From 207943f7395ebd4d7176566dc9e031478037bfca Mon Sep 17 00:00:00 2001 From: actions Date: Wed, 12 May 2021 21:12:29 +0000 Subject: [PATCH] Honor .Values.global.clusterCIDR in rke2-canal Signed-off-by: Brad Davidson --- .../rke2-canal-v3.13.300-build2021022304.tgz | Bin 0 -> 6090 bytes .../v3.13.300-build2021022304/Chart.yaml | 13 + .../templates/NOTES.txt | 3 + .../templates/_helpers.tpl | 7 + .../templates/config.yaml | 67 +++++ .../templates/crd.yaml | 197 +++++++++++++ .../templates/daemonset.yaml | 266 ++++++++++++++++++ .../templates/rbac.yaml | 163 +++++++++++ .../templates/serviceaccount.yaml | 6 + .../v3.13.300-build2021022304/values.yaml | 80 ++++++ index.yaml | 17 ++ 11 files changed, 819 insertions(+) create mode 100755 assets/rke2-canal/rke2-canal-v3.13.300-build2021022304.tgz create mode 100755 charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/Chart.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/NOTES.txt create mode 100755 charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/_helpers.tpl create mode 100755 charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/config.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/daemonset.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/rbac.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/serviceaccount.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/values.yaml diff --git a/assets/rke2-canal/rke2-canal-v3.13.300-build2021022304.tgz b/assets/rke2-canal/rke2-canal-v3.13.300-build2021022304.tgz new file mode 100755 index 0000000000000000000000000000000000000000..3a2d21506b04130953afaac626b7c2c2652c0053 GIT binary patch literal 6090 zcmV;*7d7Y~iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKBja~iqQ=ziu`bm6*{FCM@z@$PbO-MR#DLamLt2Jh~vQ>R!l z(}0eJG)K~4b8_YPI@Bk+*p4`GgbJ>@JDajSX3` zAD;JVwOXyS(^LC*tJNz1-8y}L^uy6<>-5Lg>GAQ8r$4lgPL7UFe}L9A(^2_EN)!1* z>zi?v2lp3wNJxK0si@#>SRd6$7-m0D8b>FMlUjhvmo(J&<$x^D zELu?Bs4c|`+pyF+RPAQ-?(VJ;O7TzhwNDuJMMKC%vv!M{J0Szru6bZ3ueKtTYeG3n z`w~}#vNrfe9@YPog!@aB4PUHk0Gt>M*X|u$keRBvSD7H!l!&B{7F0sYg6d^7GccMl zyr%15an#nOF}GUYETSwpZXF-Bj*m}Tr?u}rQ7`o5*8iHY2-OQHfCtw9`{UMWdHtWf zKY3gKukm=ESF0VsWQi~stxv(HfrL;923mkGk!S?L!7xcjA<#K+!4dGDDyYhhKZ$;F<>d9~0T}3mF+FLE8gZY8@x5xuKz&!j$`b8~8!~)<#!wiik<_ipL zU!p-qT+@}Mb>`Z)p}xLngx4+a-BWWq-_2`xH~{Ll4$C_?rv`%0>EMy`>j37a*D33Y zS#`UUVRDAZ{Ca*&=M3-Hg25m`Gj}hZA5)KLqO_0*dK03ZJ1eFQ7-;h^Gf_yj*%r;5 zO5_?92nneDz)%(>04AFd+pZBujZO@IBUD?UL54>FV!vB?bL|}u>bF0sL(9c_0sovb z1SS>>vtE^eKMb>c&CEOX2N+_MWvOd_P8nXf))j*pjMisn^uMGGw{n7v-Veg{**FSA zA$1$(geli^gp!Kj5GV(QzTkm6H0$neN&Thk2ogOKhK!;DV~){K8(hjLYK<9q_x2j+ z64i2GRMMKTHk`FAp0roIj1B)HJeo&65SOM8fpa zU!s4TcK&4Fxn@CbQsR!G6f4wAj1;U;OX{nn<0$=d={{`3NGA68-UvFrj|`;~bfVx6 zArMw?DmSk{HQZ6X1QAJyX7oq99MZkb;{3fgO0i^8@Y@pYY8KMM(*lfUk5G~TK}#~9 zQ{TJ|P-)6715lKt3$ATRMHs3sCpWRU89-~)%jj})(}ttd_f9w`n{Y|Y<{2+C ztHZQ;IYzmrJ`SzjpDF^gyclY$fW5U~(F(oLo=d!d%2+f1YTvu#N{`AmG}lBn8J#t6 zUH7Kz={h>i=u|XNJ`<7IGzn#j%ne_qF@gH4P;WqKX{30CgsXJXG~h-dyfY-evon>b zmjncz!$w4~Bx^MPkRa|j$cW`s#ChCy;Lsc1jtt_|K#0i`k^ZjqUB&o|1lATz%!oDa z)JADs#lmup3#zo)5$pB;sYk27#FIP!Xf2U_h zZ|A>Pd16aB_TxCU2TP)0hR73>-RRz$5sJ34HCJQxV{JM=WR4yH2RqwC;(`BF0t=^PrrIxnHy*Bh0adfGmel`(gR>F}!8pAI{h{pqyWW2K{d8>Z9la4@}`+)Ss1uQVj9 zdb==?!eGq8@|f@mD?qhvT=2uRie1h$koh>pmjb3xFzRpi;kx}v?e3mqNCgP%MYhwP zF{XPpJRf|Vo)0eiqt4{hbXovjt3XpZouQC=MZzLe6(?rkT1HrS?~{I&JSu z5{8s7RNUe5sAq%+cQnw;`hFx?yDbdyzy48kzv9S>i+NQp)&^XPh?}j2axJWS$YNx1 zE7b_*itf{yts8+ZU4#OInw|hu>XGiam)TYJv(``|6b*J!2Y`p0?(I$%L=I# zY%~&5yw}LhFV(pHNj0cwu8(G@$x&k5MM{g+HM)eHo;hYxvwACxyV)WvEO6B@Lb#PZ zR5RPK^(Olw#C8(>s{t&eh{85h_cHcEW?IJ9qKnQtN@dhX4*90Ylp_sg1!>Fwp+Y3&umodd+H(^huy7>D(EZmY`euv z^UPUFv885B=vQBlA1w*7MK`ime1UD1B$gPr-R8wtXaS`{{XMxhM!lP5hPHj|Qm9{= zSJs&nXBoUQpFRndCO8y$RG_KEpZvF%=8ZWa+pXo588aAlF6~xW;7UeKi6!ZW*Wia! zf!~24-NY+d)nNPmKgXv>XU8S~&spo_{hR;iHJ-=C|7;v2AN^YqPUom}5;0NM1?xgysRQ=V zCB!n*i?|lu;UG>jiqnA#&Rr0^cHkl}D`K;{O&ikyWt`2=f#edYljC6$P3&30HS46P z2tw6-Tu8CthTRcU1Yl%_ELovHDUXC^ZM)jDL-*MK*PnYFH$i&UFtZ6_V-=D1V7TWH@34MlXp5sujpsu`3`F%`cQ|tBw;0 zbZ)@n8l{B|xTby_s&h{a8D)d8a7h|je8+4i39()%f;PN+=d^Gv0p>9>J1$6qWpe?D zP;Fq8NB8k}b83hcewv_dWg%r`VID5YErN<3E76et@A3Nlec?k%tpK=W>b>KdW)NOg^)Z3b)Mw@J^GP;1jTV=zvKHN z;@TyQ=VkiE^KsKNC=RjnSuWe8X3zgA}t^gK%hPs z(#I5h(xIMJ#TI8j5WdZ~@iEk@X(pWs5~yY<+#k&YjdB$S+dVNiqLxl%?$bv}d~|gq zV^=cLhF07xStngalyXdPs?6$jFPXr&wK0LZBCE$OF8NHm7gfJe>@&)VOw2Ub#Vp6| zh`Xz=DFoSb^Bf!I4!Y-anww`=3TX6pqS^MOtu^4wm+kC;q~NTP)n&n#FYP@IHCbeF zIrGG2cy0K5y_uu4p_cW39V&Li-9$f)NJ)TXX$cs^QV}aBw434oRP$}En>B{W2#qd z>9Asmq0zo`VOq)R85v*n`=cFe!4^{G<=<8I*t`MNE`eK_w{8NOMn0M%)J>n$=8W=M z6%%|;y;)jXv=6$WJqs@BZ-!(X3{d&8jR&!C%tsn z$XP^b?i|evPu3-rVj;;&WyL2>XpG5V^B7eEHP_t?Zd;mir__qcEAX>!Z!(z5h||L6 z_zZHF7MMRMbXm(SiL0;~ZWQME+8GU!)AWq^w?;>%iFwspve%h(#*?e-{&e!U(GJsL zo5(`B_;!9$Lfw-KzqjeT8TY57tKQVKcr0~U`S@G{?5G-cLf zDJd7l@21BXAWyY9jG^)Bc1BO|cN&ldzF}igW<>NhfepG{;>C0&TWn!$p65-9NwXk3S8D zlm7Luor}j(zwZWs9mA={|HN6Xs{G%{zM+7@2uKh}RAwi@An$$2(=^y+=T#kXl6-i3 zrOnshW>W;b<7OM^E(v#67?_uqEFg28osgX}v_O|+T?WfV?Ad6z19p7%%G}6`%d3Y! zJTI0-&!>U>qfr7;T9Jd%ucxD{tBY-gdXPUW{(RgxI{PWTh^N@@sW)M4PgqP$Z!k7e zWD}gH7grxY4u+NI#WvK9=~1TRD=#M4CdbKiuYcaTxtR2az0uWRIGJ31x*AV9-O1o; z_$2w>bLYWsCAR-UkX&X+BV0yR6{w-<8Jsf*Ty14o{?*H1q9!&l= z?q2u%PvhOzy&k*BD;pMwQc2PCDzPjvBKJ{ zq6{gB?E{bFp*@aPACg=H&oag{_=>|TI+TxEg|G4DP(5U1v#ZUVP!>s?ERFdgSkQ*E z0*^>QcZ_hUb@&l=c{HIr<)%H$pY2sjKevAVx%9zo8Evqq^R46azF|JrYsBcRxe`Id zuuPJZU`A(N^>;IrE6z4s5>!SZBi_7sc2y%yxhms{8+a8BGDOKGL%T4oiL}^qx099e ztcmnw#J$QUPs3zb_W<y|2LJ0652j+Hk+rxoXH}eUJrmo%1@B0v|HsDlIq4>M=`K z?Io9L<=~jJC}BnhwKb<~Tea=a$luBLOg@UV@N>U|qS$PwKdk6dvCdNG@v^;xyzTJ$ zv*!%uEgVEHR1v&qRd%%+PAdMNMK^DGSrX2Vu6i%y)=xt34PHKOmr;*Lo$d?cw@D4v z`|L$$IP72ari1e*QSp*-ovf7k0g^}4%g*@!|0#&hikcs>l{`VqKcM4xYs1WwY!{#B z&x^F@DM0Nv^D3xW%hO+Q2H)h1-M1B4^`>X`UyG`^TzBuI-a~uNUWhw3Gw-48b*OAF zE2^Sz-riu@UU1bBxQzVRGqgJ%wk?X4HbpfNZt8ke+BBfe*8IV?s8$&vWnOQ`_bR4+ zU)bndsjUvCm2OysFJH3J{8tpHx9fWTR8M98ubdJ884JK4s{d}CoR#ape>^*T%m00i z=Yjm+R1#{n0~m0hMF9dy(r%?-mtJ)Z_^l$t7BAx}f?9^4U~2I4(nG~G!mK-#O8RHHPY0~=nk z5nB>z;RUGCIm`vOCteb);+Y`6k4j}1O2LYRPh-C8XSzKDhwbDwl_ol>$EJ_=%v^|WfDAy^mzEX}d3pVC~p*Kzk$qo7&mS1tf z)ELUJKI?d``c%`%<_Fxyo)cTk^1=~ zLqQ!qNyo)mGD#-#)AaRM&cI}e%AN#QRN2BoTRI{*+t|pBq_Lt;iUMpl!1}mx=4=I@ zxLfdM2ohIfjX|6WkSih(9BeX1Aw8fZ23Z>P>D0RIb&khbmd&lp78DeTVv@f_?SFrX|CAw+JA`?J+=LwzJEM}?eOT$ z<(W*9WY=($_<`D*sO*Nc9B(s&oD&A)Lb*(ZDQ-YfzW6qaoD-G?H_QnlcD*Je-vhB$ zx>m+YM|rAMG&3v4{`YULb#YilN_Lm|mCK3uj&mocb}=CK8$RRs^GBWM;=%VmoxVLU z{Z#sYN=Nc<^#nb1|NGHN`ToBjTW3da{-4))%33bfWhI5NLyx_wj<@ISd3)ZTzv%Pd Q0RRC1|9CF8PXK%X04`+|cmMzZ literal 0 HcmV?d00001 diff --git a/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/Chart.yaml b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/Chart.yaml new file mode 100755 index 0000000..9b1287b --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +appVersion: v3.13.3 +description: Install Canal Network Plugin. +home: https://www.projectcalico.org/ +keywords: +- canal +maintainers: +- email: charts@rancher.com + name: Rancher Labs +name: rke2-canal +sources: +- https://github.com/rancher/rke2-charts +version: v3.13.300-build2021022304 diff --git a/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/NOTES.txt b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/NOTES.txt new file mode 100755 index 0000000..12a30ff --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/NOTES.txt @@ -0,0 +1,3 @@ +Canal network plugin has been installed. + +NOTE: It may take few minutes until Canal image install CNI files and node become in ready state. diff --git a/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/_helpers.tpl b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/_helpers.tpl new file mode 100755 index 0000000..b647c75 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/_helpers.tpl @@ -0,0 +1,7 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} diff --git a/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/config.yaml b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/config.yaml new file mode 100755 index 0000000..1995894 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/config.yaml @@ -0,0 +1,67 @@ +--- +# Source: calico/templates/calico-config.yaml +# This ConfigMap is used to configure a self-hosted Canal installation. +kind: ConfigMap +apiVersion: v1 +metadata: + name: {{ .Release.Name }}-config + namespace: kube-system +data: + # Typha is disabled. + typha_service_name: {{ .Values.calico.typhaServiceName | quote }} + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + canal_iface: {{ .Values.flannel.iface | quote }} + + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: {{ .Values.calico.masquerade | quote }} + + # Configure the MTU to use + veth_mtu: {{ .Values.calico.vethuMTU | quote }} + + # The CNI network configuration to install on each node. The special + # values in this config will be automatically populated. + cni_network_config: |- + { + "name": "k8s-pod-network", + "cniVersion": "0.3.1", + "plugins": [ + { + "type": "calico", + "log_level": "info", + "datastore_type": "kubernetes", + "nodename": "__KUBERNETES_NODE_NAME__", + "mtu": __CNI_MTU__, + "ipam": { + "type": "host-local", + "subnet": "usePodCidr" + }, + "policy": { + "type": "k8s" + }, + "kubernetes": { + "kubeconfig": "__KUBECONFIG_FILEPATH__" + } + }, + { + "type": "portmap", + "snat": true, + "capabilities": {"portMappings": true} + }, + { + "type": "bandwidth", + "capabilities": {"bandwidth": true} + } + ] + } + + # Flannel network configuration. Mounted into the flannel container. + net-conf.json: | + { + "Network": {{ .coalesce .Values.global.clusterCIDR Values.podCidr | quote }}, + "Backend": { + "Type": {{ .Values.flannel.backend | quote }} + } + } diff --git a/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/crd.yaml b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/crd.yaml new file mode 100755 index 0000000..0351759 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/crd.yaml @@ -0,0 +1,197 @@ +--- +# Source: calico/templates/kdd-crds.yaml + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: bgpconfigurations.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: BGPConfiguration + plural: bgpconfigurations + singular: bgpconfiguration + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: bgppeers.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: BGPPeer + plural: bgppeers + singular: bgppeer + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: BlockAffinity + plural: blockaffinities + singular: blockaffinity + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: ClusterInformation + plural: clusterinformations + singular: clusterinformation + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: FelixConfiguration + plural: felixconfigurations + singular: felixconfiguration + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: GlobalNetworkPolicy + plural: globalnetworkpolicies + singular: globalnetworkpolicy + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: GlobalNetworkSet + plural: globalnetworksets + singular: globalnetworkset + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: HostEndpoint + plural: hostendpoints + singular: hostendpoint + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: IPAMBlock + plural: ipamblocks + singular: ipamblock + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: IPAMConfig + plural: ipamconfigs + singular: ipamconfig + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: IPAMHandle + plural: ipamhandles + singular: ipamhandle + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: IPPool + plural: ippools + singular: ippool + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + scope: Namespaced + group: crd.projectcalico.org + version: v1 + names: + kind: NetworkPolicy + plural: networkpolicies + singular: networkpolicy + +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + scope: Namespaced + group: crd.projectcalico.org + version: v1 + names: + kind: NetworkSet + plural: networksets + singular: networkset diff --git a/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/daemonset.yaml b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/daemonset.yaml new file mode 100755 index 0000000..8b9520c --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/daemonset.yaml @@ -0,0 +1,266 @@ +--- +# Source: calico/templates/calico-node.yaml +# This manifest installs the canal container, as well +# as the CNI plugins and network config on +# each master and worker node in a Kubernetes cluster. +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: {{ .Release.Name | quote }} + namespace: kube-system + labels: + k8s-app: canal +spec: + selector: + matchLabels: + k8s-app: canal + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + labels: + k8s-app: canal + annotations: + # This, along with the CriticalAddonsOnly toleration below, + # marks the pod as a critical add-on, ensuring it gets + # priority scheduling and that its resources are reserved + # if it ever gets evicted. + scheduler.alpha.kubernetes.io/critical-pod: '' + spec: + nodeSelector: + kubernetes.io/os: linux + hostNetwork: true + tolerations: + # Make sure canal gets scheduled on all nodes. + - effect: NoSchedule + operator: Exists + # Mark the pod as a critical add-on for rescheduling. + - key: CriticalAddonsOnly + operator: Exists + - effect: NoExecute + operator: Exists + serviceAccountName: canal + # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force + # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. + terminationGracePeriodSeconds: 0 + priorityClassName: system-node-critical + initContainers: + # This container installs the CNI binaries + # and CNI network config file on each node. + - name: install-cni + image: {{ template "system_default_registry" . }}{{ .Values.calico.cniImage.repository }}:{{ .Values.calico.cniImage.tag }} + command: ["/install-cni.sh"] + env: + # Name of the CNI config file to create. + - name: CNI_CONF_NAME + value: "10-canal.conflist" + # The CNI network config to install on each node. + - name: CNI_NETWORK_CONFIG + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: cni_network_config + # Set the hostname based on the k8s node name. + - name: KUBERNETES_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # CNI MTU Config variable + - name: CNI_MTU + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: veth_mtu + # Prevents the container from sleeping forever. + - name: SLEEP + value: "false" + volumeMounts: + - mountPath: /host/opt/cni/bin + name: cni-bin-dir + - mountPath: /host/etc/cni/net.d + name: cni-net-dir + securityContext: + privileged: true + # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes + # to communicate with Felix over the Policy Sync API. + - name: flexvol-driver + image: {{ template "system_default_registry" . }}{{ .Values.calico.flexvolImage.repository }}:{{ .Values.calico.flexvolImage.tag }} + command: ['/usr/local/bin/flexvol.sh', '-s', '/usr/local/bin/flexvol', '-i', 'flexvoldriver'] + volumeMounts: + - name: flexvol-driver-host + mountPath: /host/driver + securityContext: + privileged: true + containers: + # Runs canal container on each Kubernetes node. This + # container programs network policy and routes on each + # host. + - name: calico-node + command: + - "start_runit" + image: {{ template "system_default_registry" . }}{{ .Values.calico.nodeImage.repository }}:{{ .Values.calico.nodeImage.tag }} + env: + # Use Kubernetes API as the backing datastore. + - name: DATASTORE_TYPE + value: {{ .Values.calico.datastoreType | quote }} + # Configure route aggregation based on pod CIDR. + - name: USE_POD_CIDR + value: {{ .Values.calico.usePodCIDR | quote }} + # Wait for the datastore. + - name: WAIT_FOR_DATASTORE + value: {{ .Values.calico.waitForDatastore | quote }} + # Set based on the k8s node name. + - name: NODENAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # Don't enable BGP. + - name: CALICO_NETWORKING_BACKEND + value: {{ .Values.calico.networkingBackend | quote }} + # Cluster type to identify the deployment type + - name: CLUSTER_TYPE + value: {{ .Values.calico.clusterType | quote}} + # Period, in seconds, at which felix re-applies all iptables state + - name: FELIX_IPTABLESREFRESHINTERVAL + value: {{ .Values.calico.felixIptablesRefreshInterval | quote}} + - name: FELIX_IPTABLESBACKEND + value: {{ .Values.calico.felixIptablesBackend | quote}} + # No IP address needed. + - name: IP + value: "" + # The default IPv4 pool to create on startup if none exists. Pod IPs will be + # chosen from this range. Changing this value after installation will have + # no effect. This should fall within `--cluster-cidr`. + # - name: CALICO_IPV4POOL_CIDR + # value: "192.168.0.0/16" + # Disable file logging so `kubectl logs` works. + - name: CALICO_DISABLE_FILE_LOGGING + value: "true" + # Set Felix endpoint to host default action to ACCEPT. + - name: FELIX_DEFAULTENDPOINTTOHOSTACTION + value: {{ .Values.calico.felixDefaultEndpointToHostAction | quote }} + # Disable IPv6 on Kubernetes. + - name: FELIX_IPV6SUPPORT + value: {{ .Values.calico.felixIpv6Support | quote }} + # Set Felix logging to "info" + - name: FELIX_LOGSEVERITYSCREEN + value: {{ .Values.calico.felixLogSeverityScreen | quote }} + - name: FELIX_HEALTHENABLED + value: {{ .Values.calico.felixHealthEnabled | quote }} + # enable promentheus metrics + - name: FELIX_PROMETHEUSMETRICSENABLED + value: {{ .Values.calico.felixPrometheusMetricsEnabled | quote }} + - name: FELIX_XDPENABLED + value: {{ .Values.calico.felixXDPEnabled | quote }} + - name: FELIX_FAILSAFEINBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeInboundHostPorts | quote }} + - name: FELIX_FAILSAFEOUTBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeOutboundHostPorts | quote }} + securityContext: + privileged: true + resources: + requests: + cpu: 250m + livenessProbe: + exec: + command: + - /bin/calico-node + - -felix-live + periodSeconds: 10 + initialDelaySeconds: 10 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: 9099 + host: localhost + periodSeconds: 10 + volumeMounts: + - mountPath: /lib/modules + name: lib-modules + readOnly: true + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - mountPath: /var/run/calico + name: var-run-calico + readOnly: false + - mountPath: /var/lib/calico + name: var-lib-calico + readOnly: false + - name: policysync + mountPath: /var/run/nodeagent + # This container runs flannel using the kube-subnet-mgr backend + # for allocating subnets. + - name: kube-flannel + image: {{ template "system_default_registry" . }}{{ .Values.flannel.image.repository }}:{{ .Values.flannel.image.tag }} + command: + - "/opt/bin/flanneld" + {{- range .Values.flannel.args }} + - {{ . | quote }} + {{- end }} + securityContext: + privileged: true + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: FLANNELD_IFACE + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: canal_iface + - name: FLANNELD_IP_MASQ + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: masquerade + volumeMounts: + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - name: flannel-cfg + mountPath: /etc/kube-flannel/ + volumes: + # Used by canal. + - name: lib-modules + hostPath: + path: /lib/modules + - name: var-run-calico + hostPath: + path: /var/run/calico + - name: var-lib-calico + hostPath: + path: /var/lib/calico + - name: xtables-lock + hostPath: + path: /run/xtables.lock + type: FileOrCreate + # Used by flannel. + - name: flannel-cfg + configMap: + name: {{ .Release.Name }}-config + # Used to install CNI. + - name: cni-bin-dir + hostPath: + path: /opt/cni/bin + - name: cni-net-dir + hostPath: + path: /etc/cni/net.d + # Used to create per-pod Unix Domain Sockets + - name: policysync + hostPath: + type: DirectoryOrCreate + path: /var/run/nodeagent + # Used to install Flex Volume Driver + - name: flexvol-driver-host + hostPath: + type: DirectoryOrCreate + path: {{ .Values.calico.flexVolumePluginDir }}/nodeagent~uds diff --git a/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/rbac.yaml b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/rbac.yaml new file mode 100755 index 0000000..cd39730 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/rbac.yaml @@ -0,0 +1,163 @@ +--- +# Source: calico/templates/rbac.yaml + +# Include a clusterrole for the calico-node DaemonSet, +# and bind it to the calico-node serviceaccount. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: calico-node +rules: + # The CNI plugin needs to get pods, nodes, and namespaces. + - apiGroups: [""] + resources: + - pods + - nodes + - namespaces + verbs: + - get + - apiGroups: [""] + resources: + - endpoints + - services + verbs: + # Used to discover service IPs for advertisement. + - watch + - list + # Used to discover Typhas. + - get + # Pod CIDR auto-detection on kubeadm needs access to config maps. + - apiGroups: [""] + resources: + - configmaps + verbs: + - get + - apiGroups: [""] + resources: + - nodes/status + verbs: + # Needed for clearing NodeNetworkUnavailable flag. + - patch + # Calico stores some configuration information in node annotations. + - update + # Watch for changes to Kubernetes NetworkPolicies. + - apiGroups: ["networking.k8s.io"] + resources: + - networkpolicies + verbs: + - watch + - list + # Used by Calico for policy information. + - apiGroups: [""] + resources: + - pods + - namespaces + - serviceaccounts + verbs: + - list + - watch + # The CNI plugin patches pods/status. + - apiGroups: [""] + resources: + - pods/status + verbs: + - patch + # Calico monitors various CRDs for config. + - apiGroups: ["crd.projectcalico.org"] + resources: + - globalfelixconfigs + - felixconfigurations + - bgppeers + - globalbgpconfigs + - bgpconfigurations + - ippools + - ipamblocks + - globalnetworkpolicies + - globalnetworksets + - networkpolicies + - networksets + - clusterinformations + - hostendpoints + - blockaffinities + verbs: + - get + - list + - watch + # Calico must create and update some CRDs on startup. + - apiGroups: ["crd.projectcalico.org"] + resources: + - ippools + - felixconfigurations + - clusterinformations + verbs: + - create + - update + # Calico stores some configuration information on the node. + - apiGroups: [""] + resources: + - nodes + verbs: + - get + - list + - watch + # These permissions are only requried for upgrade from v2.6, and can + # be removed after upgrade or on fresh installations. + - apiGroups: ["crd.projectcalico.org"] + resources: + - bgpconfigurations + - bgppeers + verbs: + - create + - update + +--- +# Flannel ClusterRole +# Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: flannel +rules: + - apiGroups: [""] + resources: + - pods + verbs: + - get + - apiGroups: [""] + resources: + - nodes + verbs: + - list + - watch + - apiGroups: [""] + resources: + - nodes/status + verbs: + - patch +--- +# Bind the flannel ClusterRole to the canal ServiceAccount. +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: canal-flannel +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flannel +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: canal-calico +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-node +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/serviceaccount.yaml b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/serviceaccount.yaml new file mode 100755 index 0000000..582d55b --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/templates/serviceaccount.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/values.yaml b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/values.yaml new file mode 100755 index 0000000..feeaa7d --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.13.300-build2021022304/values.yaml @@ -0,0 +1,80 @@ +--- + +# The IPv4 cidr pool to create on startup if none exists. Pod IPs will be +# chosen from this range. +podCidr: "10.42.0.0/16" + +flannel: + # kube-flannel image + image: + repository: rancher/hardened-flannel + tag: v0.13.0-rancher1-build20210223 + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + iface: "" + # kube-flannel command arguments + args: + - "--ip-masq" + - "--kube-subnet-mgr" + # Backend for kube-flannel. Backend should not be changed + # at runtime. + backend: "vxlan" + +calico: + # CNI installation image. + cniImage: + repository: rancher/hardened-calico + tag: v3.13.3-build20210223 + # Canal node image. + nodeImage: + repository: rancher/hardened-calico + tag: v3.13.3-build20210223 + # Flexvol Image. + flexvolImage: + repository: rancher/hardened-calico + tag: v3.13.3-build20210223 + # Datastore type for canal. It can be either kuberentes or etcd. + datastoreType: kubernetes + # Wait for datastore to initialize. + waitForDatastore: true + # Configure route aggregation based on pod CIDR. + usePodCIDR: true + # Disable BGP routing. + networkingBackend: none + # Cluster type to identify the deployment type. + clusterType: "k8s,canal" + # Disable file logging so `kubectl logs` works. + disableFileLogging: true + # Disable IPv6 on Kubernetes. + felixIpv6Support: false + # Period, in seconds, at which felix re-applies all iptables state + felixIptablesRefreshInterval: 60 + # iptables backend to use for felix, defaults to auto but can also be set to nft or legacy + felixIptablesBackend: auto + # Set Felix logging to "info". + felixLogSeverityScreen: info + # Enable felix healthcheck. + felixHealthEnabled: true + # Enable prometheus metrics + felixPrometheusMetricsEnabled: true + # Disable XDP Acceleration as we do not support it with our ubi7 base image + felixXDPEnabled: false + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: true + # Set Felix endpoint to host default action to ACCEPT. + felixDefaultEndpointToHostAction: ACCEPT + # Configure the MTU to use. + vethuMTU: 1450 + # Typha is disabled. + typhaServiceName: none + # Kubelet flex-volume-plugin-dir + flexVolumePluginDir: /var/lib/kubelet/volumeplugins + # calico inbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeInboundHostPorts: "" + # calico outbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeOutboundHostPorts: "" + +global: + systemDefaultRegistry: "" diff --git a/index.yaml b/index.yaml index e90b893..bf3cbbb 100755 --- a/index.yaml +++ b/index.yaml @@ -63,6 +63,23 @@ entries: - assets/rke2-calico/rke2-calico-crd-v1.0.001.tgz version: v1.0.001 rke2-canal: + - apiVersion: v1 + appVersion: v3.13.3 + created: "2021-05-12T21:12:29.0241624Z" + description: Install Canal Network Plugin. + digest: f415764a39ece22f38d6b446825ae056e4b1f45cf60e140a0b8fba56df6ea3f8 + home: https://www.projectcalico.org/ + keywords: + - canal + maintainers: + - email: charts@rancher.com + name: Rancher Labs + name: rke2-canal + sources: + - https://github.com/rancher/rke2-charts + urls: + - assets/rke2-canal/rke2-canal-v3.13.300-build2021022304.tgz + version: v3.13.300-build2021022304 - apiVersion: v1 appVersion: v3.13.3 created: "2021-04-29T00:16:16.864175502Z"