigera-operator + template: + metadata: + labels: + name: tigera-operator + k8s-app: tigera-operator + spec: + nodeSelector: + kubernetes.io/os: linux + tolerations: + - effect: NoExecute + operator: Exists + - effect: NoSchedule + operator: Exists + serviceAccountName: tigera-operator + hostNetwork: true + # This must be set when hostNetwork is true or else the cluster services won't resolve + dnsPolicy: ClusterFirstWithHostNet + containers: + - name: tigera-operator + image: {{ template "tigera-operator.image" . }} + imagePullPolicy: IfNotPresent + command: + - operator + volumeMounts: + - name: var-lib-calico + readOnly: true + mountPath: /var/lib/calico + env: + - name: WATCH_NAMESPACE + value: "" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: "tigera-operator" + - name: TIGERA_OPERATOR_INIT_IMAGE_VERSION + value: {{.Values.tigeraOperator.version}} + envFrom: + - configMapRef: + name: kubernetes-services-endpoint + optional: true + volumes: + - name: var-lib-calico + hostPath: + path: /var/lib/calico +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + - name: calico-resources + configMap: + defaultMode: 0400 + name: calico-resources + - name: install-resources-script + configMap: + defaultMode: 0777 + name: install-resources-script + initContainers: + - name: create-initial-resources + image: {{.Values.calicoctl.image}}:{{.Values.calicoctl.tag}} + env: + - name: DATASTORE_TYPE + value: kubernetes + command: + - calicoctl + args: + - create + - --skip-exists + - --skip-empty + - -f + - /calico-resources + volumeMounts: + - name: calico-resources + mountPath: /calico-resources +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.1908/templates/validate-install-crd.yaml b/charts/rke2-calico/rke2-calico/v3.1908/templates/validate-install-crd.yaml new file mode 100755 index 0000000..4fcb3cf --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/templates/validate-install-crd.yaml @@ -0,0 +1,31 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "crd.projectcalico.org/v1/BGPConfiguration" false -}} +# {{- set $found "crd.projectcalico.org/v1/BGPPeer" false -}} +# {{- set $found "crd.projectcalico.org/v1/BlockAffinity" false -}} +# {{- set $found "crd.projectcalico.org/v1/ClusterInformation" false -}} +# {{- set $found "crd.projectcalico.org/v1/FelixConfiguration" false -}} +# {{- set $found "crd.projectcalico.org/v1/GlobalNetworkPolicy" false -}} +# {{- set $found "crd.projectcalico.org/v1/GlobalNetworkSet" false -}} +# {{- set $found "crd.projectcalico.org/v1/HostEndpoint" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPAMBlock" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPAMConfig" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPAMHandle" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPPool" false -}} +# {{- set $found "crd.projectcalico.org/v1/KubeControllersConfiguration" false -}} +# {{- set $found "crd.projectcalico.org/v1/NetworkPolicy" false -}} +# {{- set $found "crd.projectcalico.org/v1/NetworkSet" false -}} +# {{- set $found "operator.tigera.io/v1/ImageSet" false -}} +# {{- set $found "operator.tigera.io/v1/Installation" false -}} +# {{- set $found "operator.tigera.io/v1/TigeraStatus" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rke2-calico/rke2-calico/v3.1908/values.yaml b/charts/rke2-calico/rke2-calico/v3.1908/values.yaml new file mode 100755 index 0000000..f098535 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1908/values.yaml @@ -0,0 +1,49 @@ +imagePullSecrets: {} + +installation: + controlPlaneTolerations: + - key: "node-role.kubernetes.io/control-plane" + operator: "Exists" + effect: "NoSchedule" + - key: "node-role.kubernetes.io/etcd" + operator: "Exists" + effect: "NoExecute" + enabled: true + kubernetesProvider: "" + calicoNetwork: + bgp: Disabled + ipPools: + - natOutgoing: Enabled + encapsulation: VXLAN + cidr: 10.42.0.0/16 + blockSize: 24 + imagePath: "rancher" + imagePrefix: "mirrored-calico-" + + +certs: + node: + key: + cert: + commonName: + typha: + key: + cert: + commonName: + caBundle: + +# Configuration for the tigera operator +tigeraOperator: + image: rancher/mirrored-calico-operator + version: v1.17.4 + registry: docker.io +calicoctl: + image: rancher/mirrored-calico-ctl + tag: v3.19.1 + +global: + systemDefaultRegistry: "" + +ipamConfig: + strictAffinity: true + autoAllocateBlocks: true diff --git a/index.yaml b/index.yaml index aec86f1..8f7db2d 100755 --- a/index.yaml +++ b/index.yaml @@ -1,6 +1,17 @@ apiVersion: v1 entries: rke2-calico: + - annotations: + catalog.cattle.io/namespace: tigera-operator + apiVersion: v2 + appVersion: v3.19.1-2 + created: "2021-08-03T20:10:11.019141483Z" + description: Installs the Tigera operator for Calico + digest: 96dedc6fd1855025407316ec4011f2c3965940c51110d819f1154c238dd1db0b + name: rke2-calico + urls: + - assets/rke2-calico/rke2-calico-v3.1908.tgz + version: v3.1908 - annotations: catalog.cattle.io/namespace: tigera-operator apiVersion: v2 @@ -79,6 +90,15 @@ entries: - assets/rke2-calico/rke2-calico-v3.18.1-101.tgz version: v3.18.1-101 rke2-calico-crd: + - apiVersion: v1 + created: "2021-08-03T20:10:11.007196108Z" + description: Installs the CRDs for rke2-calico + digest: 51d7396ce558c09c5bd62a0995e9a5c449ac0b68ae5b6384b8125e073e61a164 + name: rke2-calico-crd + type: application + urls: + - assets/rke2-calico/rke2-calico-crd-v1.0.008.tgz + version: v1.0.008 - apiVersion: v1 created: "2021-07-07T08:18:57.708528959Z" description: Installs the CRDs for rke2-calico