From 1edab58aec9409d14e292e8f05722d721eed0cc8 Mon Sep 17 00:00:00 2001 From: actions Date: Wed, 6 Oct 2021 23:55:46 +0000 Subject: [PATCH] Bump flannel and calico images Signed-off-by: Brad Davidson --- .../rke2-canal-v3.19.1-build2021061111.tgz | Bin 0 -> 27881 bytes .../v3.19.1-build2021061111/Chart.yaml | 13 + .../templates/NOTES.txt | 3 + .../templates/_helpers.tpl | 7 + .../templates/config.yaml | 71 ++ .../templates/crds/bgpconfigurations.crd.yaml | 144 +++ .../templates/crds/bgppeers.crd.yaml | 115 +++ .../templates/crds/blockaffinities.crd.yaml | 62 ++ .../crds/clusterinformations.crd.yaml | 65 ++ .../crds/felixconfigurations.crd.yaml | 565 ++++++++++++ .../crds/globalnetworkpolicies.crd.yaml | 856 ++++++++++++++++++ .../templates/crds/globalnetworksets.crd.yaml | 55 ++ .../templates/crds/hostendpoints.crd.yaml | 109 +++ .../templates/crds/ipamblocks.crd.yaml | 82 ++ .../templates/crds/ipamconfigs.crd.yaml | 57 ++ .../templates/crds/ipamhandles.crd.yaml | 57 ++ .../templates/crds/ippools.crd.yaml | 100 ++ .../templates/crds/networkpolicies.crd.yaml | 838 +++++++++++++++++ .../templates/crds/networksets.crd.yaml | 52 ++ .../templates/daemonset.yaml | 266 ++++++ .../templates/rbac.yaml | 163 ++++ .../templates/serviceaccount.yaml | 6 + .../v3.19.1-build2021061111/values.yaml | 82 ++ index.yaml | 17 + 24 files changed, 3785 insertions(+) create mode 100755 assets/rke2-canal/rke2-canal-v3.19.1-build2021061111.tgz create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/Chart.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/NOTES.txt create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/_helpers.tpl create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/config.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/bgpconfigurations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/bgppeers.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/blockaffinities.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/clusterinformations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/felixconfigurations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/globalnetworkpolicies.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/globalnetworksets.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/hostendpoints.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamblocks.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamconfigs.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamhandles.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ippools.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/networkpolicies.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/networksets.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/daemonset.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/rbac.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/serviceaccount.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/values.yaml diff --git a/assets/rke2-canal/rke2-canal-v3.19.1-build2021061111.tgz b/assets/rke2-canal/rke2-canal-v3.19.1-build2021061111.tgz new file mode 100755 index 0000000000000000000000000000000000000000..087c90a9986784d0d7568aa04bf8db5b1fdd6f4e GIT binary patch literal 27881 zcmY&;b983Gvu*5&&50+rZQHhOTN6xdn-kmoV%wP5HolkpyYIerU;nkMs{5Qid#&!% zUA2j#VbDSTs{yG%XpAJ48BHYR*k!%A*o;}!8BJB#th80Q*cH^(+2u5Bt&QwWy;PMP z_$1A2?LaQNZG1M^mw&C#d|_ZeW;->+kr^a%63pWljVLAT5JQDuPjsIWgNA+=-n3{z(rH4}adXNXJ7+raF7E3y7g+(Vh2tS{me! z_->R6c>_QsBqR-Bz{|tweQj(mA%Q@^+re1lF{J?kAs?5w^8*H#@2;0QK8&4ZY62Ff*(f=Shw@gU zlDcd=_SMuuc1~gjQ#(H&XIp0{-jVbdQEGaqId6hUMJcpTtF0HMTBX7>6a=G#gM2$< zGJNT-1bZ1T4|ya&;uA?x?EvpA{tdKjAmkKWsQ@_Ws^eE4fq-9w z_g7waw(BuahBu_&(Bay~na||FxXDu*HJ3V3CIf|3st}tkMpB42UN!-ZpI8`9d{v_6 z4`E`0>=-~Yi6__0bn>Z(VocVWVpMdDi;1Nsve0-u+^1dE;6^nkaeHp>=JfW)(bLn> zb$(+b%TyI6HRlTDj;)<;*ml>S*jK*HHf|Sq=_8CjQF0_+c}R5&?Io@@4k7dDF*`eZ zN~ML57?+EPRJGvi>gfr#zxwEGl%6>onjqYm9Fr#bXH=A$IcYr}i2H#9lsxd&hsjlx z0gssN2ZWm18jo@o{cBN}jDda6%U7x4qlKFSpl`!vH2D1>D7F=jo9yi6Sm$14k7nE zO+YRjY3z_9cd>NrY22|d&XV?SjUe;;*`l^ z^J@(-$!O({mGDvB5Z?UQAVu(Q-8tbGtk=K`7+?`+=E_;WuOxpp3`$9#{3;bd=E3># z6Y#Wi8`C|ooB+^`!K8G544?u<^c-ORx+O8l*2VCmPvIg*%e4A%9zsvE%5xNAl_{2V z+sW#yyxAQMVkn_-CV72Dwzpa+uE;nSQBO9>#QTQ5^7X&c81wcHfT4o z-P5ofqC3gIu1IRBwKO8b!TN2-x-eguZ9d$ChGybKXQGlxt1-ghG4%vOYQQAY6B6e6 z3s1^hSJt!^Vw#4l+ZevIO-r9VipfdZ7X0O_q|Yyy-aN+KJatmjS;zka{3Cp7-cV&T zqCL^Y-2CsX>2%D$$S0!MagN$sfH#r9NdP}lLL-?Gj>_*7)g&HqWms30{T@{NQ34JY z5_qvFrU1l|g06YP$-Ehf!(SMfAFL*hnI*wrF=VL?Sh91;C`Bix18DCy<4t>D=J^FB z1hMcZgM?r{XPdAMyA|B9sj8RIXjb&?fw#NU_s?i@hJVBp8?hMlV{2p-^Grh0t_E#h zLl%!{g_uA$YT{vds#aF6@jKRHF()UZzM=fs+=9jL?3D>$@yo+gM4VYhlYlN`>wYwM z*b9Ftn2X!-bWku}&C$QfTD;*K-c_b@Ow{w$2!&f3Q^Yga>W{_@VK9H$M z6Doy#(R~t$M?>;S>$u#TC}+=)UIBZ;RiY9raSUZMDF8BSUZq;@g=mQ zG4$!5A}C&zzo{DnMSYLg^>=SDTS$2v$9}e*jtzWB96t~LG05B9W=%4ImUOxJ4CO{RtX+}eQ12ZYYWoX5(ul6l67YL#G1ib*^zzI}{%gz0p z3#3%&xCe^m_8Zncv$caok5!;i3(E!)L4gVfHl*87E_au8;wr-~OOAJWp#hPD*{ZLLBV|?)`Q$|!jVC%V|&>cxr z=KCwcfo<%@FINd(#^ou%A@*0IR!#GK#y;6hg0J&@F2x%o;#jNXXAA`k$ZdR|2e$=m z8O}pUD)U5da2R;!Ej#k8`&7jq>{J8!n3?`+V={O3vk%9M&&OHvhYg7JZU8rd_l&U- zl3Q|!ZYlUm&&u-;)IFpqJ9kcBX5LDD?jPdU$sf(C<3JY0ndeF7h$|HJ!-yODq=jc3 zow`YOkZRpaw+a&fYo3bavBy+Qdw+uK9pK?sE5nX{PnW;f%?=KMXf%1iXK*neE=%?nADeXL%d=3c6v!zd{sfnM>Yb?3R%A)!A1WWz?*iAD!&V z^enlw8^ax+;v4~lAY}89`>-o5h`)|vKn>*xL_k+=%UYfo$Q?kAy2cN@~S-mjJj zpfd#~tG^i1d3;xDSe*tumN=MKd5qa~T3-h8ZY=f}k==Dlz*1bMi@^yfiWJ#Yy8J42 zk+zC*3PTPT%TFf184`zuxiM>rXtXXlLw&3wz}U1)v>VR!^y42~3m)M}oZO5Wie1)c zHvB8SeSZmiGzW?Dt>~p;ciK0G=g4~?^%C^Hl|GNNcY67QKC=)HFyP_g;I)w(7~uO* zya4pepd1JG9+QkkEgFNpNN_QM-2P*iyCgc#)w^C{f`SOgwNP-G=EtRA?dts$M{4KQ z#P_nwpB10pVSd=`ghXKUcoofx>j2%jrmFy$>Dqlj(g=qz2h(7jq-$4 z%Um;MP*`i=WS1|MixFj>@Y=64(S?Phc7FW~GZ#6zR>5Hho&>MxVo%t11we66o?Ok& z<>sbwp_mrO65wyI{FIfP@^EmQ{;FJb3|P)EqG?sE*JT^qPol|SF=KdI*d0b{X&-)B zJgRdji>%JxhL!M;F{{wQNkBX1A94n;qLr?Poh6_NLnfGX=7<=Jv6ePH8%q^yGMfE1 zj?9MpifeGFv)&L2TF*$~7dmMu#B+T0o7J8QPd*n>-y&q;Bk!knJ9xpfjSJiEWFSS) zF66Gm1fnKH3mEz1vXG`2q$PtvkDr&D+{bJkPSq@Qn+DODH9T!!TRLM{)=5{trlENY zcA67~dVg*7Z8l!#bpS&;6jCU$mr&Tf6!jf?D3vquC_J~t8hquN#SRF(6<=N8mOZ?% zbMrcO0cO_?dZkgXy27Q}bmH5X+rMAg*sg^Y_v6hy`xYzwss@<%Oe$5qwK=;qwiZq> z-FAwvj_zU*JvY?IXAmd7+-%q0GojhMe(tUxt)I;tXcb3`+3Wi+2cDO7!SjSmREpy_ zx19u9|HhT|Rq1X8HQ(&_elxmC?(f;a24yhya1-{)|7lnH4v~P~S^es03se?ITIu;0 zK1Ir6o4(($?qXLiSs~qjA6`kNlVek?0JhKyJt6Pt$87gI2uW99j)R5;3S%vqAzd)V z(9XI(LF!(plJLd5>Q;!8_+A*iKOQYY`T)G7OxU+haZo_v_#R2_p7?;Lf?86e>K7}G z&p_<^f&DQ0$6LQ}d;JK~6J8}Y7dNqq{iYSpfMnIX<_{B#wbjEngg1NaghZr!uGr^; zHui0WmfOl)vh-5D2tLFCLMz_$dVQBtC<~44``DsB0v~7Vixh9^ujity2cVZP9PqRE z3*&3z(_P@eGQVn1rV?GRrmHa`Co(}5r9)MuT*FL6;jV8G-pF1`tfn|2a+3Erh;O9N ziST8KfDbsR9nJMQdJOnT&gS)bI#_$Np}%>YlSgOLajDo4{I}wJ^D)4}MZVrm>`IF@ z*-mNh+%ZmwoF5%y8E$X(V089laZ_C$#_Ag8>0kiqdTcN9y6zg$*y5LAdp*SZ4Kc|U8O28N*cA+UWI6Qgv7{@GlQOgL@kG=7cxIbxex9=K?_z)D zdXCq8Yx=Jd1#hE9%o&Kcgrl4Twr|`N8LwB}0{u%945Z9Cd+cBtHqMiK3xrAe=pU#r zCF_LgKQe%nn8Mou- z?Zn*ZOL6GWrxV3?SUb8g9tbmC{R!nK?an9S%DvWbor016rIV^5`=eyko=3dIUW6lt zC@kY9*V`+b$}qMFYpx9Ja*okJHltS46n@Of=q!t{k z#KjuGm$Y6_7Lb2k{6&duDkz;Dth>Asmc>}8uhCGtj3!kl5PTM?!D#y!N2Yz7TaUwp z4G|<3Zc2!f_sjlq)se$4hnk9)s$a8?>)oAs3bOyRShD}AKw-=P*b>p*@F3xUS|`9C z_*u5}mBvzfSeg)t@}h`I=avNr2gxxXtVR1t6OSn z)FR-|+LIybIYl=<&nrS|*Ywfy+9r3F&IBfJ-P9D}hnq?k8d*}GO+sz__(?&v;0<6Ky3N13q^~;q){S0wr5M(Z)6Xfl%Iu;Kxf9)pa=3v#MHL84> zAZ_~L$k8cQd1RU;2|N*URUPe1UjMpGYZDxf-|lyqDj`sVo5yoWK};HJYVA?7gWKc! zd`T7RNwFbpY+FhQnK6p&3jyc1=3?@|EQjO4LA^`b3KWDyC8nvP)f3_(M+fCoV>L=5 zx!*z=JVsD`S)~i@O4A#`zQ!Tl(eL78m>O~xj*UfXM#8fMlP@|8h~5Xob6{9wrVA~r zm46SR5)NfoXCyWkH(7V8i7c=lN5E|iDj#Sk#k$HpIQgu}IPKgOKY4|VXQ|9M=;%S2 zY>yAY7(+!7wVk{&e4i)W$R4+{aC{xJMUSf2st6wGr?dRnLfqRWM{i5##{X^4Ee!or zg%FMmdYf_Ls9o!-DLdQRk8+7Z2T7SClUQ+!bAhy9fm@ug|eXr)$R z`YXInk6BXNF76t{1o>tIIiq$BbR0xrYrE{T8^#Ul3W@`23Eh|hyG{H`Y;qRzyncFO z0-{#X0ygR$E=Nnff^fN+kLQ_Bn_0r=^9&~U1$$g5+k0LKls#ya+)oAhU^2f-DP79P;_bW^*rS!*B}@O~gX&NptIY~k_e9LEmwV_KQ0u61~OX3pfv1YDePwQO2FNjp^McqoZ3H zWTJ^UXAG9Bbqm8|6u-u>2Fkbj`S9pDOsq-3?^#wg+4Fc}Qnb^>`+f3J$z0?^WdJ?) zF`XHizg+_C73K{+a!DLU+x$cKSapN6|I2xR-uEpx;A^Ae^XCyM3C6482Jh$nX}}tL z08|wgnRiH#H5!8WLz;Gs9ysMM4`>j4QEBP8I;M%@lIp$*t`g8$TFEe#S0zy?a>aHv z2M!OZZKe@`Qb>}U;Kt=w9qlJytq9;~KDpJ{ZX_PX+PrdH#u4H~EdrbHJw*m3Ck|WA zoQa%D-_Ue&lE5V>82K%I^g|t z6!mw3o%hkSAPqQ7gZ-j>(~4y5vpY{XYkg5I;S<5eH%0W%~`L z>Cyu|p=)_LM{##yK~s{=d3K|G9nZr&V^FRn4;!bJavH~nUk%Aq*)!aED&Ev=9bgaJ zR^~xoOlR#6!p&YOn^9t(l#NRi++@WbRFLOlZ^K`@FxL0l9)X_>dPzW{=y>ZnpapY# z3ECo{L4gU}HU=obr5y?6^7Y?54EQ3M2{{95Fdn&Nf|88B1}=kayyHCe=r+TKUN6&u zKYCT;!UVTYOv}z@z;d(n*KWun&j-`}fwU;v$;^zGkfWh-Lf)K_Ks9&1nj&+2LBD1?T&#*lSL%a*b;x ze49CeE>dYy0TH@j=_gXYj{W}854KKUlofLXLp%+C=Uv@bw<$_L#iLI>g0HlR)2}j| z+^Y({sgGV3PR;S^qr7BLLvSGQ;>I%tD8TKt4FCot9236+v4=HniSwjjEC*&I&>*_9 z+}H-9SnIY8<;Z?dI*ZY2I^04gg8rTHB_{}Uabl?6?0@Kx1<7esitwkj_XTw_`5bLI z1nW~6Irp_G;t+~1232MDE?u#}X?b)ix>DTm;=)3pR7qBe+>lo#7M-kH8%XW^>Iv|0 z>ai+SlMzsO*~oavq-gQ7EoW|6T5T!Wp^^aR7mj_FDN>yJOjzR9->isrYwt5BS!jc> z&H7Rc`eRW1LSi{yU@V#%A0qP=W5IgMlL74q>yR{8XC5?0vlOAS%kW6vK;uhrYE(^R z)T8L8J+9AESqi3>2b2n46V+o#X(cK_mSW{jevE+LK@}84?nMueeZbM70IkBCe0ok6 zXn{f*anNHREA&9VfVU4vI^f2b6c+GSEH@$UjQR`Ji`{ zR^y=e5z|2MYcR{R%-8Woit^p9!GPc`=i(XCwAW3zkqQZ)@aEktc!Jr>gQ)}ikEQcO z%$NMwtAg^Dd17hSN9xneI)6AUO@^Aj9OD$s#x*Kyaj5VilO#{Asl4q>Xk_RS?tNui zh61IdtIN{!HyO{q>KO;aUL#+S$hdD0+`KY4YRsuJrl?cQpK( zbSHh?ko>4VkV;Nes?jwCjf2DJeP&J(q=IGR9_t^27D@__;lwxHE?!hqG0|4F*Y|p5 zd?XmB?WnO!$_{@V=rNo9?Q@=-w=d(ciQS2`j2)gwl88X=p@_`wgZM=53+H+nF?U>+R1z` zM{mC;x5N-HrHGKOHo(7bLx{~W`_Gg1cLKFyZZex}*WJji*&=o)DdwOvd0EsnoBHlg z<&s?tq7W9gG1_ubXT=8ep3UF)9LO;xxbW$HSVl}K<=f*mfHElO;s%oZjIISy`gH9n z@TT?|9E^%BkAzXKI#o3c3}O{10C&zz%b@77)?D>Qs@m2F(S^xIjfE{eDqWPAd10rxKw8@e^kS7fRevjf2RnZ#goF}a%?JG zZ1(GuGq3CU(U)XmUM44iZ|d;amc=J!>8Hpyn|#jm%T$E&h1>Y z`&sJ76bp5skX7EW`6^YXtQft()cI6@KI7+Ot+j@ZTf)?Vp5z#*49txAlr&tw;}wX2 zvy%6hDfHNY@!XKA(BUOdr7~^dAsD7~>=faBBtzR)Cw-`)7Sf>c@cfXlX!asR5lyKJ zm8)8Bq>XVt622X|C>T^U0XfIV>(Yk)j$dfV&>I2PaB~F`A;+EIi^n*IjBHB`l>Mp} zEdHjQ_R>%B>7U3HGdOD82q3-KUVFby*2yhjC2Ea9dW6w%Pnj&Nr<;%9#q|lG)8xVy z+88>`n8mVtQu%>d=*IF(;)J*f-j|I~e`D#6$8OU%&V{#9Z)x2_lpqgoi9CYg27JRA z(Uu@i1@Q{+(_})A>WKjLfT*VP54A3qXcXtVZ}jWr#XOV zXW>^P2IJm)X5DLgNou|zTh}JyuB}++qJ;C(wtHh)82t0$m%*yLSkEV*p&(*CEX46Q zEj}^YrbK(9W%5KSSv^4_*n$drJA2fe*Dpxb*|nXx@ay)B1XFP?#%GOD``2RI!w(AL zVm;sVM*RTH;U0)>8~U155*#MLp}bO4CAq90oJMUsVLLq{vXo+rxI-OULv_}`w zPxImxxIhtM{V|@>E@>NU*ji(&1jG3wp@fiib+VRIBwuct4e?r$_ktDAxa|bt1*%3> zLt7m4iBv4E44JSr`#*n)PIIK*Xt?|Un6#+&-7Q!>RzJ4mP4UKWQpgFwY8d^WWURV_ z-|(-eIOM7B%$ZLgrLMs$-wK$Ar1QJQsd$rAWTQrpHq)cD>WZ+%(8Qf{8+%%3bgpnc zRg>S3?>&b%kSK^RNM&gA6`{V6m3KLk#&*JaK=BceARU)C7(*G(rm~u_S*RRD>Ph7Z zVkV*6lxSQB{$V=5W432kPQP|yXLS1gfo*$o>EzibXJjPNyEdf#lW<>vMVWmZRhra* zE)f&3PXhWVQnL!C%S^2WaKEzmc{n0saH(vb$mvXmob%We4N3Upy5Q<+GWmP>Mu9_X z(kYPiMV11Fy;N@TmOs-SSploy@?AhOnh1C?|;Xh-L8UMc6tm=cqg3c0^--RK_%Kw%kww_a0z`B z=QZ({orYT$S65S2P8Hy)U1?LeWYl@7I5N%9?taVvo3;~#(_LY?a>X}OKmeeLu8xS@ zT{grBN$AEtoH#FwFMXNKaI;J0Z_MH2lk1)5^!l-!1$8E&lk2q=(K}%k=gm7$(_R*8 zEtA~zcL~R@WjrYLg$|*r&T+X2KW?ObXFc`Ty{j|SugyYM>)k= z+U1J~(ri!MhMc~(DBkD10_nrQ5k$uP6YzdC#nxb^rgu#NN|PJUpn1H6s6|?%_pkcV7hWHU1b_%%jgl*wr@I1|W)VZ5 zy(1XY4J{An3c^B_BW+$Xn8Px_1-OEz3N@28T$Aem=Pe+f17^#Ni*fJ z%z8k)uECYh95{d|pzD@0`4}*e#cdI@O8qn;(fuJ6gu{7gD*S623LBC~qeRnKUB-DN zx<1CrnWtRr?Md(JEeh)0ms`zR)Sh?C%8}(dgX|iVRG6vCw2>Agg~ok}D&9&9mRElku^!|_b9+G5+*w0{310;?!fjdDyOF3u$U znPf^qq32X2y68BdParl=HNem1cR&uW-`miqo3pd>*CVgt^en5Je92=aL>Y#YbSW=nJpJa z=zXHQxs(&o7uWLFMo5xVqkz8r12)X1bgt$K z<{o*G$t5XU{mMqzv>MJv3AU36<%!f96EC!46^(fQh46DRbCaxCF_z~9w9i5NE&`(Zbbhw&UbE)?qG^r7ti@Exu6Qa=_F2qIU4OD> z?}ClI`?QrOb@69K!{qgKQuJJ$1{vMaefo%Tdw9GPQ&oZaR%VZc-&{%4%7%~csiBKZCQ{Iv$1=}5%IqdUAPN7%GDToj( zgj)d6Fo4L%!!lr7`Kz3Le#_UHAvx9tw*$!Wat6@x$2 zfMq)B-5z+^It(zl8jEtPT#3*mcE(fU_GGBvU`EFMDd?ITS{=L>s`2&R4&PjQhyz!a;RkErqZ2rl1A4p6Q7ZpI^)eu8djvjo4cmsb&kPKy?ps& zGh6WZC9yb}SvuqSWAe~$FL(s(%x*rT8OK}#bKCAx<G5mj6(c|*docD&z zAQTLvBVbncf5Aj1o{my@eygZ>RH4Q#xSDSZwM$h9@pu? zh;qslIDD?Er#Fo^>?P|1P~OWi$bTDSucII0H}*L|ARCGmk_&efU0>K4Vj*B4F%bkO zw#xqX_7LPF?~Bo9jUv+9%Umxi{Bmq7Vo1LJ(#hOxSh8GXyU}0NNdpU;8DMhn)qxtG z+1S=*!e(S8TSA93tje5EmvW9~^BrLsL>Ikf^CGgHi^h=av2mTz1hhOl@HPn9*-*|! zs9(a+{xmucwXl`^N;{-EK@B#UMUVh2>LJKaskS_I@y2;WrVC=JOdrmXwaE#~d}JSS z4gRDtGChUE?yW{R45spl{U!AZLDL+cow>GuL(Qoe#`$t`0LF9vUQh~oB{{~lkqgD@ zd(sM}OQPYL#>5WhvYmfS#x@L>t;s@&%_=~|7*tf-e}9iS>B=h znzW6RJI}Yr5x;xqsg2jd1A?rbpYu@%7TMd2$s5alq;c?-FERx3fNdFl1M=xAiM<>= zhP3L=DTM7LSmwY;AU`&LRkWLYCB;1dv=Ta8Z^qK~d{?v}O)hoG%G)JT=iu+<)hivY zaRth;x-O)ywo|5hL|OfS4$ePAo+ipsF+E8&Ob@tVs^bRabm-OBN(e|j<7LT1JXzlZ zF8Q(}qgt7-L;sVzOzpXImD3xWN_zv9Zl?Kv#wFbnt?i#Y$;ouz^1vgTJQ zr@=lvQw=yGpm)j^xJNlfrr}!i;uQ?JM@yO8$_q1^HnRzpcdAg=pF+|4@~jnX$O>j@ z%py(36SU#BB2O2}4E(r^yQOk#(K055R>VR)(?s;~ZSF6V%;St1bA6En<#sHrAm`L{ zw?fVj2nL^>xoHI7hsLcE?vcg!eCBxFoDieB*2_s>@Seqss7}Uvta{;c#>T`>iOXQv zbmK1gcK0{32~zNDkdE*+^${;ulf06}3a0C~9Mx9UpjV{(t=@lyFDH7v!+@sKhDJ@E zJ)$|^-OTsm1ce9*iITTz{krl9oz_PF>uPmJ=?H^Olm=uuzp-`hvbtn|$fyTRx36XOj+9Wsm3G{gpAgL8VtfWo` zr=Jw81bxCV4gE{kIj5LDcG?1VTvb_7_B)AWLh$L11M5nKqAV9m%p8eVQZPO6b&8Cv zvpmxAzjP^Fd@yUnMieGm8rr)VW2f#>yBa-4908Ck@#-^+~fcC)AUR2Y2&TKsd&WyfUMz%e5&thC3CXPutb&qAQ;hddW^K< zg6`Q~7e-~s`+*MHA2lxGV3LPlEK&9)MG=o+lI+GRSIogMCMgF~)Bz%oAFh9iYsy$E;tx7wmdkos4h z$C9XaCOI;%W@T~V`oC{)I9q-5c+g@h@Io!5BvRsCV1A-oh*%+CdsD>`Y8ESRz28nARmAA&ALPWgP{PgB&|7{#UD;N zUIL#tn77rS0#ZLu?{mh3VJA1Im+ZTW%yRzfy#8E@?z-$z5|pzuH0fY?sPWv9Em${! z>;l!x6)BVUZcMz9Um)%v12@=*_DQgZgZ5&PIny_?^ zaR=RNiMssaS1F7+Gks>tCtV;Ehat~Gt8Ita!F86mOF#z1-w<+R^1X)VJm$^B>~z+M zrb=o%#J^x-3?H!SZ!DVOKK3p?X&K&IEThGK}$YEpi{4LQ2W&OUiy*H6wkJNQLSSK_;pQpQN@@>L9&;r|T zmiw7qvh}9Ryk~2w8Lm(|jhqA|^_X8Q9Uj(%D@&P}51y9j=2i^%NFWP!t7H7ey_{S& z#SOJ|G=H_f{49&m-y}i=&eDbez9l$Lq^x|KSX@PU8m9d|RBo)qzUWyKkoQ9C$aB3? zmM>$6Bm092$lfHZU~c zK#0uJM=dobSAI6_c$$8(WER}Z``A6%P2*41hLVZ7U8q%*H+u8{9lX7bB_wOa!KWP? zdVjh4m}$9j^p3lN@-s^*wZ@$vV>Tm5a8yu0L+a9q-Jn=%LngPa?fN32N{G3~$ExZA z7r#&Hhi)8fuF;p^6vB$113&q&Hvud-JhPlHOIDjTGIi(F zIDgIpuWew4KPa|OHpaEKk!EYOXW4H6r75}~sThZsk}Bc+EY(^(Rh31ig1&&z=mdVT zFe%o4C6X}q%HN@jY8i4+h?!VLjVo?NFCgA6y@M3X+z)xzh-^2Y){63?aKF^8@~zJ9 zA31Hf?dujYRzq6yqb7dopd6$I=;RGW1%pL(YXC$BhznQsOJqF$N*9nyer%B+VXjf>uH<6D`?toa;;TaXi-lwk5dyRjoJjSW9nsclw?-1PF zx|sZS#m`fbR!Iq`h%9+FUr0yHwo5iOKgMXdmJVX6`vHr0V5N#Am1qPEOpy%5_K%qP zKmB2u$!E2v=9xPO3r8VT&{e2K-*T1yOgfLdkzh@p*2*?H(v^-x_x>$QeT?)`d8ejkmNoU_n>nQu35mP(0F;?a3>&#wZQNQ`O*rdn+ez8@ zdKJN8t)T63^m2K5$3YgH_vWv?y1xqGQ7`yUTCy~+y&PihX(-~JVPOV9y6o_MUm4zS z?~Ge(uiA_kf-7BRlwTI4-yg~P&7ybx{a+HX4!dM5PGq=uMm>P&pVnbp;3~fxxrY6| zY^w}2dTMW0H{~Lx3F{WdsL~#zYzArfcEs17R355QhSt6?thaIh+U%P(*J&e6%yEo# z{&Q+irJLSU5ZZX_xyP$LI$il6%Z}h(V&Yu+kW`+SF%{U7k2CpV_*fNCo2`xpna6c(ys79 zU-#4c%H9*O5enqR5wdz>F#p-4v0pl6F>amoh9s}ht!I=CgBNzvy}!NpnuPY}Yje}+ z9&uV_y;`4j^xEYiFyxuQ5rquhq{?XI1CUH~|6!l7fH+j)?j~T`i1ih*h><9zf*Lq9e(<{Wbq;Ll?OoM4dQ4#Y z8t+}D4y=3S((U}duG`#!^1uAMjLr7Y(}(IBn)z1Q0s1WUOe%|fS2>#ym#`kWA$wTD zx{}(x#dv<-V8m#`z~Q6D?3r9()ut<=%ZLAW94)-!Z&W`g4<6{_L=WOQ0F+@Gz*_17 zCC9QfotyY_aI0x`tNr>{pJ^2pS1t5$ zvunH#o}@y1jg)e+H3fN%q9TWiHhzv~Qo)BfHS-%Tq*y1yNe8?!r{11MHPHf40`Y@y z>>=#6>6yw+G2on{o3=#zOBq=__MY`Xa*$fuPW7Z+7Vr`qXiifWY;S^5Y0bGbGH*r^H%< zC;}L;lMR>rprX53OUL6VFW*^|$Whn0oG8LuW3v!yvZyQ2P~3zlLi_$Fmg}6e8~&^z zV>1owc80EQKRxs6)%{$AWEkDdn4`=#vr>UjdrbaWaA<`Ttgj2>TFslR>T4}D>$vy{ z{;^0J%_cil&sT8dv^$8b$_Xea@(_X0R-?l880o+U72IO$YkG<-M#kVee7pP%i3!j? z3e0yo3ND-$;O+H;&!+lp^yqjx+eF)Hzd@t35%GP^t{-A)`O10s zGFbg40MetXfSEX55a zUdefJT^c8=oJd!>CJ`8oa#R@L!5>vx^(|cCSxf(0?9EPSdI31rN*s0|L>y&mKc7(zNiaAr57y|#hGLiUcH5ga@M7?wB`cyg3 zhj$h8$KwRk11cTb&-A`XFjg}TsHcbO9;jPHLI19oE_~8Q<5fGss!^S@T#3=%2*xfM zTKhENA+5q8&9lIBE0ttFwCrlV;N+1o)Hz%6SUfU6N40aE30M}y)^cul4>fW~ ziFTTU0|Z%1NP@yXY;?#YkA=5`$hzP)3Ufc--1=*}+1-^>FaHk6B#eTA+ZtAcWg3p4 z9HjNgIS%QOJXmm0QBOdGXx}#d1htv-duca{|7nf7Z9alokmY_9LLg#a^N!@rwK=oP zhKn`FacPGsP}JVLH%sZ$vd1@Xj%k8$=YjWj+tCr6$hA{fkR}_eBL*S6NNHHv*`!6J zZnmhK))elZgo952khP7hQBQ}tD#rfT$&bMOB%Il1X`y4l8N-goQlKBqFzvHD(yX0gl2~!!t_cu(Y0MpY56*YzOlvX(h2=whR^WqXXPcLFZCCn7%#4^3- zKUyhMVt2#LnzJ20sw=Co)fRUgC2r-!iKa>U0te}+NI5(`3``bgi8!?QyKRN+p)X& zN3`aI^VdIDj&gr1nhYe@`Dh~!3iagc6iQy9|9q*HkJXYv?@NQSuC<=etR24kZ|?K? zx+^oVB?~^pDHJ!rkHi@GQjf$C70xx2#RwIU2_TyOs*$d=XAfy|o~)8=CZE8s$Mc%y zn~&4*vd}1!YFd4SDX&JX)1{U(KjeL4>o5OFv*4{rSyH3``}>Duxla6r)-B9B(%RKm z2Wl_D0BLejcWONn+>(EVZ;JI}%eJKj2$h8p3u1U}CcG%#Nd3fC>-`c|^ce_`dsrUc zOhbr>S(|^l3PC!Ld+*$(Mnd!6^`9|;b0k#RR&LI0oGffsShXuYPcrr@2}#d3X^(6_ zy{YpFrNKXP=EDa%Tp%Bgeteaan}5^;qVZa+_M5s}cgnCojwdHgJNSYE{#+6zPYf@S zxD9{jdSY5+{>BTMx*ZtGVzm3ZeBPnwG^8_HOC908oN}bqex;En$P92|p8O;-{EdXn zBEr85L)0~*+Qn(}*mo!{Lx6{gS#OKPk>HE9)CifnvZhP^Y^8WIwCmO3(VuM=@B+M$?L(;2!Z-BRd^!3i)a^xLOK(L`Z9EACVjoG+ zWFF6`T)gH?Fop?X9|qcdeAv%Q=6EGzO=dLSg3DO0{2);^?!04V4MbDTNOJ=Xt|&^~ zdY(+N##(hGWyrFxA<>aUMkTdO=$WQJltxLf@Y;TN?5q0WWU{68{h_L*^-vJSB&R_Rfph#La031u`8 zb_RaJKl62rdG`E{`qlFikYi2b;|kUA?+|dHnIN)6tKkJp7vehG9y;4xkBXVr%=E5s zmwK&}VTDQA&P$rA1>S!ZPtO{|`if1o(x3@-3Fh0_J8eh0lf<$tY1rz(txx@NNKkqx_=Wis=L{D?&vkHuhvqxBJ?^A>9?HI?Av8pV_eSX z={)pBbFh?-#TLC#*!aJZZS((_Zu+8mv4Q`~nwnt<)BN`SFV{DmFy&z=99{52`Hu8{ z5?potK2!M5_nf9yMY^4)cDhddX9^8I9siA*OMSlZN|rDF(`B$srgihX z|5fPd{mzN}$$y;xGsM}I?*IG9|DuD_`adKzKdwVce~ud?{ST?%eEMSyeY5*N#Qrzb zrr3a#7R&t)?{Amaj#$6c0{+*KZ)l*|aY%RZaQkW3yFqy(rvy8bfP;lw0#)pKwG8M2 zD2Fb$gdd7NgCz<(Xb$3Slpg9=nA8j{*JI>g<5S#19!6iH$^JP-eq<_X@f~vH3qPQ>yr59eCtIVDNe$$Wo6O0j)zyz1K&rJB=aKCGff6;7m=RY(jEJM zoF{;S0$UAp!qU&0k}pjHgv+5#9ObD>@Cc zt>Jk^NCp@SLw+6Yv#FWXtiB$uJwk(w}-QD8}3F#qJ{<}W)X_5G%|fL z)C0ezUk5v!*-DW2bIc_!)K4!gk#F5RMUut)&h+m7x~wsTr_S%Mf-ChnLm+2ItVM4q z4>#NMHzSPGZd?d#7`im+Ux>)R-1k4*=aa@^n@BjIzMkKA_66*+sxnl~;~i7bH$ik_ z{*dr}og2vINo_om`o6FBOjj7oyQWiX9jLpuF|ke%0%&#UceuH$lPz3tj!{c2Qz5n8aae zyXlv#T3{Dor*NdqRp*8n!(99$V^^3|{UFl%vP*3h589^Q>UrLgJ)k6>V*gaj4qg;| zeqKxcclvP%2E#X=CIie|hzN7e!5fV{%!tGdTPjKCWu$lPPX#ww@4E`Rf=Wx^m%oI% zqg#%AQys1w-+t=Hg4#pT3_!G<%DZ{U{x3Qf%1MoP-g612iUUHL0_x( zeJ*T2I0MdkjO|_}>I4?U|Kv!~C;pY}CZI1!EepM_(udLa6HYx3+9n(^JA0edAEs0X z4<~0-J7&s&&Sb0Z=yht7Ov~r6SttByD!`Sa^?!Q1tEf7@eofR!aEIXT?(XguB)9|( z!QI`1y99T4cV7_PU4zSl;J#M#|MvcN@9uNX7-#fF*Hz83QCG8S)-!)^^>;JM08i!Z z5pvX7Os%5YgJ@DO;#lr~;R<>)-TnNARBBz0Gsk7C%~YxK)8wuLn4rYs2Ch_K=$rNj86paa4)zbC3BJymTlE&49y z4n5LKi|$uP0F8RSp-x^>AIJ{P$D$&-beOd7B}I0tabH{lW(xJAKK4t^F_~J0h?ucK zP;b>Qd|@R`fsZ(Z)^oi7H4OoL@O*o0Oe`!c;19a{o&0@9wO2q$#QWyriP8B_e3t-$0VJBY~PIfRW4 zmn(@XF4rb`y=kT59r0;X1Jgm1^LkHH>%DL9E1>0B@$R0nRvGwIJB9WW3U`5`$ojoU zc;jcY)S#HaD=Iubmg6z;(L z6Sy+co-f>i;7g8}@_|m=?txA|u^uzMVHqxU1G5<2UPOz!XMr)=Xa$kO_qXo#Xzhel~G9((H zf89bV8TMmyWtSNFm+9Tm%X$vPclY2$@?eiuoK}0w=0${zSx$%u#Mu zp}Dod;CwSs5;{l4Df*%ux@iVjIpi{oIo>=WYf2&gG+ z_kaSiXYmcPYYS(10iTO*Nw~pwwQec-$6CF&Z7$kkbrQ*!MhVHPQ3tCW4I3V%5i`Z* zaawQMwP=j%MWl+Q42yY+6juTv94AF9bNzti>U|?5FmH0F^HC@7)#H*3=<4L;xv2;n zboKZ2wkQt#ia8^B6W|upuqq*fb=ww~g*N&WChpIuWc*|uyH_>!BWw+6$B#s&Za+jo zqBlT=870Hy;WC z*O3!>sbE(|Le_Se@K3B?Y!ktocUrcQC4>0Qk(nuNMoTmA9_&@I9!5x})~qtzk7_Z` za9u46KcG7DE#b*=*!_WkK!WC3n;-(lXG*e+Hl{}A)P+UaP6K8EKQkYfkH_p%M8_uP<*@WaSS&DU1?YJR_PcvBQAZOWyI2$P81byh47rgp9=W=k z6604PTh%BDJZu79K9gq#2>}p&gI^N)Q#ntt5UEUJy(p)bD7z!a3opM8^4*!W{0SP| z{ArJ_Oma%0AY4wvD{N^Q!P_&+vWPtS%0%rB2%y?TuN~>Fu$3odH4BF0(VlN4830h) zhJ+Z8c3Jl}R4qtD<^CZc@5aHyjp>)xXtYQ>@&X*;^d)#w{(%2p1;*QAwdeaNR(}@7 zsqQd^c6?!&YNYI9o}|uTsqj>vB-HVIeWG|Bi|^6{sY@aIF)!*!X?(7wx3%TO<$|(z zPcG?e+A=SI#9jY_0qr<}Oi(zXZJY4WS=-N+81BmN^uu$xLSvnyq9W-eU4`OyxWb zw#0}Wf7ST@u*U^)B;&I8?15>Q^BbtE%A4>mVCuyh(*NN-f{0&{Yk1$Sb<@nIfBZ%73G0_`M{@ykKWuneCMo!rK_7pBOH@Ur zRHB7z%-eQ$6cm-}uhRYpl;5h8c>z+`>PLfLLVj=|ov)-3O_s}X%79+lz$Oh?1xd_? z3coUxfMs+2BfPiMi)65X_G6z3Q@-~{AqLI_yH6ZbOt`XN&HJ{xJs7s?!~Qmt8{Fm= z$`3Bcm5WWds;9AIVYTWNjgz$vu7y)#f?LrqQ-)!Cj`4p4%NnE*g&w=!EC0-8WM%rM z?O!Qra%fRMxf7f}FPwMyBOQ!MPviSi0ktawzM{1OiAK=U=Da;p=SHM~g#f;mkZe+u z5vdTyVlx;R=*ChOV!Tax`$jMSB9Q{*ISa_moV8jV*AYBQ&@>FI;HAThXB4%RVCX_#Vz zdRvC#+aO&`p5o$8CbpjHRAMd9&cbyth4WZ^olwx3`_TEU+YEJv111HtD0A1w$WM z=WMKL5qHOKb5tJmq#NO!ZjC&n6713(*>+n>;-_qZarhg+lM4Xwp}J+>#ajdaKYjdM z@>g*De%Xv5=t@xtZ30XV@YUL`lNgUUc$Jy&I1UraduJcK8bDt5>>=_wdFqavIe+Rl z=FI!9`o1ibYv(H(cNqmXBi!+{Qse@|SxqCxvLkv;& z!$V zLtT5KB1~pW%E`*eF8Ik!{F}gyp9n|%GrW`T;7t;~-9*r?do2QKLn@r5gY;mQbIfIq#`<8tmhE{iE9jQ)RwP}?f?S0FQTlC>S!|kFS za%_x%*`hW4}; zH$%zDr4jgb$wA869-d8UlY6!$lI4w1>mFz(strO+=jD2p4MU(=db28JP#`&D|Js&j zqgb&OLjnmz1qod@ESto1CBmZR<}A0;H0Ax-!KH8Ipd%FCrJ1UPWO_3L?a|q#H_1?X zRlOe)+C2lPp=RjG=vygm9iw_H+L^`iM7DvxJwy@o0hN$HO_>vOa+!wF!6~6 zp)ST^_ZsTw3{D;hLun4-rI3Saabb>m9I^9Nq6yh>IKNoe@j|VnFmMNmr!+< zmn#?zuGpphA7P%#rgeSf!=hN*|mu5vzwlNtrBfYSQSZeyN z(}S*$wZEquAK?vsVLz%Tddod-mk($=s#`rh^$${Q0?o|DY<>kieG>jw_3<`xdj0#l zY3Z#lLN*7ygX=}24sMHL&r?IglbnuNfa{D2%Q&)-X4dg(DbGf8YE*QQ6Q6W^{=ra9VqvvgIZCCZ&V@ipJ2uOru?*>gOFhLvi{W+*RZK?<=@^)vcpYr1AnSJh95#E+g4v{8eQ@J)>sfJVNpqJ z-5%aZK}XoZow9`e8{a_F<`NOLJTO)>rN!IeC#*pY3aWd{$pR(Vg3cxFWxKbBQYZmfju*11J%cz^!`?JKI#@VzD8hWjk z#B`|ATR%<4cI;M7xW)ChwyY9%7QKmbtL(^0qi4So)1Vk+YZL!95wNu0EUDSAxfCt= zFYNjvVZ=|YB`Bl9Xjml>J?LkXm;c6){G~>-x5=+dH~AW~%z$Rs0k~Y(QN1KsiwFzV z@~ToPK)dNscmo>XvcS;%)kUDtt7RN%Ui&G)X4E2<&S!*sAOtSoPSGFt0w;HKogym@ z1R2dQ0%vL&QL1wj(uCHHxb;BW?F$YMYp@qlLx2o7$AmL>;MF;kEqKo;{abEcy8#!aFmKb%` z5=kt9(O%a|mxk$1ev&J54(1l&`souJ!_KNrPo*fYkzGtOamO@q(Ls4jDhH36XnS#B zEYPqIuYmY|>$!ZuDB>T|`qht`2b^DB+OSv4@r_P#f7+yM$O&kb>d)aH$!7z>a&1PL zIA_S!>NvV+VpF-X^Wbw@P+RkA+N6JdFHr4aBj8Zv5i8Zsol^Dy00dp51wY8ERs%&C z@gP#iZRI7Y9@==dMGK^=#%}S_Z?n{&RWOwwhlVy{=b=UB!!oG-dieS)iSHlM5UA;wyzI%$0{pjodgDK$=ZFl;r&d*(7i71HTL zlDt-UMY$vSsM*4*$%)scxgvQyzeVYf`RgiQ==*Z)j`#FyW14+zQ=SRVmR4_hA7DOj zmdwm3TlAppL-{uE_Xn(iKMpkqyAmt_vEolT(3kal(k`Bn-%#RK^`P{z3x6rz7x*;F zE3DehOJs0NdVK#WgPY_iOoTFo!$F%MjeM0&-`cmvF25I${zUozW?8Vjt7kt9O**1l zv77V0LAH<3V5Q-ihh}@`LH4+Uym$M))PCD94*Lv!JiULRtaG{gZ_Nr6I$C|UJX{ly zs=QIiW71za|LHKpwWJso!2Vy3Wm@9=6&{iY7ud4*D#{0Hk6cucx0Tg>;}O^8;rI7p$1hM%uZsMWUok5Rxh%gm#hf71PT z+Iw{~BUxXfH}`~Z#N75psQONmPviuKii1z->H>c?jW?#OSmi$7btIY@NmnxK9z|}A zg-&~iABb%#xG#^Kuk_Egy+*6c*owdp5l>_?q(uh3J5D9W2_ z0T(gu_|8@)z~*t`UnF^0a{mEYbcJ>Xxc>!N#&2ca$h&g3TJZ^g9fO9Nu+t2CurpTD zi^2)BCS!hna^2HlMfUvPG|Ok{|3kBK%~};>((3uz8&oIa8a@kNyZ8-+|Yz7%8D|y18NYhBK=iJIp#yFFQ#Y300d2 zFH~N-J-S%}J5xE!<7t754xo{*g90ZO;fVG^9y2<(>+Rb&tt!lhUi8tK%qix?|Ls}J zP&{PUnq=L~zHPlxEXeKQahY&|3){-Yzw*4T!0Eu7nKBFJ>Zx%WDTWM$I}`a}hBl-Z z!ri{h4QBr>*aaXy+#j5m1c@B|^C7nm?D#&E)U{O%)uW9qzmL4T_*SQ4_CitWHhJ7Y?gup?N>9%L(T}w6AuP;pIZ#R`7a_ZsPZ$V-$8m>2|@s!vgb`gXA zS?MY=Q&LMbX3vb91GE`*ksRIinZWKU(p?r&D@Ig#*R{GMGBu@`d*1RYwG%?fnlzq0 zOKux@;EVtgAr?_s53IvEOTv89PgU+hW3ZJ79Ggh6rT*xo&z3fD~n3qA3 zAc;Vl{E9}!S=%xOa`RWgG7?XHWxz;fe$ROtGcm_;N)^C4c*!hGVNirX+UEZ^ZOQZ{ zjMv%p#^(lX?1EMeqOkKGG+uSbr$El*r?u_XFl2u1jDAycnssFX>tcfQI>;OdX>kc?ZoBKzb)$njQ|}Vy!2sF z)6wO(6ldL$1bNfZbgk?EZVIp#s>=5Nx7N{dxO=fLaX?n4Eea z1~=Qd6Ps{(2XS4K*G~%u0#fhN6^1$271*dgv-)WEf-4;JtT{UDqY&CK#@}z^=(7>L zfiPGLQqvvmX}->+6&RL{fe#GZhn!BKJ$J$I7$YU0mbg67lD^w*jm{vSqosm-DC_O9Hb_aLWbVY!GJrf|K z*^BrSnlmq15ho?em07@f%{$wi%Y&-(LeU8%Hvmli5HPft@J1NHS@})Gs^~6pm?VHk z?a`(zE8f*$dSp62I(&}O&|Z}EM1Us*Pi!mOQd2aTWLux$BR!;pC8D4-*al`{2NG%o z{wj~rEhk%y(b;S_pbsnzT4?R~C2s+Xpe;Xu;`n`)ZhpTHv~-u*Y$!U|77sknW;o(o ztw@r#=U*k1Y`RdJ?Ef?GUvwqqB?A}0q84STn{VGB`v=>e6cJzTIcU8oG-CbrQ+TNS zdT8}dN`ZMYEl>Dqth!~=%G%K-ebpi7^wBIw}6+Y$6pjZg<=ea%Xbsc#Vt^i~Q zA`JVDNqoHPjrh*{#Q3gcaIWV+B=um#yT*Y&Kq~GOmSJNdw)jc@vkT~TJx8q~a(8XN z*JDt1Efgnn?h~#>Q0YA1$`7iJrs9jirQUiC&r?uy!~{lb<2;0SYEb8DEaqv74Id-) zjrOSAs@D?+XxYPjox?mI;t|>uBU09YN_UQH3!f69MTx-I_+H}gJXWIt!rg!g zf?~BwH4mero|d44ff+KR7HvHbQTY#wjX+GxizlSvG6CLdyq05{4r*70juSy5F%*Ay z+4OaO@!N8;R(lP_@yl;>^jH}~LM~Ghf-5-*;O~k<=U~>tw+2%^RWrj$VyolwemsrZ6VWpy` zyXI~=#0-5b$z`g0;18dw0teh&oUCcfs>a9ViTd3ftlcKpp~j=d=L&;lLj&G_;9m2}1sWiP><^X|d2&At^jj#Bt8Xs7xEIwWjnM zJ2Zp8AF-5`YXy#&sXiQU8BTVf#+yIbE2Zw$A!}rryQX^PnqdwX{Hn#&Y$fXx3WrDm zXOHms?IX-__37q-Ba6xE$xJ>%!?&k{%7@#|*E)|{cO&~HE9ei6X0@_(@RIe?7H(vG zAy~11_32oV13v<}a^hhCXuC?A>bhrI;mLu~lkB8ig>^|--#CNl(1LI+6nwly6HNzF z$fKy88J_fJ`UTp^n!4=7Ga6ed?B+yN+bS%W>FeI4|%<`IP26sQa&!OAHtTeH$vl> z8D_9WX^*L=1wQ2RI2aolVu`vkWf1Hc`IT2O*F)@^{=xswMi{CDs(IZ zcWQT#&`k$Kkj_;fnkVl-KY+<;x`0`_XmWsvM1@9L1-6orENtiN-Vc|X^i@JzW#)TZ zrNu8)nQosl#8#5@rMih!tg&FAG3!+29{W+T%210-wv2uFQel$oFHW2W1zwKWK6wC8 z)Gu>q|L08ry@d7srABPUqn7)+FfD+hHFKy5yr zQ1nXhUUjVb7hxgXu>fU?11RP0Qzw83(9HXye5qsE=e+%mm4)@9;g>`+bqf2ZDAT^o zzx0WwS2kRtGZj2a;)EN4^rpuU?s2npdFEkuyskRqThNF!V?3)KCE1}NgJk1--bSb^7FV(vI4J zH}0=(HG;4PQKn02p+(z`hd(~ax8e(A-%P|a(NE%V)>d`1?oCFtzjJ#{!Q|ZruqBNP znmlDEex8eck(7z@t+X1C)TFY&ZxZ|~YpRnL7CI)Eq#z-Wc2khD^@`?=y`#7Du1T}* zT$6@12Pbl*NqT?@cKO@lf%Zoo`CzzEuOo4w>Ixk2kXy&^r2qQpi>Q24&uSyL4r<)$ z#$fyT9pMSivMom?0$V1~GFF;8i^hZYv1w;6(RQL$i7X3fcQuTbiO?D!7Z*1jKa46}XKPBz({2KHzK7|hR2)WN+C%~bi=d)m(7U^o`zY@DJ*hFow3XBaFrzkO92((eRFB)K~fbp zBw-N+1hATy)A~J{*_k{Yv&wFCXN+k6=xCKN8jWYkX9;)t0BA+O+l?PtcFFE|3lG@< zyV%>)D?k&~b}Dd(^Xptuj-xzLG97|O5cp$EpjIMyXSp?3FG}csxf!*EY`={y(8H$< z`!QxuU4H#x@g^3pulrffqyG~@T4~hSEQ&}hfE0rK3J|WG*QC7lqP@Sh2ZXy}qglq1 zKskH9o>ODhH-cQl1aL)5OfjkE79gngR-`n3kx4zy&F7t;kyyjON%Q+dTDo%Sc>;TB z&O>y+2?(oKC5BoMycKen#msZ>~KFr|*Fmd!eN=MV@ zH$f}PfUiiiX>TT%z{;y?O?jmp{@5ItL)9P(dH8(Oq~=N(ewg|UD(r7-va2OhG>@q~ z75XY3TohGFZB=9Ix=h8+m$C;WexdwDBxQo|tGiMYc+bOWjujfST&0iYqdXY^tHH+j zR7nBS`xD$BaaqB{H?Qb!2qoySNcE}|-tid(RIDt&goeq_o{S8KSt*_S%o3X*hK;nw zZB`@XU*?B=ir=%`89W6|$>YSf&mZ+n-;bER_u-#cK=7MoH+3NKspqLHxcbr@gE;dl zOx{J$TA7t&HVrFo7{Cvv%1fhKZsaC9E#O~;9@Ci^?bhrXzU@c@TnqXq&mcZUEWUH3 zFR?3!2WOk+?UiXGjB~e|FK@qN%GjCdM{#!r`QJ>Gw1sr{`J$)Tu!oCnMjtuSz2k;h z)nyb$QBBp|>DSIb<;b%UbT#d2_YJs~Q)WVk#n}HAOw$F5G{ zFs$Qk-RI3|=L}fP`b~>E!h${g9qCzy(>jk$*|qJ<&F5GVx9)Gtq_N-m8&F3MRF#rN z_Ir^1IYs6n_?M3o!U4wi-|uwZXvC?~05F}s*Mt}S)BWdh92&EP+mp3|TWFW{9(0Fy zfU@f|J#1;<9tZY?T24ht3!-#`;u6$&d12Bca16CHxu2M{1==C^BKw5lh}ue8CA+#>j$qa6N;z?NIL>y5*t2g^Nc6-2ZS(gkFn;TI4KMQM_2~5O zmkSd|RWu$NMU~<8XskgGKI@D)zc)(l7A|`W6Pp70ulYRI+V%gh5ta%vlW@TXch1?AI zDOr>NtbDO@Uh+iLRe1VkMZ0DvqyMs0nct z{7A=h!Pm|l_wRFje9lOhEVP|M?sW?42UE*@CXP`-IhW!;*g7-YNw*qs-vmzM3?KQ{ zQC6)f3*dxRxwIH3@#>dUQ*iU3?QrjdUHj^Wi z6|9D&ijr(~4AcnbY<3K+o~z`B|v&9c>Mv)h;JVWHmuDplN z=Ui8l31x2%4$8$}Gi0Dxf8x&Q60jcBs@X-xNtke<7(qm+{UQn;zTNywL2LYz+k6D= z>n+n}srE?(SdbU(QPx$~lp=Iyt=oAxZd02PsTwuDki5OfomO6W7s7;y-^k1Ru>5Ak z>y#zs$6mQC#oO%NB<2F$A(f8eZHROY3kEFG6#2N!DZ$OiG*7X5m zk7xk6*IBYMhVj$3*OcEj@04Vb3`R~HuWjOTJRu!w+{tFcPPzvE$XrMX@QW9GE&%9b zq1{4(D|FrDpAx-?kg^7`3HVX=pI;an3mH=B!naeWEk_bXPEGoQ7;@!q$TUrt zUJNYZp{a!Xkw)mansK&B^XWvF@z59}G|6--DUAL;3^o(@`n$PCT%6%$)JfrYLsM+9 zgi{lp%6CWF)=KMgjK3CbKO&ree}2?5aBHiQRDDx<6pS}^;Lbi@6aUWV3fGglB8nJ& zmANv&9%t$L%ry?WsO5YH_rc5)GJ)g}MyU-qhz^By#zo2Zvr0@b^&g9kL;-7r$!su4K4=96D=!xANLbIic?~+uk9nEFfP(;*!m|DwX z+CZAl4Pu;KNh~<>)ycuG;Rz!~XmJ%DFTgn|X!S3juH>OCRygV_GPlXy>cZ7{Y-5HXQj7*(r28WI7<2)g`Gg>ThH<7sV_Tu+dW;rHQ;x~ zTH3P!7ZpB!e#u;c&*6?*?i0FFH=DmO^ytnUcXG=K>iM(fp89hV0boA3Kay~#vC=GzAT(%AM|G?SSAb%xyMRZaTIWlRf{#^ zlp(m_P?0leO`AHpUz-+bLq(8dNIWL!%ww1rFAG+PT>e%Pf$aR|k5V zNU^2Fqpk&?Fc=ll>92pQ3TD#}DgVA!;Xg)-w8SN}=;gKr-~VJ@bfDMa6LWR}W&i7I zR9=DV-#sWXI~3wc>aVd9P`COFi{pFJ!CF_%!lCN%_EVNJ*z@|&`x{s#w zJN575gwv~3x@8E2wXo^9kt?C2JT}i0IQYp#u~w8W*g{FSqv0c5CI(`Mq>30hZjPw!MlQZ4_ z3wCAflC=j6d$H*PVe9u6e@@T3c3S46&Pf=mYxNwxZQ7N`My=N2iZO*dG3bi-YAL8{ z_rzY%!%}UM?+zyKTnWd*>>ZB6pA$O#G9>dxii7=wdrob#KmeX@6FE**5#{V?aDvTI;|7FB-Nh7wz)A}m@FRbC;;lMEoZAiQbc%7Jh)FMs%Z^`(wEatbh48X~d zEgR9dtuY>8g43WB4xIfAC67bZz5$Q~X+hb2x$Co$ zb4p3aPorhf#Gm61phq{z6LMqk+u@A_jeIHhB88C#AC~luZJ7ARAX&VV=8p$+_7Q42 zg1X)*ig>4#WA0+Of}+~B$wx7v->4_QHq{KR69?74Il28gDVtbeFq`+CRK>j7_2N;l z{0Sjo{uF%6YnYQ>I1sQQ=-1QxXb}t6G`Mky{UnS5=I?vDF2n?Td4MkeaD#5O4ZhN+ nPc%mLTP2v)74F}A_ZZc!oRfOL(|-Kb3~VlPt! host communication. + # If left blank, then the interface is chosen using the node's + # default route. + canal_iface: {{ .Values.flannel.iface | quote }} + + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: {{ .Values.calico.masquerade | quote }} + + # Configure the MTU to use + veth_mtu: {{ .Values.calico.vethuMTU | quote }} + + # The CNI network configuration to install on each node. The special + # values in this config will be automatically populated. + cni_network_config: |- + { + "name": "k8s-pod-network", + "cniVersion": "0.3.1", + "plugins": [ + { + "type": "calico", + "log_level": "info", + "datastore_type": "kubernetes", + "nodename": "__KUBERNETES_NODE_NAME__", + "mtu": __CNI_MTU__, + "ipam": { + "type": "host-local", + "subnet": "usePodCidr" + }, + "policy": { + "type": "k8s" + }, + "kubernetes": { + "kubeconfig": "__KUBECONFIG_FILEPATH__" + } + }, + { + "type": "portmap", + "snat": true, + "capabilities": {"portMappings": true} + }, + { + "type": "bandwidth", + "capabilities": {"bandwidth": true} + } + ] + } + + # Flannel network configuration. Mounted into the flannel container. + net-conf.json: | + { + "Network": {{ coalesce .Values.global.clusterCIDRv4 .Values.podCidr | quote }}, +{{- if coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 }} + "IPv6Network": {{ coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 | quote }}, + "EnableIPv6": true, +{{- end }} + "Backend": { + "Type": {{ .Values.flannel.backend | quote }} + } + } diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/bgpconfigurations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/bgpconfigurations.crd.yaml new file mode 100755 index 0000000..589c3a2 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/bgpconfigurations.crd.yaml @@ -0,0 +1,144 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_bgpconfigurations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgpconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPConfiguration + listKind: BGPConfigurationList + plural: bgpconfigurations + singular: bgpconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: BGPConfiguration contains the configuration for any BGP routing. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPConfigurationSpec contains the values of the BGP configuration. + properties: + asNumber: + description: 'ASNumber is the default AS number used by a node. [Default: + 64512]' + format: int32 + type: integer + communities: + description: Communities is a list of BGP community values and their + arbitrary names for tagging routes. + items: + description: Community contains standard or large community value + and its name. + properties: + name: + description: Name given to community value. + type: string + value: + description: Value must be of format `aa:nn` or `aa:nn:mm`. + For standard community use `aa:nn` format, where `aa` and + `nn` are 16 bit number. For large community use `aa:nn:mm` + format, where `aa`, `nn` and `mm` are 32 bit number. Where, + `aa` is an AS Number, `nn` and `mm` are per-AS identifier. + pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$ + type: string + type: object + type: array + listenPort: + description: ListenPort is the port where BGP protocol should listen. + Defaults to 179 + maximum: 65535 + minimum: 1 + type: integer + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: INFO]' + type: string + nodeToNodeMeshEnabled: + description: 'NodeToNodeMeshEnabled sets whether full node to node + BGP mesh is enabled. [Default: true]' + type: boolean + prefixAdvertisements: + description: PrefixAdvertisements contains per-prefix advertisement + configuration. + items: + description: PrefixAdvertisement configures advertisement properties + for the specified CIDR. + properties: + cidr: + description: CIDR for which properties should be advertised. + type: string + communities: + description: Communities can be list of either community names + already defined in `Specs.Communities` or community value + of format `aa:nn` or `aa:nn:mm`. For standard community use + `aa:nn` format, where `aa` and `nn` are 16 bit number. For + large community use `aa:nn:mm` format, where `aa`, `nn` and + `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and + `mm` are per-AS identifier. + items: + type: string + type: array + type: object + type: array + serviceClusterIPs: + description: ServiceClusterIPs are the CIDR blocks from which service + cluster IPs are allocated. If specified, Calico will advertise these + blocks, as well as any cluster IPs within them. + items: + description: ServiceClusterIPBlock represents a single allowed ClusterIP + CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceExternalIPs: + description: ServiceExternalIPs are the CIDR blocks for Kubernetes + Service External IPs. Kubernetes Service ExternalIPs will only be + advertised if they are within one of these blocks. + items: + description: ServiceExternalIPBlock represents a single allowed + External IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceLoadBalancerIPs: + description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes + Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress + IPs will only be advertised if they are within one of these blocks. + items: + description: ServiceLoadBalancerIPBlock represents a single allowed + LoadBalancer IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/bgppeers.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/bgppeers.crd.yaml new file mode 100755 index 0000000..bdbd2ee --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/bgppeers.crd.yaml @@ -0,0 +1,115 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_bgppeers.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgppeers.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPPeer + listKind: BGPPeerList + plural: bgppeers + singular: bgppeer + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPPeerSpec contains the specification for a BGPPeer resource. + properties: + asNumber: + description: The AS Number of the peer. + format: int32 + type: integer + keepOriginalNextHop: + description: Option to keep the original nexthop field when routes + are sent to a BGP Peer. Setting "true" configures the selected BGP + Peers node to use the "next hop keep;" instead of "next hop self;"(default) + in the specific branch of the Node on "bird.cfg". + type: boolean + maxRestartTime: + description: Time to allow for software restart. When specified, this + is configured as the graceful restart timeout. When not specified, + the BIRD default of 120s is used. + type: string + node: + description: The node name identifying the Calico node instance that + is targeted by this peer. If this is not set, and no nodeSelector + is specified, then this BGP peer selects all nodes in the cluster. + type: string + nodeSelector: + description: Selector for the nodes that should have this peering. When + this is set, the Node field must be empty. + type: string + password: + description: Optional BGP password for the peerings generated by this + BGPPeer resource. + properties: + secretKeyRef: + description: Selects a key of a secret in the node pod's namespace. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + type: object + peerIP: + description: The IP address of the peer followed by an optional port + number to peer with. If port number is given, format should be `[]:port` + or `:` for IPv4. If optional port number is not set, + and this peer IP and ASNumber belongs to a calico/node with ListenPort + set in BGPConfiguration, then we use that port to peer. + type: string + peerSelector: + description: Selector for the remote nodes to peer with. When this + is set, the PeerIP and ASNumber fields must be empty. For each + peering between the local node and selected remote nodes, we configure + an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, + and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The + remote AS number comes from the remote node's NodeBGPSpec.ASNumber, + or the global default if that is not set. + type: string + sourceAddress: + description: Specifies whether and how to configure a source address + for the peerings generated by this BGPPeer resource. Default value + "UseNodeIP" means to configure the node IP as the source address. "None" + means not to configure a source address. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/blockaffinities.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/blockaffinities.crd.yaml new file mode 100755 index 0000000..dbaaebc --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/blockaffinities.crd.yaml @@ -0,0 +1,62 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_blockaffinities.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BlockAffinity + listKind: BlockAffinityList + plural: blockaffinities + singular: blockaffinity + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BlockAffinitySpec contains the specification for a BlockAffinity + resource. + properties: + cidr: + type: string + deleted: + description: Deleted indicates that this block affinity is being deleted. + This field is a string for compatibility with older releases that + mistakenly treat this field as a string. + type: string + node: + type: string + state: + type: string + required: + - cidr + - deleted + - node + - state + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/clusterinformations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/clusterinformations.crd.yaml new file mode 100755 index 0000000..2f25897 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/clusterinformations.crd.yaml @@ -0,0 +1,65 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_clusterinformations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: ClusterInformation + listKind: ClusterInformationList + plural: clusterinformations + singular: clusterinformation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ClusterInformation contains the cluster specific information. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterInformationSpec contains the values of describing + the cluster. + properties: + calicoVersion: + description: CalicoVersion is the version of Calico that the cluster + is running + type: string + clusterGUID: + description: ClusterGUID is the GUID of the cluster + type: string + clusterType: + description: ClusterType describes the type of the cluster + type: string + datastoreReady: + description: DatastoreReady is used during significant datastore migrations + to signal to components such as Felix that it should wait before + accessing the datastore. + type: boolean + variant: + description: Variant declares which variant of Calico should be active. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/felixconfigurations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/felixconfigurations.crd.yaml new file mode 100755 index 0000000..a1c3d6d --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/felixconfigurations.crd.yaml @@ -0,0 +1,565 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_felixconfigurations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: FelixConfiguration + listKind: FelixConfigurationList + plural: felixconfigurations + singular: felixconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Felix Configuration contains the configuration for Felix. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FelixConfigurationSpec contains the values of the Felix configuration. + properties: + allowIPIPPacketsFromWorkloads: + description: 'AllowIPIPPacketsFromWorkloads controls whether Felix + will add a rule to drop IPIP encapsulated traffic from workloads + [Default: false]' + type: boolean + allowVXLANPacketsFromWorkloads: + description: 'AllowVXLANPacketsFromWorkloads controls whether Felix + will add a rule to drop VXLAN encapsulated traffic from workloads + [Default: false]' + type: boolean + awsSrcDstCheck: + description: 'Set source-destination-check on AWS EC2 instances. Accepted + value must be one of "DoNothing", "Enabled" or "Disabled". [Default: + DoNothing]' + enum: + - DoNothing + - Enable + - Disable + type: string + bpfConnectTimeLoadBalancingEnabled: + description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, + controls whether Felix installs the connection-time load balancer. The + connect-time load balancer is required for the host to be able to + reach Kubernetes services and it improves the performance of pod-to-service + connections. The only reason to disable it is for debugging purposes. [Default: + true]' + type: boolean + bpfDataIfacePattern: + description: BPFDataIfacePattern is a regular expression that controls + which interfaces Felix should attach BPF programs to in order to + catch traffic to/from the network. This needs to match the interfaces + that Calico workload traffic flows over as well as any interfaces + that handle incoming traffic to nodeports and services from outside + the cluster. It should not match the workload interfaces (usually + named cali...). + type: string + bpfDisableUnprivileged: + description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled + sysctl to disable unprivileged use of BPF. This ensures that unprivileged + users cannot access Calico''s BPF maps and cannot insert their own + BPF programs to interfere with Calico''s. [Default: true]' + type: boolean + bpfEnabled: + description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. + [Default: false]' + type: boolean + bpfExternalServiceMode: + description: 'BPFExternalServiceMode in BPF mode, controls how connections + from outside the cluster to services (node ports and cluster IPs) + are forwarded to remote workloads. If set to "Tunnel" then both + request and response traffic is tunneled to the remote node. If + set to "DSR", the request traffic is tunneled but the response traffic + is sent directly from the remote node. In "DSR" mode, the remote + node appears to use the IP of the ingress node; this requires a + permissive L2 network. [Default: Tunnel]' + type: string + bpfExtToServiceConnmark: + description: 'BPFExtToServiceConnmark in BPF mode, controls a + 32bit mark that is set on connections from an external client to + a local service. This mark allows us to control how packets of + that connection are routed within the host and how is routing + intepreted by RPF check. [Default: 0]' + type: integer + + bpfKubeProxyEndpointSlicesEnabled: + description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls + whether Felix's embedded kube-proxy accepts EndpointSlices or not. + type: boolean + bpfKubeProxyIptablesCleanupEnabled: + description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF + mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s + iptables chains. Should only be enabled if kube-proxy is not running. [Default: + true]' + type: boolean + bpfKubeProxyMinSyncPeriod: + description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the + minimum time between updates to the dataplane for Felix''s embedded + kube-proxy. Lower values give reduced set-up latency. Higher values + reduce Felix CPU usage by batching up more work. [Default: 1s]' + type: string + bpfLogLevel: + description: 'BPFLogLevel controls the log level of the BPF programs + when in BPF dataplane mode. One of "Off", "Info", or "Debug". The + logs are emitted to the BPF trace pipe, accessible with the command + `tc exec bpf debug`. [Default: Off].' + type: string + chainInsertMode: + description: 'ChainInsertMode controls whether Felix hooks the kernel''s + top-level iptables chains by inserting a rule at the top of the + chain or by appending a rule at the bottom. insert is the safe default + since it prevents Calico''s rules from being bypassed. If you switch + to append mode, be sure that the other rules in the chains signal + acceptance by falling through to the Calico rules, otherwise the + Calico policy will be bypassed. [Default: insert]' + type: string + dataplaneDriver: + type: string + debugDisableLogDropping: + type: boolean + debugMemoryProfilePath: + type: string + debugSimulateCalcGraphHangAfter: + type: string + debugSimulateDataplaneHangAfter: + type: string + defaultEndpointToHostAction: + description: 'DefaultEndpointToHostAction controls what happens to + traffic that goes from a workload endpoint to the host itself (after + the traffic hits the endpoint egress policy). By default Calico + blocks traffic from workload endpoints to the host itself with an + iptables "DROP" action. If you want to allow some or all traffic + from endpoint to host, set this parameter to RETURN or ACCEPT. Use + RETURN if you have your own rules in the iptables "INPUT" chain; + Calico will insert its rules at the top of that chain, then "RETURN" + packets to the "INPUT" chain once it has completed processing workload + endpoint egress policy. Use ACCEPT to unconditionally accept packets + from workloads after processing workload endpoint egress policy. + [Default: Drop]' + type: string + deviceRouteProtocol: + description: This defines the route protocol added to programmed device + routes, by default this will be RTPROT_BOOT when left blank. + type: integer + deviceRouteSourceAddress: + description: This is the source address to use on programmed device + routes. By default the source address is left blank, leaving the + kernel to choose the source address used. + type: string + disableConntrackInvalidCheck: + type: boolean + endpointReportingDelay: + type: string + endpointReportingEnabled: + type: boolean + externalNodesList: + description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes + which may source tunnel traffic and have the tunneled traffic be + accepted at calico nodes. + items: + type: string + type: array + failsafeInboundHostPorts: + description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow incoming traffic to host endpoints + on irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all inbound host ports, use the value + none. The default value allows ssh access and DHCP. [Default: tcp:22, + udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + failsafeOutboundHostPorts: + description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow outgoing traffic from host endpoints + to irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all outbound host ports, use the value + none. The default value opens etcd''s standard ports to ensure that + Felix does not get cut off from etcd as well as allowing DHCP and + DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, + tcp:6667, udp:53, udp:67]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + featureDetectOverride: + description: FeatureDetectOverride is used to override the feature + detection. Values are specified in a comma separated list with no + spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". + "true" or "false" will force the feature, empty or omitted values + are auto-detected. + type: string + genericXDPEnabled: + description: 'GenericXDPEnabled enables Generic XDP so network cards + that don''t support XDP offload or driver modes can use XDP. This + is not recommended since it doesn''t provide better performance + than iptables. [Default: false]' + type: boolean + healthEnabled: + type: boolean + healthHost: + type: string + healthPort: + type: integer + interfaceExclude: + description: 'InterfaceExclude is a comma-separated list of interfaces + that Felix should exclude when monitoring for host endpoints. The + default value ensures that Felix ignores Kubernetes'' IPVS dummy + interface, which is used internally by kube-proxy. If you want to + exclude multiple interface names using a single value, the list + supports regular expressions. For regular expressions you must wrap + the value with ''/''. For example having values ''/^kube/,veth1'' + will exclude all interfaces that begin with ''kube'' and also the + interface ''veth1''. [Default: kube-ipvs0]' + type: string + interfacePrefix: + description: 'InterfacePrefix is the interface name prefix that identifies + workload endpoints and so distinguishes them from host endpoint + interfaces. Note: in environments other than bare metal, the orchestrators + configure this appropriately. For example our Kubernetes and Docker + integrations set the ''cali'' value, and our OpenStack integration + sets the ''tap'' value. [Default: cali]' + type: string + interfaceRefreshInterval: + description: InterfaceRefreshInterval is the period at which Felix + rescans local interfaces to verify their state. The rescan can be + disabled by setting the interval to 0. + type: string + ipipEnabled: + type: boolean + ipipMTU: + description: 'IPIPMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + ipsetsRefreshInterval: + description: 'IpsetsRefreshInterval is the period at which Felix re-checks + all iptables state to ensure that no other process has accidentally + broken Calico''s rules. Set to 0 to disable iptables refresh. [Default: + 90s]' + type: string + iptablesBackend: + description: IptablesBackend specifies which backend of iptables will + be used. The default is legacy. + type: string + iptablesFilterAllowAction: + type: string + iptablesLockFilePath: + description: 'IptablesLockFilePath is the location of the iptables + lock file. You may need to change this if the lock file is not in + its standard location (for example if you have mapped it into Felix''s + container at a different path). [Default: /run/xtables.lock]' + type: string + iptablesLockProbeInterval: + description: 'IptablesLockProbeInterval is the time that Felix will + wait between attempts to acquire the iptables lock if it is not + available. Lower values make Felix more responsive when the lock + is contended, but use more CPU. [Default: 50ms]' + type: string + iptablesLockTimeout: + description: 'IptablesLockTimeout is the time that Felix will wait + for the iptables lock, or 0, to disable. To use this feature, Felix + must share the iptables lock file with all other processes that + also take the lock. When running Felix inside a container, this + requires the /run directory of the host to be mounted into the calico/node + or calico/felix container. [Default: 0s disabled]' + type: string + iptablesMangleAllowAction: + type: string + iptablesMarkMask: + description: 'IptablesMarkMask is the mask that Felix selects its + IPTables Mark bits from. Should be a 32 bit hexadecimal number with + at least 8 bits set, none of which clash with any other mark bits + in use on the system. [Default: 0xff000000]' + format: int32 + type: integer + iptablesNATOutgoingInterfaceFilter: + type: string + iptablesPostWriteCheckInterval: + description: 'IptablesPostWriteCheckInterval is the period after Felix + has done a write to the dataplane that it schedules an extra read + back in order to check the write was not clobbered by another process. + This should only occur if another application on the system doesn''t + respect the iptables lock. [Default: 1s]' + type: string + iptablesRefreshInterval: + description: 'IptablesRefreshInterval is the period at which Felix + re-checks the IP sets in the dataplane to ensure that no other process + has accidentally broken Calico''s rules. Set to 0 to disable IP + sets refresh. Note: the default for this value is lower than the + other refresh intervals as a workaround for a Linux kernel bug that + was fixed in kernel version 4.11. If you are using v4.11 or greater + you may want to set this to, a higher value to reduce Felix CPU + usage. [Default: 10s]' + type: string + ipv6Support: + type: boolean + kubeNodePortRanges: + description: 'KubeNodePortRanges holds list of port ranges used for + service node ports. Only used if felix detects kube-proxy running + in ipvs mode. Felix uses these ranges to separate host and workload + traffic. [Default: 30000:32767].' + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + logFilePath: + description: 'LogFilePath is the full path to the Felix log. Set to + none to disable file logging. [Default: /var/log/calico/felix.log]' + type: string + logPrefix: + description: 'LogPrefix is the log prefix that Felix uses when rendering + LOG rules. [Default: calico-packet]' + type: string + logSeverityFile: + description: 'LogSeverityFile is the log severity above which logs + are sent to the log file. [Default: Info]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + logSeveritySys: + description: 'LogSeveritySys is the log severity above which logs + are sent to the syslog. Set to None for no logging to syslog. [Default: + Info]' + type: string + maxIpsetSize: + type: integer + metadataAddr: + description: 'MetadataAddr is the IP address or domain name of the + server that can answer VM queries for cloud-init metadata. In OpenStack, + this corresponds to the machine running nova-api (or in Ubuntu, + nova-api-metadata). A value of none (case insensitive) means that + Felix should not set up any NAT rule for the metadata path. [Default: + 127.0.0.1]' + type: string + metadataPort: + description: 'MetadataPort is the port of the metadata server. This, + combined with global.MetadataAddr (if not ''None''), is used to + set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. + In most cases this should not need to be changed [Default: 8775].' + type: integer + mtuIfacePattern: + description: MTUIfacePattern is a regular expression that controls + which interfaces Felix should scan in order to calculate the host's + MTU. This should not match workload interfaces (usually named cali...). + type: string + natOutgoingAddress: + description: NATOutgoingAddress specifies an address to use when performing + source NAT for traffic in a natOutgoing pool that is leaving the + network. By default the address used is an address on the interface + the traffic is leaving on (ie it uses the iptables MASQUERADE target) + type: string + natPortRange: + anyOf: + - type: integer + - type: string + description: NATPortRange specifies the range of ports that is used + for port mapping when doing outgoing NAT. When unset the default + behavior of the network stack is used. + pattern: ^.* + x-kubernetes-int-or-string: true + netlinkTimeout: + type: string + openstackRegion: + description: 'OpenstackRegion is the name of the region that a particular + Felix belongs to. In a multi-region Calico/OpenStack deployment, + this must be configured somehow for each Felix (here in the datamodel, + or in felix.cfg or the environment on each compute node), and must + match the [calico] openstack_region value configured in neutron.conf + on each node. [Default: Empty]' + type: string + policySyncPathPrefix: + description: 'PolicySyncPathPrefix is used to by Felix to communicate + policy changes to external services, like Application layer policy. + [Default: Empty]' + type: string + prometheusGoMetricsEnabled: + description: 'PrometheusGoMetricsEnabled disables Go runtime metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + prometheusMetricsEnabled: + description: 'PrometheusMetricsEnabled enables the Prometheus metrics + server in Felix if set to true. [Default: false]' + type: boolean + prometheusMetricsHost: + description: 'PrometheusMetricsHost is the host that the Prometheus + metrics server should bind to. [Default: empty]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. [Default: 9091]' + type: integer + prometheusProcessMetricsEnabled: + description: 'PrometheusProcessMetricsEnabled disables process metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + removeExternalRoutes: + description: Whether or not to remove device routes that have not + been programmed by Felix. Disabling this will allow external applications + to also add device routes. This is enabled by default which means + we will remove externally added routes. + type: boolean + reportingInterval: + description: 'ReportingInterval is the interval at which Felix reports + its status into the datastore or 0 to disable. Must be non-zero + in OpenStack deployments. [Default: 30s]' + type: string + reportingTTL: + description: 'ReportingTTL is the time-to-live setting for process-wide + status reports. [Default: 90s]' + type: string + routeRefreshInterval: + description: 'RouteRefreshInterval is the period at which Felix re-checks + the routes in the dataplane to ensure that no other process has + accidentally broken Calico''s rules. Set to 0 to disable route refresh. + [Default: 90s]' + type: string + routeSource: + description: 'RouteSource configures where Felix gets its routing + information. - WorkloadIPs: use workload endpoints to construct + routes. - CalicoIPAM: the default - use IPAM data to construct routes.' + type: string + routeTableRange: + description: Calico programs additional Linux route tables for various + purposes. RouteTableRange specifies the indices of the route tables + that Calico should use. + properties: + max: + type: integer + min: + type: integer + required: + - max + - min + type: object + serviceLoopPrevention: + description: 'When service IP advertisement is enabled, prevent routing + loops to service IPs that are not in use, by dropping or rejecting + packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled", + in which case such routing loops continue to be allowed. [Default: + Drop]' + type: string + sidecarAccelerationEnabled: + description: 'SidecarAccelerationEnabled enables experimental sidecar + acceleration [Default: false]' + type: boolean + usageReportingEnabled: + description: 'UsageReportingEnabled reports anonymous Calico version + number and cluster size to projectcalico.org. Logs warnings returned + by the usage server. For example, if a significant security vulnerability + has been discovered in the version of Calico being used. [Default: + true]' + type: boolean + usageReportingInitialDelay: + description: 'UsageReportingInitialDelay controls the minimum delay + before Felix makes a report. [Default: 300s]' + type: string + usageReportingInterval: + description: 'UsageReportingInterval controls the interval at which + Felix makes reports. [Default: 86400s]' + type: string + useInternalDataplaneDriver: + type: boolean + vxlanEnabled: + type: boolean + vxlanMTU: + description: 'VXLANMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + vxlanPort: + type: integer + vxlanVNI: + type: integer + wireguardEnabled: + description: 'WireguardEnabled controls whether Wireguard is enabled. + [Default: false]' + type: boolean + wireguardInterfaceName: + description: 'WireguardInterfaceName specifies the name to use for + the Wireguard interface. [Default: wg.calico]' + type: string + wireguardListeningPort: + description: 'WireguardListeningPort controls the listening port used + by Wireguard. [Default: 51820]' + type: integer + wireguardMTU: + description: 'WireguardMTU controls the MTU on the Wireguard interface. + See Configuring MTU [Default: 1420]' + type: integer + wireguardRoutingRulePriority: + description: 'WireguardRoutingRulePriority controls the priority value + to use for the Wireguard routing rule. [Default: 99]' + type: integer + xdpEnabled: + description: 'XDPEnabled enables XDP acceleration for suitable untracked + incoming deny rules. [Default: true]' + type: boolean + xdpRefreshInterval: + description: 'XDPRefreshInterval is the period at which Felix re-checks + all XDP state to ensure that no other process has accidentally broken + Calico''s BPF maps or attached programs. Set to 0 to disable XDP + refresh. [Default: 90s]' + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/globalnetworkpolicies.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/globalnetworkpolicies.crd.yaml new file mode 100755 index 0000000..1cf624f --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/globalnetworkpolicies.crd.yaml @@ -0,0 +1,856 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkPolicy + listKind: GlobalNetworkPolicyList + plural: globalnetworkpolicies + singular: globalnetworkpolicy + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + applyOnForward: + description: ApplyOnForward indicates to apply the rules in this policy + on forward traffic. + type: boolean + doNotTrack: + description: DoNotTrack indicates whether packets matched by the rules + in this policy should go through the data plane's connection tracking, + such as Linux conntrack. If True, the rules in this policy are + applied before any data plane connection tracking, and packets allowed + by this policy are marked as not to be tracked. + type: boolean + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + namespaceSelector: + description: NamespaceSelector is an optional field for an expression + used to select a pod based on namespaces. + type: string + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + preDNAT: + description: PreDNAT indicates to apply the rules in this policy before + any DNAT. + type: boolean + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress rules are present in the policy. The + default is: \n - [ PolicyTypeIngress ], if there are no Egress rules + (including the case where there are also no Ingress rules) \n + - [ PolicyTypeEgress ], if there are Egress rules but no Ingress + rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are + both Ingress and Egress rules. \n When the policy is read back again, + Types will always be one of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/globalnetworksets.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/globalnetworksets.crd.yaml new file mode 100755 index 0000000..6024037 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/globalnetworksets.crd.yaml @@ -0,0 +1,55 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_globalnetworksets.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkSet + listKind: GlobalNetworkSetList + plural: globalnetworksets + singular: globalnetworkset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs + that share labels to allow rules to refer to them via selectors. The labels + of GlobalNetworkSet are not namespaced. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GlobalNetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/hostendpoints.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/hostendpoints.crd.yaml new file mode 100755 index 0000000..797801d --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/hostendpoints.crd.yaml @@ -0,0 +1,109 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_hostendpoints.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: HostEndpoint + listKind: HostEndpointList + plural: hostendpoints + singular: hostendpoint + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HostEndpointSpec contains the specification for a HostEndpoint + resource. + properties: + expectedIPs: + description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. + If \"InterfaceName\" is not present, Calico will look for an interface + matching any of the IPs in the list and apply policy to that. Note: + \tWhen using the selector match criteria in an ingress or egress + security Policy \tor Profile, Calico converts the selector into + a set of IP addresses. For host \tendpoints, the ExpectedIPs field + is used for that purpose. (If only the interface \tname is specified, + Calico does not learn the IPs of the interface for use in match + \tcriteria.)" + items: + type: string + type: array + interfaceName: + description: "Either \"*\", or the name of a specific Linux interface + to apply policy to; or empty. \"*\" indicates that this HostEndpoint + governs all traffic to, from or through the default network namespace + of the host named by the \"Node\" field; entering and leaving that + namespace via any interface, including those from/to non-host-networked + local workloads. \n If InterfaceName is not \"*\", this HostEndpoint + only governs traffic that enters or leaves the host through the + specific interface named by InterfaceName, or - when InterfaceName + is empty - through the specific interface that has one of the IPs + in ExpectedIPs. Therefore, when InterfaceName is empty, at least + one expected IP must be specified. Only external interfaces (such + as \"eth0\") are supported here; it isn't possible for a HostEndpoint + to protect traffic through a specific local workload interface. + \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; + initially just pre-DNAT policy. Please check Calico documentation + for the latest position." + type: string + node: + description: The node name identifying the Calico node instance. + type: string + ports: + description: Ports contains the endpoint's named ports, which may + be referenced in security policy rules. + items: + properties: + name: + type: string + port: + type: integer + protocol: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + required: + - name + - port + - protocol + type: object + type: array + profiles: + description: A list of identifiers of security Profile objects that + apply to this endpoint. Each profile is applied in the order that + they appear in this list. Profile rules are applied after the selector-based + security policy. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamblocks.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamblocks.crd.yaml new file mode 100755 index 0000000..efc9f1f --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamblocks.crd.yaml @@ -0,0 +1,82 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamblocks.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMBlock + listKind: IPAMBlockList + plural: ipamblocks + singular: ipamblock + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMBlockSpec contains the specification for an IPAMBlock + resource. + properties: + affinity: + type: string + allocations: + items: + type: integer + # TODO: This nullable is manually added in. We should update controller-gen + # to handle []*int properly itself. + nullable: true + type: array + attributes: + items: + properties: + handle_id: + type: string + secondary: + additionalProperties: + type: string + type: object + type: object + type: array + cidr: + type: string + deleted: + type: boolean + strictAffinity: + type: boolean + unallocated: + items: + type: integer + type: array + required: + - allocations + - attributes + - cidr + - strictAffinity + - unallocated + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamconfigs.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamconfigs.crd.yaml new file mode 100755 index 0000000..b03a308 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamconfigs.crd.yaml @@ -0,0 +1,57 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamconfigs.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMConfig + listKind: IPAMConfigList + plural: ipamconfigs + singular: ipamconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMConfigSpec contains the specification for an IPAMConfig + resource. + properties: + autoAllocateBlocks: + type: boolean + maxBlocksPerHost: + description: MaxBlocksPerHost, if non-zero, is the max number of blocks + that can be affine to each host. + type: integer + strictAffinity: + type: boolean + required: + - autoAllocateBlocks + - strictAffinity + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamhandles.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamhandles.crd.yaml new file mode 100755 index 0000000..06a6306 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ipamhandles.crd.yaml @@ -0,0 +1,57 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamhandles.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMHandle + listKind: IPAMHandleList + plural: ipamhandles + singular: ipamhandle + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMHandleSpec contains the specification for an IPAMHandle + resource. + properties: + block: + additionalProperties: + type: integer + type: object + deleted: + type: boolean + handleID: + type: string + required: + - block + - handleID + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ippools.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ippools.crd.yaml new file mode 100755 index 0000000..6b8c9d1 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/ippools.crd.yaml @@ -0,0 +1,100 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ippools.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPPool + listKind: IPPoolList + plural: ippools + singular: ippool + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec contains the specification for an IPPool resource. + properties: + blockSize: + description: The block size to use for IP address assignments from + this pool. Defaults to 26 for IPv4 and 112 for IPv6. + type: integer + cidr: + description: The pool CIDR. + type: string + disabled: + description: When disabled is true, Calico IPAM will not assign addresses + from this pool. + type: boolean + ipip: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + properties: + enabled: + description: When enabled is true, ipip tunneling will be used + to deliver packets to destinations within this pool. + type: boolean + mode: + description: The IPIP mode. This can be one of "always" or "cross-subnet". A + mode of "always" will also use IPIP tunneling for routing to + destination IP addresses within this pool. A mode of "cross-subnet" + will only use IPIP tunneling when the destination node is on + a different subnet to the originating node. The default value + (if not specified) is "always". + type: string + type: object + ipipMode: + description: Contains configuration for IPIP tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling + is disabled). + type: string + nat-outgoing: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + type: boolean + natOutgoing: + description: When nat-outgoing is true, packets sent from Calico networked + containers in this pool to destinations outside of this pool will + be masqueraded. + type: boolean + nodeSelector: + description: Allows IPPool to allocate for a specific node by label + selector. + type: string + vxlanMode: + description: Contains configuration for VXLAN tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. VXLAN + tunneling is disabled). + type: string + required: + - cidr + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/networkpolicies.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/networkpolicies.crd.yaml new file mode 100755 index 0000000..f729b6e --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/networkpolicies.crd.yaml @@ -0,0 +1,838 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_networkpolicies.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkPolicy + listKind: NetworkPolicyList + plural: networkpolicies + singular: networkpolicy + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress are present in the policy. The default + is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including + the case where there are also no Ingress rules) \n - [ PolicyTypeEgress + ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, + PolicyTypeEgress ], if there are both Ingress and Egress rules. + \n When the policy is read back again, Types will always be one + of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/networksets.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/networksets.crd.yaml new file mode 100755 index 0000000..2e545a1 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/crds/networksets.crd.yaml @@ -0,0 +1,52 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_networksets.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkSet + listKind: NetworkSetList + plural: networksets + singular: networkset + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: NetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/daemonset.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/daemonset.yaml new file mode 100755 index 0000000..8ee8512 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/daemonset.yaml @@ -0,0 +1,266 @@ +--- +# Source: calico/templates/calico-node.yaml +# This manifest installs the canal container, as well +# as the CNI plugins and network config on +# each master and worker node in a Kubernetes cluster. +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: {{ .Release.Name | quote }} + namespace: kube-system + labels: + k8s-app: canal +spec: + selector: + matchLabels: + k8s-app: canal + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + labels: + k8s-app: canal + annotations: + # This, along with the CriticalAddonsOnly toleration below, + # marks the pod as a critical add-on, ensuring it gets + # priority scheduling and that its resources are reserved + # if it ever gets evicted. + scheduler.alpha.kubernetes.io/critical-pod: '' + spec: + nodeSelector: + kubernetes.io/os: linux + hostNetwork: true + tolerations: + # Make sure canal gets scheduled on all nodes. + - effect: NoSchedule + operator: Exists + # Mark the pod as a critical add-on for rescheduling. + - key: CriticalAddonsOnly + operator: Exists + - effect: NoExecute + operator: Exists + serviceAccountName: canal + # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force + # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. + terminationGracePeriodSeconds: 0 + priorityClassName: system-node-critical + initContainers: + # This container installs the CNI binaries + # and CNI network config file on each node. + - name: install-cni + image: {{ template "system_default_registry" . }}{{ .Values.calico.cniImage.repository }}:{{ .Values.calico.cniImage.tag }} + command: ["/opt/cni/bin/install"] + env: + # Name of the CNI config file to create. + - name: CNI_CONF_NAME + value: "10-canal.conflist" + # The CNI network config to install on each node. + - name: CNI_NETWORK_CONFIG + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: cni_network_config + # Set the hostname based on the k8s node name. + - name: KUBERNETES_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # CNI MTU Config variable + - name: CNI_MTU + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: veth_mtu + # Prevents the container from sleeping forever. + - name: SLEEP + value: "false" + volumeMounts: + - mountPath: /host/opt/cni/bin + name: cni-bin-dir + - mountPath: /host/etc/cni/net.d + name: cni-net-dir + securityContext: + privileged: true + # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes + # to communicate with Felix over the Policy Sync API. + - name: flexvol-driver + image: {{ template "system_default_registry" . }}{{ .Values.calico.flexvolImage.repository }}:{{ .Values.calico.flexvolImage.tag }} + command: ['/usr/local/bin/flexvol.sh', '-s', '/usr/local/bin/flexvol', '-i', 'flexvoldriver'] + volumeMounts: + - name: flexvol-driver-host + mountPath: /host/driver + securityContext: + privileged: true + containers: + # Runs canal container on each Kubernetes node. This + # container programs network policy and routes on each + # host. + - name: calico-node + command: + - "start_runit" + image: {{ template "system_default_registry" . }}{{ .Values.calico.nodeImage.repository }}:{{ .Values.calico.nodeImage.tag }} + env: + # Use Kubernetes API as the backing datastore. + - name: DATASTORE_TYPE + value: {{ .Values.calico.datastoreType | quote }} + # Configure route aggregation based on pod CIDR. + - name: USE_POD_CIDR + value: {{ .Values.calico.usePodCIDR | quote }} + # Wait for the datastore. + - name: WAIT_FOR_DATASTORE + value: {{ .Values.calico.waitForDatastore | quote }} + # Set based on the k8s node name. + - name: NODENAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # Don't enable BGP. + - name: CALICO_NETWORKING_BACKEND + value: {{ .Values.calico.networkingBackend | quote }} + # Cluster type to identify the deployment type + - name: CLUSTER_TYPE + value: {{ .Values.calico.clusterType | quote}} + # Period, in seconds, at which felix re-applies all iptables state + - name: FELIX_IPTABLESREFRESHINTERVAL + value: {{ .Values.calico.felixIptablesRefreshInterval | quote}} + - name: FELIX_IPTABLESBACKEND + value: {{ .Values.calico.felixIptablesBackend | quote}} + # No IP address needed. + - name: IP + value: "" + # The default IPv4 pool to create on startup if none exists. Pod IPs will be + # chosen from this range. Changing this value after installation will have + # no effect. This should fall within `--cluster-cidr`. + # - name: CALICO_IPV4POOL_CIDR + # value: "192.168.0.0/16" + # Disable file logging so `kubectl logs` works. + - name: CALICO_DISABLE_FILE_LOGGING + value: "true" + # Set Felix endpoint to host default action to ACCEPT. + - name: FELIX_DEFAULTENDPOINTTOHOSTACTION + value: {{ .Values.calico.felixDefaultEndpointToHostAction | quote }} + # Disable IPv6 on Kubernetes. + - name: FELIX_IPV6SUPPORT + value: {{ .Values.calico.felixIpv6Support | quote }} + # Set Felix logging to "info" + - name: FELIX_LOGSEVERITYSCREEN + value: {{ .Values.calico.felixLogSeverityScreen | quote }} + - name: FELIX_HEALTHENABLED + value: {{ .Values.calico.felixHealthEnabled | quote }} + # enable promentheus metrics + - name: FELIX_PROMETHEUSMETRICSENABLED + value: {{ .Values.calico.felixPrometheusMetricsEnabled | quote }} + - name: FELIX_XDPENABLED + value: {{ .Values.calico.felixXDPEnabled | quote }} + - name: FELIX_FAILSAFEINBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeInboundHostPorts | quote }} + - name: FELIX_FAILSAFEOUTBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeOutboundHostPorts | quote }} + securityContext: + privileged: true + resources: + requests: + cpu: 250m + livenessProbe: + exec: + command: + - /bin/calico-node + - -felix-live + periodSeconds: 10 + initialDelaySeconds: 10 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: 9099 + host: localhost + periodSeconds: 10 + volumeMounts: + - mountPath: /lib/modules + name: lib-modules + readOnly: true + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - mountPath: /var/run/calico + name: var-run-calico + readOnly: false + - mountPath: /var/lib/calico + name: var-lib-calico + readOnly: false + - name: policysync + mountPath: /var/run/nodeagent + # This container runs flannel using the kube-subnet-mgr backend + # for allocating subnets. + - name: kube-flannel + image: {{ template "system_default_registry" . }}{{ .Values.flannel.image.repository }}:{{ .Values.flannel.image.tag }} + command: + - "/opt/bin/flanneld" + {{- range .Values.flannel.args }} + - {{ . | quote }} + {{- end }} + securityContext: + privileged: true + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: FLANNELD_IFACE + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: canal_iface + - name: FLANNELD_IP_MASQ + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: masquerade + volumeMounts: + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - name: flannel-cfg + mountPath: /etc/kube-flannel/ + volumes: + # Used by canal. + - name: lib-modules + hostPath: + path: /lib/modules + - name: var-run-calico + hostPath: + path: /var/run/calico + - name: var-lib-calico + hostPath: + path: /var/lib/calico + - name: xtables-lock + hostPath: + path: /run/xtables.lock + type: FileOrCreate + # Used by flannel. + - name: flannel-cfg + configMap: + name: {{ .Release.Name }}-config + # Used to install CNI. + - name: cni-bin-dir + hostPath: + path: /opt/cni/bin + - name: cni-net-dir + hostPath: + path: /etc/cni/net.d + # Used to create per-pod Unix Domain Sockets + - name: policysync + hostPath: + type: DirectoryOrCreate + path: /var/run/nodeagent + # Used to install Flex Volume Driver + - name: flexvol-driver-host + hostPath: + type: DirectoryOrCreate + path: {{ .Values.calico.flexVolumePluginDir }}/nodeagent~uds diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/rbac.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/rbac.yaml new file mode 100755 index 0000000..cd39730 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/rbac.yaml @@ -0,0 +1,163 @@ +--- +# Source: calico/templates/rbac.yaml + +# Include a clusterrole for the calico-node DaemonSet, +# and bind it to the calico-node serviceaccount. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: calico-node +rules: + # The CNI plugin needs to get pods, nodes, and namespaces. + - apiGroups: [""] + resources: + - pods + - nodes + - namespaces + verbs: + - get + - apiGroups: [""] + resources: + - endpoints + - services + verbs: + # Used to discover service IPs for advertisement. + - watch + - list + # Used to discover Typhas. + - get + # Pod CIDR auto-detection on kubeadm needs access to config maps. + - apiGroups: [""] + resources: + - configmaps + verbs: + - get + - apiGroups: [""] + resources: + - nodes/status + verbs: + # Needed for clearing NodeNetworkUnavailable flag. + - patch + # Calico stores some configuration information in node annotations. + - update + # Watch for changes to Kubernetes NetworkPolicies. + - apiGroups: ["networking.k8s.io"] + resources: + - networkpolicies + verbs: + - watch + - list + # Used by Calico for policy information. + - apiGroups: [""] + resources: + - pods + - namespaces + - serviceaccounts + verbs: + - list + - watch + # The CNI plugin patches pods/status. + - apiGroups: [""] + resources: + - pods/status + verbs: + - patch + # Calico monitors various CRDs for config. + - apiGroups: ["crd.projectcalico.org"] + resources: + - globalfelixconfigs + - felixconfigurations + - bgppeers + - globalbgpconfigs + - bgpconfigurations + - ippools + - ipamblocks + - globalnetworkpolicies + - globalnetworksets + - networkpolicies + - networksets + - clusterinformations + - hostendpoints + - blockaffinities + verbs: + - get + - list + - watch + # Calico must create and update some CRDs on startup. + - apiGroups: ["crd.projectcalico.org"] + resources: + - ippools + - felixconfigurations + - clusterinformations + verbs: + - create + - update + # Calico stores some configuration information on the node. + - apiGroups: [""] + resources: + - nodes + verbs: + - get + - list + - watch + # These permissions are only requried for upgrade from v2.6, and can + # be removed after upgrade or on fresh installations. + - apiGroups: ["crd.projectcalico.org"] + resources: + - bgpconfigurations + - bgppeers + verbs: + - create + - update + +--- +# Flannel ClusterRole +# Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: flannel +rules: + - apiGroups: [""] + resources: + - pods + verbs: + - get + - apiGroups: [""] + resources: + - nodes + verbs: + - list + - watch + - apiGroups: [""] + resources: + - nodes/status + verbs: + - patch +--- +# Bind the flannel ClusterRole to the canal ServiceAccount. +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: canal-flannel +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flannel +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: canal-calico +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-node +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/serviceaccount.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/serviceaccount.yaml new file mode 100755 index 0000000..582d55b --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/templates/serviceaccount.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/values.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/values.yaml new file mode 100755 index 0000000..f049271 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061111/values.yaml @@ -0,0 +1,82 @@ +--- + +# The IPv4 cidr pool to create on startup if none exists. Pod IPs will be +# chosen from this range. +podCidr: "10.42.0.0/16" + +flannel: + # kube-flannel image + image: + repository: rancher/hardened-flannel + tag: v0.14.0-build20211006 + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + iface: "" + # kube-flannel command arguments + args: + - "--ip-masq" + - "--kube-subnet-mgr" + # Backend for kube-flannel. Backend should not be changed + # at runtime. + backend: "vxlan" + +calico: + # CNI installation image. + cniImage: + repository: rancher/hardened-calico + tag: v3.20.1-build20211006 + # Canal node image. + nodeImage: + repository: rancher/hardened-calico + tag: v3.20.1-build20211006 + # Flexvol Image. + flexvolImage: + repository: rancher/hardened-calico + tag: v3.20.1-build20211006 + # Datastore type for canal. It can be either kuberentes or etcd. + datastoreType: kubernetes + # Wait for datastore to initialize. + waitForDatastore: true + # Configure route aggregation based on pod CIDR. + usePodCIDR: true + # Disable BGP routing. + networkingBackend: none + # Cluster type to identify the deployment type. + clusterType: "k8s,canal" + # Disable file logging so `kubectl logs` works. + disableFileLogging: true + # Disable IPv6 on Kubernetes. + felixIpv6Support: false + # Period, in seconds, at which felix re-applies all iptables state + felixIptablesRefreshInterval: 60 + # iptables backend to use for felix, defaults to auto but can also be set to nft or legacy + felixIptablesBackend: auto + # Set Felix logging to "info". + felixLogSeverityScreen: info + # Enable felix healthcheck. + felixHealthEnabled: true + # Enable prometheus metrics + felixPrometheusMetricsEnabled: true + # Disable XDP Acceleration as we do not support it with our ubi7 base image + felixXDPEnabled: false + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: true + # Set Felix endpoint to host default action to ACCEPT. + felixDefaultEndpointToHostAction: ACCEPT + # Configure the MTU to use. + vethuMTU: 1450 + # Typha is disabled. + typhaServiceName: none + # Kubelet flex-volume-plugin-dir + flexVolumePluginDir: /var/lib/kubelet/volumeplugins + # calico inbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeInboundHostPorts: "" + # calico outbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeOutboundHostPorts: "" + +global: + systemDefaultRegistry: "" + clusterCIDRv4: "" + clusterCIDRv6: "" diff --git a/index.yaml b/index.yaml index 9738535..ac326e7 100755 --- a/index.yaml +++ b/index.yaml @@ -309,6 +309,23 @@ entries: - assets/rke2-calico/rke2-calico-crd-v1.0.001.tgz version: v1.0.001 rke2-canal: + - apiVersion: v1 + appVersion: v3.19.1 + created: "2021-10-06T23:55:46.034454443Z" + description: Install Canal Network Plugin. + digest: 0b6b3f90a8559f302153ff97d67b4610791271e63c45d93230db3df02a59f43c + home: https://www.projectcalico.org/ + keywords: + - canal + maintainers: + - email: charts@rancher.com + name: Rancher Labs + name: rke2-canal + sources: + - https://github.com/rancher/rke2-charts + urls: + - assets/rke2-canal/rke2-canal-v3.19.1-build2021061111.tgz + version: v3.19.1-build2021061111 - apiVersion: v1 appVersion: v3.19.1 created: "2021-09-30T22:22:01.255914599Z"