From 781054545bb9e6ea19476094b5eb4c988b69f6d0 Mon Sep 17 00:00:00 2001 From: actions Date: Fri, 30 Apr 2021 08:57:03 +0000 Subject: [PATCH] Merge pull request #74 from manuelbuil/calico Add Calico helm chart --- .../rke2-calico/rke2-calico-crd-v1.0.001.tgz | Bin 0 -> 12731 bytes .../rke2-calico/rke2-calico-v3.18.1-101.tgz | Bin 0 -> 26478 bytes .../rke2-calico-crd/v1.0.001/Chart.yaml | 5 + .../operator.tigera.io_imagesets_crd.yaml | 76 ++ .../operator.tigera.io_installations_crd.yaml | 1202 +++++++++++++++++ ...operator.tigera.io_tigerastatuses_crd.yaml | 104 ++ .../rke2-calico/v3.18.1-101/Chart.yaml | 7 + .../v3.18.1-101/templates/_helpers.tpl | 7 + .../templates/certs/certs-node.yaml | 13 + .../templates/certs/certs-typha.yaml | 23 + ...d.projectcalico.org_bgpconfigurations.yaml | 141 ++ .../crd.projectcalico.org_bgppeers.yaml | 106 ++ ...crd.projectcalico.org_blockaffinities.yaml | 59 + ...projectcalico.org_clusterinformations.yaml | 62 + ...projectcalico.org_felixconfigurations.yaml | 550 ++++++++ ...ojectcalico.org_globalnetworkpolicies.yaml | 769 +++++++++++ ...d.projectcalico.org_globalnetworksets.yaml | 51 + .../crd.projectcalico.org_hostendpoints.yaml | 106 ++ .../crd.projectcalico.org_ipamblocks.yaml | 79 ++ .../crd.projectcalico.org_ipamconfigs.yaml | 54 + .../crd.projectcalico.org_ipamhandles.yaml | 54 + .../crd.projectcalico.org_ippools.yaml | 97 ++ ...ico.org_kubecontrollersconfigurations.yaml | 230 ++++ ...crd.projectcalico.org_networkpolicies.yaml | 750 ++++++++++ .../crd.projectcalico.org_networksets.yaml | 49 + .../templates/crs/custom-resources.yaml | 17 + .../00-namespace-tigera-operator.yaml | 13 + .../tigera-operator/01-imagepullsecret.yaml | 15 + .../02-configmap-calico-resources.yaml | 27 + .../02-podsecuritypolicy-tigera-operator.yaml | 47 + .../02-role-tigera-operator.yaml | 249 ++++ .../02-rolebinding-tigera-operator.yaml | 12 + .../02-serviceaccount-tigera-operator.yaml | 5 + .../tigera-operator/02-tigera-operator.yaml | 85 ++ .../templates/validate-install-crd.yaml | 16 + .../rke2-calico/v3.18.1-101/values.yaml | 31 + index.yaml | 22 + 37 files changed, 5133 insertions(+) create mode 100755 assets/rke2-calico/rke2-calico-crd-v1.0.001.tgz create mode 100755 assets/rke2-calico/rke2-calico-v3.18.1-101.tgz create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.001/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_imagesets_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_installations_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_tigerastatuses_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/_helpers.tpl create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/certs/certs-node.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/certs/certs-typha.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_bgpconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_bgppeers.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_blockaffinities.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_clusterinformations.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_felixconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_globalnetworkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_globalnetworksets.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_hostendpoints.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamblocks.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamconfigs.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamhandles.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ippools.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_kubecontrollersconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_networkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_networksets.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crs/custom-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/00-namespace-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/01-imagepullsecret.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-configmap-calico-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-role-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-rolebinding-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/templates/validate-install-crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.18.1-101/values.yaml diff --git a/assets/rke2-calico/rke2-calico-crd-v1.0.001.tgz b/assets/rke2-calico/rke2-calico-crd-v1.0.001.tgz new file mode 100755 index 0000000000000000000000000000000000000000..7dc38e74d2f29bee33612203c811236490f2f146 GIT binary patch literal 12731 zcmV;sF+|QEiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYQcigy+j_s_v)v{$z;+;%ZD{B&+8Ou6ujk9Mb z^TcQp-HnJO7yy*jv)S){4+;SPg9KZ0W^%9i#&Q!Z6o5jZP$<+-T+`>Xh$JlHvq;2; zr&}V_d`Hsci+g((i^byA@iG3pSS;HAE{?ujd~tNVIDY=+@r$DuufA9u9WP!Se*ug8 zW5NFvQW5dR;?8xo8}~2rkeq#>LNcDchMS{DF_n>Exx)XSXHtbS^OGK3#oYeo=RSbh`ym~mNA^%DODsUioAXVK(dT0obyuu7a-!9 z5nLT z;r?7xTvCNUB}}Ss8$W-?qF8Y*QpeRKGt0kP+8hDv4Bvewat zIZ#`oN|JzYTqi+H^Mvo@9Imz$Sp>eu67|~XZB8R)YFtrZnJ!VIxaJ}y3O;^yLj)t) z=Ihy4f+mzm`t?Uc`J;KGJ{r!MgpV{+ROEt5`VrW=MbR!bC^^fVM)1LWk6&Klz%FT2 z2zpkd!qt|FPfSu^rl8SdALli~$c$y~Bcz2?kP;PbvCVeCTo+iLvHzOA#$=78mS3g2 z#`NU@s4bHvt%zj0&-h9ameCkiJIIOD0)!+#&Stjc$9jh*WTPoIDqXRRh+Wl~Tm5L2E1;$)m;^y{K_$)1Ty78sU5I4BSAV0Cn!}O` zO$Owa7fGxq{0$Wf1daG6V?UL&rE4HAFRDe8>2b|S0yiWn=mC%{hLr3;P+bcYS&beR zk#l&nh={gK(MT17 z9+I5Rko63e*F24XC9JBGPa3=$>qaWUvQ6y;s+oZi(E3ITDY2iLR#YAB1mykM@(Ntl zI2i5T$9}Iql+_UE4rAGx3Nwgn!BeD3vpDB0GeR9DjArfbm&Gb&N{{>B3sfnJ&*2oc zxt8W4kBOr39L_U1B`Hl#iKL%>0CZ2wneN!IA*e4z?ZT$lYA@U>;u$Ze4pAA^r%X&G z6I!ShQK&p!$$5iV|71l;M_4*l335XkN@$}OA!^3?WJ7MHM^xTd}3+~ALW)j zfBEY5#{<2d;bLUl>I|G5hni4%B+*IrihHNdgM?Ga?=!OK2|as7EVnx%n%z@ zYKM45tCC)_X!+<--sLc9HA_Uou>)FnaQZH5U zYfz#vHA}^X7S!4=#j0F-U6Zu7E#zzXpZ|Si|J0j}D5ANd@kQI%fBd*%%j16|p2f^; zOyGwfADN12{K47m`p2JpGxjq))As*0D}90wU~vEceDU)6(NSyvfBa(c;$i>)&v+iq zX0u1XP$xiL+V0O0P@~#*2Gm}49RhW3+D?Hc&Cl)_s8y%?cFi`0pl125zv62+#hI;F zH2YVzf36!ACkj%oZOn`s5?MrRdqKMyVG?AK=UkYrfGX`G-J%#C$8=4KL_KcrzZ?9X zT%J2FB}5$UAoYohYi%%SW6S;*a-Ohg2N6$mp6PwgL4DVo#oGS7VKJ4kp&1n3Uf&}G_#gGNN_cd=WIuTwVVzEX@}KULn(jwoJAd;Y9eeZ^5}Iw)c7P-} zCoM`WNfNFX!E6IL6|;=T*xSfl&B90tYg>uU$BmF?r6$zRU%}J!%bVk82XOTKIsX0X zS-*&z$DH5keT#bWe4w0>Ty0fua39nEL@XA;-HW|g3b1aq6Ei`wO=S<9Uk>(!o(Nj) zMhTHJ(VwI3JBzvQL=e2d-Zl;Oxlkd*jS8q3B9hC(*c{=KbXNbYB~1;I!-BNSY1ad8 zT+pVcus3S*aDI7yIW+u!J!hU7QaBY{%4M<2XrJ@2S$43%hyVKSmT>w=6AEEo_-gnM8kv-eTG% z%fl@Dppnxs&C7E`@@)l962R&2JS$av4n%6dtR zFJxm&SXv~Co$Iw@O(Oc1#~w?eDX(ukUp4Jtr>x5#Jsp6x=Lt2dm!_qAO?UDf-f4sP z25sMUpa0H7vf-!f*vkD@u~wpWH0uVBv3ig12FCVMfxR)dCh2F*gjC<~qV37`cH1}Q2YRq&IYBC&h!K0Zdm@6Q zR8irNtib7O>;-cmVu>8M^+?lMQK@Ehz2-u}nk9-3wi#+8N0VfBo$*gK%I1t|Ov+ZA zCzSY1{gPNxaVK zDs@`+uquUw@%6rpv{J@nTl$t{WJ6P$^&DX}wM^eP^-XckW8B-6ajvy5mTZ%;Z1din zoAKwBY{+Z(MT_!yspG}(UX7Rf?a}Z09d0u?JAGry zofhJTK7Z+>)-3npxBY&OcDa|&kM9lRxA=lJWY8_Jc`l86Is8wG+L*0Ae*}69NyZP zOrvMbC4<-S_^Whh4@bW~)PI}u+D82P@w{Kw2D{dO@-ee(QO}F2LnfIc85=V`F3#JB z^%v(oXQr#2iRtr)kiqCe%W@K;I?gXo-nMwkd5q?w-BG5MnKW>!)!^U78To^HN18U? zymBnUjN-@3Mia5s=6GSkr7f7;F!&AL%sIU{A0T>Z_%NjGEnRaN%v*_D@WS;EpCps8iw(M`!uJo|8Y>Zj{U3;swVv?$AG!9VHktDIV>P)P%HCMw(;)FAQ;yr5PB#Ub? zdM1uIra8@Gnngax0k}JqefQ#B2S}O|Z9XQux$dlys6S*C8`{5O!|190Y&i5y7bpdB zpiDXVLuH)c?Y|ElJ|&+afqmSnemym$qZ&feULiWE4(iWT^;Cs3UK($hZ`KYels|rZ z=BEcI-!6T=*+50oNA+wv)l!YXZ{U0lc+bzE&c_y($1gSO<~Q?+l5n)-5*R`igp>B>QkIJE5<(1bHRdpvK3b>EoY z+uJto)pbM0ue<*AzI`ROdYZOy=L46L#GP40c!!VuMD0$*6zgfGZHJb!T9iS_(S%e1 z4Gy&_(cx0}Wf7^$t)hj^y?kF|q<1)QFGMQVw56Z*Z8OHr-;#!Z)9CB*a;KM}z?uV< z>ax0-ekFYm>7j*xhKGUPmsh)d>+@gDP|u&17cqT0Ghi|Aj!95A^$jLQMt_o}NR}6c z5|%RWVqvcTmA9hkPI_Us=&WJP*y{`ZfkKhU!u1BpC)_J{v(kgeO zJd0?q@Q>TmpTwP3RZXP+3_H*{~F@z4p!O%%d$HOtTRP0 zq@%2ZNq0rZn2FV0HlH_ykgny_`8Jzen^Qyn@ zMp{G@Sz+0PT$k;s)C8=!P#28fDV&3_mS|vZPK23+O~O|gEQQHzdtI1XY?Gum+!OblMh|WUs*bqg2^IAe8$sPy`>M<&scOHOZXvzl>Pm0P+x-#T z`n&8Eavqy~dBr|j*-DXUYmZdS8{EnEJM#1-R<&>vt6!DC)03~R>F&TJO`z*Fjnvn* z$axp%(@VD;-mlzWU-#LVWA>$~HOP)W!=k{l*c?Wgc3|@i72P4o^Bm67T=^ZFDJ7Y- zQ73v7>qO)n@HDJ;x5FAg)|cS7%>{)EzSKigB=i6-1zl57{esr`1wXr`QK3BX>H+(Z zYq|^Su5ani<&`t-yQaG;zgZ>yR;2yyQrz~Zr{AvW&O}aXy4R*ws>}Nqz*2ZzB9$}r zk^Q?7_lTz}mKo+um2O~ltzM$m)q|laNn+UAx04-%K|TG>wWi9d0YumTMB5?uM#`4u z_6&5m0p+!COVq>}n*PDIo&CKa)s-&n8}pNwuKidK%ijxjLlQiC!^=u>M1--0Y~~cn zjf@bjeY_MSl9j5bk_0@cAn2-NQIQY_i))*bQ~l%z0^* zUH6ED1w6&i{CuV`EPqTQP(Ay6@DN=e#R8Nq4 zGoZLp*k+AEW2zR$Z#`jpySvq+-otA}r|$x0^|q6=WL3_hzFsQ#kE5400MADyz*Ci2kLuNhx3E(9-aVok72P69mNXKy z&mY%K#akCD zqDX8~lITY3FdpF@YT5U$AyqOEn(<<@MfZ;GXFVXjYyc$GL}p`F6?cqf>BTO$8_Oh% z%}YsAdmkbvQSX*xY=4%89tJ(Rs9`EtrqpDAF~6bWhS5)lHsjdr6I0unX_!33mK^>H z|M4!ASMT1udkrUXY)^m-N!LYUEG{{(Wjs8J$n59|Rj99> zHH$lU?|XxC_1M&MP2~wun5jS;c_p9bZRBdS?AvFYn zXU(0L`yF%FYmv&VEm*ga`bA8y$2U|6OxH@X9ehI*c6-`LqgeS6?cR;-Y?iYAsa7T# zL#wQZe@(#1ax>?c+6ukU^qJNjuDW#(ryLpDgy{kJ9&>;$mEMkSdK_4t(QSS(9Lixc zYxXqEq#o50hhz@Q({cUTTXOq-Ms5g8Fj*w75L2U~1y2%|Z49>|q4w|12aYov^Mp4k zd~y7;f4LryWk?$%?mtT#IqnTT>J2>RZ3@U$?YKTG(iN`d@CJ`gmQ>lBTU(;_ z+t6iFJzHwh9ann*BYJb|?65OS8`~?%li?#)%g|GL`x;(813W{`sfcK%^o~ZGe_WBI zkMRMj*d*(imdb8cD^5*yM~h!So5P9a(bh0Plu5k+XsZa1dj(JHoUV2tc#*|sD%yju z2vZgh_vxZ^y;gR{(HzchNt!40wTs|1$7t5E@M7`np~GNeb5Xun{Mt3V-HYY`&)iaU z9-{$@qR28g+UC#=50jp zBMKKgbDLMO)O*?iHdA`3r-@Kf4-V4Bo2Ko~;gU`es?0hs@Gh%_B8QBAYR@JU{H&Xl zc(zIId6z|I$2xs5=x|k zFHJ{q!8R-#h;j$N_Gs{ogOwyWOwy`}0irbp;tveiD>~$Ug5IxoIqD%R_Id_7eRpa! zU2EC&G=d9w{4RS#6N*dgo66?|qpVeuncKMc^tP$K~ObD;)W!sFG@vOM{BCb@lC4xkX3MLhce3|2sGHR-+);Q)H z^0MD)!bPokE&i;@vouSi9tu$;UdIzU+%@C-UOvPO%Ra@%_fVn>mcoCwL=O|BqU@-lYx0qJ)<+i%e0qS6r&)D(9C#TospQRg98&+V*q{z zcfa+gJb_1&7?EScEUxJeNm)#wAbL|I!8`*ITivIly>aB4!CS76f{B6)@&eU^$l`l~ zW7Ml>EN-g%w64kw22f3CuhKe88~=P=B0lv5R!yLIo*lpiSNb0p#_@(zdBN40ft2{8 zIv7L=?LOa)s-0ScrVoZ`_nt#>QagODV@}}?Vahg8XKsE&6!3KJ;fgWt2 z2OFsOd9Z;VY@i1l2p(*p@!}z^3?^*6P?H>De>T3twg;@t&TW!z)LdPoEvsW#U7>r; zCKNLebw{(K#bQk2LLv4b7-la_N@g{`;$Sh;(?fpgkTDw*fqhd@;}Jr59Nbl__+TI$ z(*7)wa2;y<2aDYh!N_RV?I#~hF?Rr(3mzBd2B=NLq*Z{)%3o$L>uK{9BIYk?R0vv2 zYSzll)II3-1zmb_GR-^{g`ds&aHuhsqsd7V28~NZQ>U3qcEDFS`ePW>ez2{*FsMy# zfu7mh$tI+WxglM%tb(?;m!C6tlbqjBkr38rXqMrW(=&+=Vr6$3o`{$2(Ipl|dk`~w zoOu|+&hD^&Px#pojG+wynH|T_8UwHzLl8v5akb$t*xCbKR-tb1jjugGz0_U97~AlR z8Icj(ZTL*s+ps_W_5j5pw82qK(_hAT4B~Rbov^tFI*zUP#OEHMX^^}3#poVkb^yH_ zLiSssKC~btZ}?nj-mn*JiG^V@d@n@^ZN`Sjl+Gpa|Tey;cm#|1DxwccW?CZ z0lJ#OJ0p-o@S+>C+=il&cRKst5Xs^5ppwJABa=hGMqyC#52BPq*zBB&Rt}#Du^c`Z zYB_us+xaOu@Jthj9|!iJ1P)IcBEA{ z$K*a(vLlp7kY*wD^e@;d2|ND^L7s*E(Pu{*Q(@CiM4%npXgYk_yP?oRAQCNvq0x5w z@jd`sp&zt$B3dhiOI9E{ZKtvKg;48h@O~(@!R-z(P^aRkcY5fau+-sm;i^ArNyOf^p}&B?ARz0Dm6B#bgMF9zGKmJ?xK1KcwO+r1~kC^h1XKozd#y zK9Gn#$n`LWUJn5#S09Q!d|o7b2r?D?i1r=!rl8sn`A$5z%XdV!4{I)rBHVYHeNQO& zus72E*lxZ;d=EvtAE9WG>!%^!kI?*0o9YzQ`^mKL2l*cML%$yrf;F^|n8Oh8$M&He zvg0WDW1QYU=5wuEgRr07GajKbii!_`$oLS5jt_wd`4GCVACL4HK+A^-K!joHej0NA zpu(T5^1{*c;VuaJLw3`*%K*i+59PBV%A-j71B9uCxSEKjKjitY7DI- zuMQnE;sen5;WHxg!#=3|Fm{;pxzYJy8bUt=n(;wM{hjtrLhBz~(Z`VdA;4%EMD&MI zRDYO&><{5aNI1ej+y&)-uy+mG{zRnzL5iAGO49)xMwoCP#qc+FJ~|y@9l~JNVItHz zOoLm8UoPZ2+zoaeI-WKQW8MN@x3S74@cJlEUBR?~xs%bK?iHFGrlenRGwngF|MkVX zMEh?EHp^;)J<1Ya_XxH#uQ0HwtcOW=sc@7kn$Oh@U&ITj?*Z(TL_Z0dz@rp98P4%S zK!p~nxPg7lO_Cd&TC=#s|<)!97N%qxYZcAs0AiV1bz?Iskr<= zZ(S~l(!bydK^ol}RUK0SPlxS~dcUmTMr*%eH~HFb(B`tTk0$rVee9ib9vja_)fC)i zC`F>JJ#cdv*WO7?vYmxpuEM7rB(}h_wXd$}?!X{F81(J0&5auWo_Slv!BxZmmHX>! zpG_QM4;v1G_XuYOE}UhtIl_brW!fT%JD~evAMy|yzab>&faj=9BoA$r4H7PMs!_P$ z4io4AE-|xG^$YGOO3?EmUV{vjk=&3?Buu(%!gDv0Le>zvZL-H<*EF9G_T@F*$uei% zwW)aorW@+HHeK>NlUMKG&Gd+Px?-7y5w|eyrsm;IT#}T-lg0R7Wbdw>ACj%IF#;uK zrWj6CIed~1m4CB0DW%IrsM~t>_kvW{Ovi@Q6}JTRko~=2Hzc7M&aY1_i6bIRu!&J5 zgA^sV08FUiB9c|G`lX~uMAxq2unzlAh@zX3-FR3uWGU`T8u4s6%WhL)x4*29CLW$q z!FW8j{ZlOMK;u8PD3(_C`P%8WQelkDp2~Es{N&mOFfb_3s#T=Y0>kREp23VM2MjA| zneow0Lp!V`*+HsnE)W~>sSSChH!M=m=J4NCa1`5&Zir$xWv0rJTr`L-r|kMnBrM=5 zk_48fG-l}1e&!Z#bHFjw?AqPjS3}nk!?v8*gkb6V;DGTeHEls|o1zkem7;ZYPu5VE zezrO#DRJ?FRCFn1f75bGK+p~1Cz}~}$C-IYlYgDi+YdY`QV;Y$bS?rkKCl_Z&=9Pn zL>n(8Le_iu)*7**)pyandK;L!VO7pOgDhsw`k&zS=3a6xy#qqEdu`7WjID8Ty^E{8 z2RxgDt`F<_$LFrFbN0FzM%~Zl5gKm6$%gtD#ZI209>}ydX0+`y4@KOSS*Tl6IkHrq zoZxRg2yOcP&r8SAQAk%u`+B`(3fw(nzz^Z*lyl!#hxW3)|&xGp+6R_Q?8cJ|C z4@DQFJ`C^%p(0)+$&yBb`uv{F5V+PS_6Vs=kX>e9l@`m~ICs2`7zo0pQL_D)nj07n|KKh35b5I(_!K`UaGK{eU=$8V^(Vf53X&4D@l z#ME|X5yuX(RfoUAe+Cz517m#>$2QWSkaS%n4#ELQ&OT5f5t#p)W$^(NEdIlgAMx`q z+uhYCU{-a*XBumEwWDws9DNhYj$190VV)4BWo8OQh0xMhvODi^;2~P_g(kU=H-nDvIBed0^Q};;!Uld- zKGtN1u1f2FYu-|J7B3$-PH%Uo(VJ@~Fp1u7$Q9&2U-#Zqn8De%OV1l$@X8EMyx+Xb zX|~+5wJ&Vk;L46<$QhZI8IS2;Hf-p-=^mO8JM)Jim@L`%niJbRO?X}0;%b#C7+!78 zcJK{N*zIWpN450ddT82REZMp2ne{Z64vxCr4qY7Qf!`pl1^240z$LHCU4KKzQ$vky zJoVrhjOC?4J_tp0ZGJQya%4f!eHOGsB{!rF%7_d7>05I9eGOk9SEhY$B8WPqbm&DH zi$m?Ww4ro(ms`%^(s*-B`dT*R#=&fhzi-20&tW#3*=5-LWQ0|5SaWU34p8I;W--2@ z8Hz6^>dWZ6^#SJNLa)gu-S?5UcrXhZtmqt;{u4Ja5s7cgNJRMPMrGdUypMBOQd(Ln z8>Y6!Y98^lX0+7*#QR0^@Wsm)$1nZnLs)D~+K`Ch^ZtO4fGObs6G8!+LUdIN`S9Y! zt1THjFn6=8HY4I{kK+*7jbq4`9R*Y&E6I~WQODR*dixq)J_9^M!Lru5EDn?78T z#FiVO+5?Ag5v7#ftXCYHDvuVw9s%D4IBD_9q+VpS<)$1~dX3}N4g@bkKsk!s9)U(A zv&m2v6&ihM?HtYF?3Sc?LSJLl^9WUC4^^!@=EdUI2f7z9(x3$bm@x| zMV2`!u#o&Yj{}g09k#*Ts^|;k!ks|H&rpgG@kebb6J{i(;(0zA*MLD7nHyrFaM?9^ z3KUDt_OsIcL?}57WNnz`d5*W@+ug_|?Fd|EoH`>k@$S8ZB8QBAYSS>6Ty(<|y-9?3 zdV@NiT3AyuJm}4}o2%#-cZNblX{^m0#Yf}W_0!}_+Z%=6AWJvv*?i{b$nwPE@bE)bAM^aiUgSwd((i zPfPvWUemI&(rM~Ht-K$nDdH!ctk*1KDnxv*>gC%Fak1bg>ld-5d;+{Bf<%f6CY9d1 z=@ksAqdwes*MV8(2Ak7q(nal)T6|@r4Is@TJ(AnGNT@w5(G9ul#byKkC20HxWn@{h zaBhx`&ClildNi|rC$`D9h+6lNsSG3DTtti>hcTmzH%ug=m~>e%T+h+lTu@98Ek`|F z?r}HbaRYjQZYrj5cOPxJHa>_M9<23-@nkRn%RHD@O+d;;=@725b`R;(+Ay2wsjCLD zCPJX7NP|v_!A8kgU$eP+!&0O6EbJRBjOhtXJ(1WmGoFtc_W&o573IJWFbElU^^elD zj7T7f|lC5XMR32=-2V3vK z)_bt^yp4OX_4?cPVCy~DdJndq_xXR()|*s;@i0zydj8q?h}&7q%iF`DQ@ZKytYdgy zp&QjEs5FqkN3)~FB1A%`Kpev)nB#DXn$>*DqeaaqjGc;vj%$dx+!Y=IkD{i1V|QVulCcOWM<&-P<-xT6SetyPHwITTzVvlr%oD zsdalZ=9`N; zOeH(uE1WVecz(@A9VWMj8mPHrls1`p4J@o&&JNT{S(hS>4GPmSAcpaTIWa8_FBl6 zR9uh^t^ZQ2L_4*m2|#=e|MS0(?4OSi0)Xa<#up@YC9hc)zjn7S@}v+XvHy*<31HH} zzz;t@G8NONM$N2AJv1t8!v^ZKk|KjL)as2$t;}=ISUVX86eti7$%P(N@&**?c zDk8pE+_|oHIUI!AUUJAie@Idr9|C&WG410-WYNDJ>O7_)nPn)lu|`vq6n&m zEaR%4`6(*%lFl|Xn_m|zx++)_Q-Q=?)i;azi}~V_y{ZXKL7R6)@sTz!bqyQAi~Ke8 zlrXd!y2+|pB#S>MOsa1?ufAhaHI!JB9iu2&hM5wYFSTlmxK_KT1`_2Fz>U*#kF=(* zXC_16!6{FQ)b-Y^wGrD=y!B~fM_llxizO#ntabA$DWg>XCV7Sz_F--M<^)^pVW%W|~|gx-RnU1uC}zwC{yzHL{`IMmt;tYRJLO$^W2aDP3TIHOk%k! zR$f3d4Op^jpKG{}9blO$aAPpEWVEFzadrdGX?AjX{^7;4@pF6QSetn5>^mOg&9=T7 z=v*0Tqz7PNU1X7&c6z&53$yG$8mVc;hMm>i=IO?nQeZMk8m{exx6yGaG5Zx(YhB+} zd6ON(SZi}w>Xr)WZjj(DGJ$=;HyQh>q%9qQ6Rz2vO_uHe-DYdZV+Lfh13~eweUa7Z zxl@Ind+r;i+-eZ%M^`NA?P8=*{r$%C+BJW ztJ1oB(qq7OEL&9D10$eyx5=7c_up3??ZTwrpDnK{zym!P?cO)p2P*lihCp{1%P`Ot z<4aAnI|Z7>IX5Z#C`1YCCIUAgn6k=WtvKFPuzN&vcR}wu^|mUd$tjWjSw`=30CZ2w zneN!IA*iqJ?ZTa%y<3$%<5i#Q%bZ4yX=5)q;q1n3S7)^ztGwKtgj8>INS%R(ei`P# zf1q01>J0BwPs@UBt!JikjU99BS5fZStD0;(Cas>u0f3X*;%0aHt$^lo4d^@fsjaK% z0(jF}9IMBBQsC|VvhmIAd1VvJbea7=C*Dj6F^GLIcJ|#}`hrt^;#Dg}(!8s1%q2=( z#cd)aud~+Wc(ALrr<`+}Xq7Qj%zHz4^Z+KMQtCZ_NF(2s8MF=%m_!kl(Abf%St-yI zEv;IAGkK=yt@mU&0Mdg<|AmECFvv zs5%MCSlT;)U4Ghm5q31ue0y&RgciHOl6yb;##}-Zxi;QoqvqL3rs^iKK4WB>5Pvo@ zwc7}L3U*pd)ed@ZQGtGRn9D4t0eW@|ukLentI%K~c!-N`HT_hTz#ty~e1O)p>Mfr< zY>^H?{wGQaiF+VeSlA~J3E?mQueH6q!Mi_`2PcuU%0m1+{(+D8r|hn`oi^cx3Ix?c z{I9!x=V9;Z0vd2XD)-b*7pTJ}7Uv{pM$tH_OwE~Ipbgpb=cDq`hffs#Br9Z>NL5pF z9PO}`bzxRmcsz!e|F}DOxZA@y7^Y@jNZzjsAz_Z-;*jNFMU-*`!@V0AQ=oH2_J95D z=_4nX_hz9P#?L3f<9~lcwdJ%=+W^8+WGg2z26L|iWl~E&J%RS$9!x)jVj`K(@)VmX zx~!7TqzY3=f&%Zu59FY`On?v=?m3OGX}IZ4)Zv?!>g7=E3d(5)cUe{H%`K4k!>;pK z>@R9tYs~Q3GYjgjgPbD4#@>9%Y=2&TC7?K+*x54;rj*C&Ra;v=r8t(d#l!vIJ65c< zuQh+0d&nW9jEqVjgxw8(?Tx2Wqp8CTAmFh>1&uDhqP)+1$}?rE8R(Kegrl}7;j~)o z^Y<~cqfuWzj;GF!cVV&%&0?CsLQElWsbkqI-`;dwDo{dp>#uD8`G+pxD$@QxJ$^Hc|K*#GTD<>XQTxf{;h+frXS;?}1UH z&0+!l0zJ$s2Y$Fnm~kD1Cgh34#>O}g*x8;x5QW#VEQ~Sxza--JCok-|4sOP0 zg#3F@NZ8R%f>9ekA27e%FDQa;HokhI-{}2^E=Ztgzq~9g&mzyDh%P|4yRV(?U&h2F zy@bo43U8Co2fSi4#lyI`en}$K@<98F0vXMBEKh|YPPBQ{L5%&wP-wT=X)!B+KzwOb zC8@G%#kYZg`?++3snu4qhnzAk#*d3y*0GOSS)%+o%gTmv=7QU`i5)vYZ zTTM@^w%A)LH>-Sbj|p{lEUJundqq7>)9G0(GjA7i%)(!At{$j0{bv>WU&EmvMMy>R zU&6w?wUeOK;bGCQpqP_PCXnjx&$1^#`O~L~8)EQ{G@8Q>m}~aU74Q8*Di?1|>_A6- z?4NV}dyG9YtD&TW!k|Dl{P+U>Q?27$+s(=I zo5<QO#!9!k01uNS4W1WkM}cy_z9-OzWO20w;=D2eILay5+V{J1)Hpm9_Gia$xj1=eCzeGBmQ#Bax%|BD+A|AXmIfMaT-y8Z;3kgTEnrN)fp{3 zw=4Qw*C|*!bAN$`ztb(<-uegU>tD_ln4D7CavSsklx$n^AjU zO2G69d36aiHv?O?**nJ(xrpI+eddGNbbVCcj!=5X>2(^W<1(Cqenxf^ywz&0#ekTf zG;j_<&5J%S=YIjO^`>m+i?H1|BaOrC*-`4_5uyq5JQyDL7xvwU zQp3d4txay6R41rn6zWpV9OVF@xhw4$uVM3Hp6&A=>H#&qLO@La<_ni>@y`ER%Pnzv{Y?`0|b7*68{z>un;jC$!3|v=F zMX0_pj@WT`MH(LYk;5CDRSOI@QtDA=PKrhh9mw^)fzKS>3=7 zdsu)D!GzBrbe!k>{S+$uR7p2CuF3}2@0>tS?geBUhM0q^xEt*eoHKe&p+=)LhJiUc; zQA{xPI6_0<)}!G|)SS9#O*uPX(Sq_GvaCYv!=wrT5-?;6vKfj@YAB_nF^nTyV2BJ4 zei{1=rG0&Zl|Pb-5?*zxG&{TvSLkx7vHT{ubkcM>Vzvh7iV-Hb5+5~=GD-RT@=-az zcYDlHw0bq1k_PitGMo*_k86Rh{&xsOFNEV3^ zUKB#u_c1ILOBpbmxptqH*Xw=v0X(*2x_#QyLT62WuxmGq$$j!D#lyo~Mk6%k=#Gt-1@aQT5TIhE!KUw@szq&9BJU~^HOzM_#9mo6&e;cVnZGa z@}=G-R*@@5j9U(k)InQIyV(%*+u(VUufaK_Cs0TaO0=fNL*8MHZ-Xm8gR#xw!X9d^ zudLlMf7+(qvFeK7ntN`W-}YeQcSS0}M!V$wEs-XB+di5ba@?eB=J%fZ4p=%JaIhNJ zoUzjxyu?mELs(K(0813CSgM57j9MPny~XTNP>Npx1+cq4045tlb(LHr)z7MbZWoL8 z#dCH#6cN$%O$AM_VmPyXCB@J|(Szw29{FNBMskOP=NI%7vA%mCq2iR{Ma|2p&)GCj z8Ol%|Io6w9ffVk*${;CmQvRIFS!z5C&z`JUsm!tkzFD?e%XdPCd(PeCRSAUSZywWx zIV5A8(6;&Z7f4|?;j@;NGK4x}EoBmuaP=^>nK$y|#Tz6Or`eVA@QcR2U_ zB_UpOP54Ka4e!_Z)`HLH#Lj_R z@yesQ39yTPeI-)Er2}{VCIx@q?GUY=z1ib|4nGHMg(VDW3^uG98ln-c2`kqw)@i-J`` z7rRwB0y2cwn!M3svn1aV`NI(%aN`+OW4&@HTZFF#Jocuo!B1_TPkKelV`6OfDvlA@ z2%y)pU9l2>uK8QLm8=U41HoIQ*7Y-j2M1O0Pq_8`@b(Re=D?IT;87_#4iS!XaI24} zOb)T3U~jRz-2Fo2M;51wbg<#x@TtC^0uH(_y;(hUS!V%wfZmiiZ1fq){%t-#BNjvmA#xU+Hx_O}eXchzg-w@He=J z(CV;*?BKT!bO(lphZO*#5<^e(vsFuKJx^KQaFsqVIVnD?h%I-8F@n5RsjP67p0ci;JQe5ge}6bQW((|L|$gnLQ`b_Ray4M}Z278FEZe}6Ss+`D8T`D=NkHTmoO z1YlA&5$V`f%!ZJ@+(Y;5JNudcp9RiUa3j<*wFoZUOneK9K!l-PtSx`s<9bAU*W3HYIWk?)J z2P_zogu?w}1+9E(dRP<{KUYKIz4_I2KPz;j>I-v8~3YX+mt0{+GxIk!UNHQ(^OB{S=7^*5xWyhQw zQe)gx0i{_z9ZUr_5BW{-?3hMQL|Zb48%a3)Ot%ajGsvtn9}wE>yrg$>TW8 zDQgowGuTdilT2GIMQN@NMuS9{q2bx6vKX8l_tk@h(vOsrhmh3loO%4U7;x2SXYq@D z5$;oav*Qb{_y^nkJ2qC)KD=wB@=_7?`{{P{ z8GHGLYNG$<#!NbOKB8wdk$>kl4ZU+Y@P zGzj!@Xu|_~lPyR*05z~qkVk?uJhF%P)x$zg+;E9QX!f2bhsl=GQFx8iFlV{XLSBWv&UTcL4AlwsMI%(7gfZBaP;9_equ zJz%+u!szz=OG+3uTu1Wlaj?l}ys3UwMR$1=jrtO2v_WdH_+w zj)r}KXbTccK#{mdE)HOY=7x_d>`+_;_BxQ@40hOqRM1I|b71@~23a zU@-DOV6@h1O7 zPoS()h*Bx)kRW^tW|x+ zl7IEXQJ*mHc}d&A5=`A=F~nr8`$aQxx5|`kD~VN6a*_7Zu^RK6L9Q}X1v3%*>j3>B zVs(Zc}}2y_>lItT*&```cL=qU(Q+ktc7A48|0 ze+>Nv{bQ&I^pj${8W-1}?er_`+PLhi=sgHxD@c9L9SeLI`m2%6M3(G^nL0BSKK?rE zk1=i6hf;Nq#C#`xqV-GdmAQz{cckwX1pdsnewk)KXt&*ce-2nPALB) ztHP6xBz*LfT28JAO0?iA+<5FGjJJBnU{A?AIOB4;`aI$kHfSMiG;rxMHex(pTUx=C zMD>Hp+uwa=8V6mKxYYQ3LpczvxmG%aEYlivZAXt<<^Ce3RX_Mzu)mJtr0naA|77e|2mK&^Vd^{g~jQ=~xOxlbd&Y?`|I1Y~%9LCQYkS+$1xLl3YYf zV@Tx%B&=;qB$-y@HfJ>vLcBua4J&n7upxUX1Di}JCB%NWncsPs=2bF4*^u3ECexRn zOPX|>GSMvBo{*);t5mselBVR!S+-7^dVau(r)2*T&wj?fx~7HZHfcV#xf7*vho!vQoB0jFzfJmeYDHt?;d1C({WyP* zYpRQuE$EXYKY%3j#=l0$w~jnDZN>P_Zmcnr{hyU_$eO#>A>~YO2j9(Zr*jPFqvfk2 zguS}9P0Ql|c6r2i&Ml*dK$J*qN6rM>Gr{r)Of9|A>;{dVMyk^sHY!m*AD*DV zQv>g-tx%!1%IlgEX=ero^Q^_s29_U@k#h01|95Mq;2n-1elXu^q^-*HpFJN=-pQiJ z&bA;D7&B=?U+v0mEfJN;8yrmHu+%uaFW#Aq=1$;Q-VDhIdSrr`qvt3FkD^tVuje#o zz5iR;x`rtb|IloRH~DXl;Ezj;zg%d~Q1vM>U_9yP8!PqMf`q0{2Y+>!4qw?0WvFB8 z2lh^u+o!D~=hf(@+A3=`U^m|x$Q+o>p!F-n12qdbJayNNnLI=)$LLGNO?G9nQ+VXl zB?<$Zsgj{(*aZF*l&#Z9Wm-};7tLHd-g2Z3$4MaCl_kP=jcl#sxKG^Wrqf;}Y;^9f zNdG}}+yAw<@5@*MuWsNd`7{yfheWmnh2^h3oDm#)GwV^TO#L!(q%XVYyUECE1!gNc zz)IS1B&fbk&en0E)x;CqxO+h(KX^e+w(-d9-#4}aQ&#mk$FD%Wlccb~OTNIFtrsw9 z>!B-`p;kOqFB2jDt4+e2@uXob23o1XaVo+|ub3P2RB_kZ7`d-hBYY*$@e)hJxMVfp z!v4IYCA+Ph8K`i5SwVOlK6H4f7YbOLDCA<~ux$awT-r--S7&-=V!<~Q zT|Evzsb9&UckEg~jKjpu=J9~voOpTS=~-^K3XEK06#qLyNCCBW(7zAoRP9 zAWf3MwQ`KYsn9t!>u#^M3az)NYZ8)m>o zjqcvcnO)h8*soE6&sw&){=wyyv1rHJufnF-mBl>>=L8FOh@>yqRzSmh5Y73CvvJ@u zow@5PP$B!+R&ut_tT8ofbxdl0-^e83LX3b&HB!UCeb20x%RYD0lkr#bq2kCAg{$w# zl*m)}5T@UOH#4woZb*W;gtYnA+U2J%8@cisLmmNS$v}vavo+aC60U8>SmW%-;iN}k zDUJ^>*q^1IZ@%$vV|?KhV^=1!VFvYA2EBg#Ya#aVw60yw%7%4?6v;0VlavOKGO49N zBe32Hik7U);sA(~$Ep(fWBX>W2FE@hFUydE{KEd6&A4&yLHz!DBI(xM;AcH6lTz&n zW!9p}nsIJ!ewz5NRR(qu9dA{;-p1NVS6kF1{?Gof*YE^{3S7b41r^aS8R}9T4e@&< z;ys!4M?8)|A;{q2UPvgn-;nZhhrARVvb~DCO}07pn`x8-Go*1jf1RGlbzC~iYAu(g zf~eWe({(zVid#OQSJH7gH5%xy{fe5{H}U~(7EKqFrE+3NHG(~?Z%=Rv7aeI{+^Jqp zPJN*Js|^B;NpvoDi+^4tO~$&`a1F=I1tap_PA8vK?&!)dJVqckWF1@qm_ofgMyfPu^o;kvs*SS<@`)>v+CV?NJ zlpIMxE1^>`QBwMySZF6V-6^aK4PDoAzJ8jHL4iJZGlA;A5XZl|5ko9d{3%ME-wd4H z{8~UkvMYfZbAo9%EGj$TcJ@sv@)N(1aF#ubMd(F-mb9*MStjUTz;b407pNBK5WT4> zSW=nQAS#re_g0v{)BtXh224)l%rb5%JBD4MP>MdMffk@+|NYIFM)R~h?9LEC=(k4Y zlO8XyM$B+}p!>wYg({tI`XCZ>AjxgXV7gOt&$Hb9oRZj2xQV$z7&J?rZsi%Pa5AnU zCLM!xv*apEnj~!`O_Nf(6$m;<*y5Zl8lbN*d2Q6abx{W(`HKEw1 z8?X(L^yZ=vv+T0-F0_sm$#YcVY$j_Hvk4X<2dohs9pc!P`9;Z$MSraE<)hqv8oxbU zc17YM0!4Tg%i}KdL6(vawX8x~x)`j!Y;GLKZ*Kqgh~$<;dNwvFz$F;O$14j5!VOq9kqE$>IH;nmd}o z$Q8L=B$-CakwI@)^U7&k{gZRT&mql8Kl9Ja{gs0iG1V@YkbQW-F=~FE9BOVm_*5CNq7r z%%saEtq!7%JUo6~7F8SR9Gd#ykBpgXRjq26z_TTf9;ADdvo(qoV}Tv0Ep1`#I{O#igv7N(6_qgyh%p>tX^^xD5aE}R@ce?!)Gca6Ojy)-5jInWq(7PIC-YKvP+B_uKE zEr!piQEF$5mrn&hl#j(Dn$x;6 zuf0OL31P=kmB0CpUMttJHK)TT6h<&ZIbdk{lAbHbu={%CnW%S+QhD^5#A&VGaG(9n zic-zLN+p}A7Cb1U^q+@mwUQeOK}Fdhzl?%fTqL2q|F3Y1rP{0`+I0zWdQzVMq29+m3yQ z69k`YonrqqDJi#~iMW{)+t>oGmquqGF|~*K_w>}C+@k}!_Ri!;>`&aM2loYwf33i9 zy?l+GZ+6S8Z>g#U>6^_Vwc!m1`^&57)omBJ{1Vx@Zf>N$Uv{vVH+Q8(f`cCV9Yarh zOQm&&AgeA~?%DtE@FrEzi&d=EWSz#g6rot3iPknk%=U>MSYfKg)*1e#S~P&TJL_}N zZUux_$*Z*OEB53vxB`s!RL{cd(ohTTj|HmQ4gUnb9v|n)3DV9b7Dpc5h` zmmJo4T!UDZw@|Xh?>XH@E;BA%_YObw#_eHEy z`{Q2ITudT=gR7sGNioqCv6oO9c@84xV%mFXqMlsNOlY`uomw z4Y`F(d=dQw#)iMaw3fj>3`pydz3;V;wY{$_({RTEziy z@IGW{5d9v&oITY|7K^psqr6^;%z+#?LGoCwf|G)Z@+>!xMwonReb{~bjlNhUg{EniSr(!7^`kn$dz`mmN)F&5ae;+`v3km?A&j&(SHST^BQ zL7N|_KcQeUt&~Zm)}2gt=%(E_I7NabTIBY5WO{iI&|A0=Ke{ETzTQ^Z^67nS zUfyomnE&drr|rp&^qy-A;O!DMYBU*JlvD0~IO(o@-){&qZhYaeLNlKKZ9Hc3M)jK* zKoMsv-Y1getPF6D)N+}OL$AgWDzv?Nbv#RkJAV?QhlIelb69O=3%Idnuf;^q`W0!6 zc2aTl&t}#kjvwOlIQF9C97Qi4^8=B>K4Kjx{a-J-yJ6vF6xjx=?V9q@bbdui4E*b|J-uqcLUn+ z)OlQS7!~5>RCwTbNz>@2CD`t&cAfu;Q;|_z@Bvc0bpFz8<#Q>HxvIVDu}9DzQ7C1* zsXgAtQvh9z;8>8R>YNmq-2SEahumJ!y!$QmM;Uo6)j|)yqWaY%( z466fF&|e_~zK^pn0KTb6WuwJEG5INtdu&y+p2qyR5yy z_Q;M5EBYwKHRMmu2!@@?sah8~ss<`utEP2dfcRH7D-aJ`J{mn6NY2zb?h?Lk>{CjX zrU2;+X<>4v5yKaf{NALVob8hp%Vwr{6Z@{yQ|<&J1^?H1jCzzj%$k zjHv@(xX6KFhF$h}5y}pbXMHrGexAjY7+fa0o>G?yt6rZs>|W=PiSpaGsFohP%=zo< zmS1Yb3OeyHWXBYn!*knv<0K=}%n75{pbFz)DWmK2R)OlIH4oacc{;A-p4?KFA%@Ux zO@7N6eS%DjH5_K+J{zIJ^+qbicFE5IZtflb&~-u7o9e7qj_BP^qw5p|-`Jf^fA;#U zI>|pd?V+3`Y6Vg%2ZETN2?J>c_)q-2gUb#1k>J0E%YKJrp?JLxvXL>E8#9Tc>Ww6n zs!_c;p83KS z6JM_fJ`&}=@Yub#uWve0mAFQ~3E&ubg46-}$r#PYDq2`x>|xa+tnxO8yG4;!{W2a= zx;bM{Dbc%}bKj2x`0NWx(1x>@B6?wAf)U(SUlyRlc3{ngu=heF=gvEDg-g^u>AC1Y=N1(F1?d?nzOraYh7ph zy_vB}Q5iuAe+>VQDL5$#?X6vfvv3xRQR_!@$${unlAQH=)*kS<(glnkMCW~=L4!Ua z*6oeF8rt{)Pg29|Z$jD{dWk~m8-FO&)gjewRm~3>g-Aj)B_FW1=WhdZHS#)y*F+Td z9=q5Tns_H=T=>%lA6?whXbbgo9Gl4ubpklH8d-}IX-*PmX>MXU2`m)!y&U}9+eMk? z($R^fh2b8Y8y3%IfAt~7_RpCAjxmvFCf{ZDrNfa|e8Yy{=e88oh@Hc{-(kiiK0_4w zf+eb5OG<7rp>yQ@Yv<2My$XvSRG$$TarC5Dy;@_#UMKb;^&C&VnI@s%18_`k34RmL zQ7Vk(2G49C=0a6=xt=cc!bJYOXZR+-JpAUIL<1dgwL?G~ShNr+Mwmrq$!2({f{C*u zqZz#uKTc4Afd5>m*SLI1?b2s>@pBx{1@V;1C9MbI3XIPhp z!iU|PxRWpmUdSArYNxwwAP>5ZWDM?lg*XuxOl4=@uL_|mU~`;82HJebrH^?na;mX< zV-YilPcnK0mPZ(ZC1V{O$hZM`*}>Xr6?6>gg%Yb)S-Gjyhu!vm1to7t9x&3Vt`1rPeere^!T~E^TSBhfy=n*UM zlL(&F3mQjAJ>C}3(cLxJRV<-~%f!NOer~IwA$JHJ>}Wh9`;aB6kuQlRk6WO8Rz+aU z9hjZ#c=>BfG2{DqfU>DeVc4q(J(8fE^u6LKc|R`(U8xSUW zT>fa}S#!=JYuw+@Xr3PcPJ-Bxq25xquR@|HOjIYtP*J7{Xf4j8RHi- zbYpwPJ$Zl3DEIzwu%nuEkWVdc{Kv9l`_u5YCZ`*=7!}9u+sVh8R+*`<&XJ{?FiDU1 zfEGP9$+BHNQcGxmV#`&}u6CQ+(ifKRHhziSf(L8k1YX84b3*&kfj@)b@}5^&yJqhd ziX$yRh8TC4)4UGxeh<7F4)@HSrgtiJ?cg`P(`AVnE=cS*40qk-M(J?8czK=ewRpq%uy+Ho z9|v{$!@_mAE}y`hF25I|6p|1T2{vqjKK6Hy2Ax3<|3VHXK4(p(d^QP+`T;`qjVMzh z!5u)Xxe#muFA-Q)$>h`>h+k_~pDy(w#Mci0yBxDaQF=SNj*N~t6qlWV+TI)bk3yyB12Ik>fSuLu5;Iq3|o>hEo{BE9{< zwV4@3_2kNwI)WZHz|QRItRw=ro~dWr+J^P|w&lW#;?p$fq}UcaBhmNDZ`A7b(?7lu z)d3zULnnNzofI z*sy?8FCSvezyT7{4Aszjo3p~;jubIj5(qc)QVo+Fh@_rpX4*V&ibS(r*Hs+zte`R;!PV>JyVzrwcjAJ>Upx&IqM1`fb)oXHMNpEH zvN!v*mVvJ_Ub5s_89+PM0wZ@CTFmc9eJL>-3@w5*E8uOR9Y0}=*O82H#)~bF?}1mO zGN~p8#HW7{*plFfB#RgrF_p!@DOC z(K}`NF*d|VOaaveNI4wHa+WS?m}y|mT;E~=_efkWrS0hOwguiOwoT;pW6#ivDv{|U zmgH}vbJKdszP~}$EC;!GKH}%97=~@)ubOY0RA{gG;&LKY~%Ba+3?|ejzcyK zep+Myo^(1ZBFwl3mrEUSAua}1iD$ciewZGMbma$ot!RW=V;D)FJMUO0(u#go^Ld*u zzW6j>-!|p%Q>On%U&({f%j?*ifOkpgS`46hv{;9w(eb^?v97Xv>&KE2jOmiN&RN~n zk|TTDbd#2VD0{lVQk+i%W)vO6OU=sA+)Ica!qG|l(ujwgNh;a~!rFU@996wWZu>=D zFuM2L!;j8ZmmeQYSKFhJe20Q+<*mxC`WXz#FSF0puNh-;kB{7B?{*aH@t)42A@X-t zgHc_X113rHH#^0sjXjgyH1(T8Kb#^+x_d_34o@v8%@+)%!4iB{`qX!Km@W3pPZpJC z9Gb?zqBpNU97UfNj{d%fE9u@}dX6IABt+;>Xmt!jw~O_%bXgp#rJ!S{>MtY?PITS8 zQT`0Z>Ds!Z*}jf*!3^jcKyEgT%ROi`+-PbQvnMhYifKo4=Y?Q!YFdkvye_R_-@{1C zyrwWc!ai{cn%ZZGv7l;K z$*Hf|381^GqO#W)g&~YdD`lIxFbJW_Ks1t$_Kc1hb}(-e>N60di^iH()(ndz@E1y( zJ0$&m9lm-vh=kgUk}oT2M{m|9|8mqNK1Ww~h4?GeQ|d22jEu5J>UX9$4T0E=?0>`@6MBXGM?9juCj_==c1+5z&zfcz0Z(gL9KX zdpq(LRR8BAoH%)zN&ckOJUqXeu2ENDH5sbp)b+gl?$lreYDm?w8{)xkpcWRv5f%~ReFOJ<9UKJ> zu<`~IB}FJrOFAR)?iu;C#WII+^a5@Z*Vv1TlK4Jn+VjKU~mZYWGeASe~i_{&@a(>cCeVfsxbA$u`e%D+nXN1`*20*ab z!M=Y=P*mpNsgx?FRm%7sXy_+tz}+0s`?Z{WdyvDaRvob93F}RQxvm%#EwM$L`gqs= zh}1!2@hg+tTREPUh4xu^a#cmn+LJ^YGfUZ;8CE&c3(AfEq6b{sFR(c_*3wvYT}hNcH@0@xK_5Hfb&3Kj5JMSJw}{MtUWD`>(P1I>;#q z@DIqC!?E*WUI$s5isik8(3ag`NYr*kzt@Elspc(C+gpset%88!LLj$?#Ck_cCG`7u zWY#Mx#;i2||0$7}?Taf2+loi;=-{J#%rq=qU06$zUD zSNT8SzgG-4{cku)&%&jjDE}Q9EFcij8pQVBD(G5a{r|&(aYQ5j{~_`J;RV~`9}ffU z|AqH|;{7AJ!{+{n{N7U(pTk7uwaUUb^RS3++yR~iOOoyb_F7tM$+iAXmb_g9k-@$M z*4{P;JuTDZX?uV8fkvu??C&}zNK;6N7-%l-vNI-?G_=z&Y5I48n9%7OCEEeuJsbUBFcmT8MqZyhyL% zzB2{!4P6Y?ic*)M3>CqH#Vd7gfDrM7cdx*ib|aXVYBHZJu0qW4u`G zG{4-EdmpX7`PdL;?i6!XnzYv|Np^%q9FeBt36o;qq%PBRZu05%k9J%H3XbgYe}Mop zjIHSTXWm4L;CsLjk~&8hQdL)n#iR9P$7C8^ec39x^Z5t?1e`S$Wwx3}Pih#* z(CHRzXPx1)5Kr+dYRxJzcb~mO*agXLTdX2|@zlc~W0@DWre?K*#y@`wpD;+KmRhW>QQqNKpgd(aax}@q z+GoKaTj9H;8>}E%zq&krD%UZoggssOW2;_&}!jXJIi9sp~ zO;Rd1GN21K%=Y(cMnTpzD~d>3PkrO-j=hT$TI9Y*82XLFiaz*-U+rK?k@ruDtp?*o z!QTas+npzFJ4KH)yRfFnNr!RGGib2 zSSkM8zPMxpLuUY%pMi@$=eMBCPxP2A))$;6%<&$P{VpFPIF(SiKGSnLv@nZvOoVGU zs~)licQWc1+XlYELyi}|cdJ)%7E<-CkSz=ZI_Edj*o5zY$8TZMbJ(KNXR`@*{D4al zW&-B7CdbTVze^I>vK7Jl+UWXgcK*5Uj8Yy)MrT!Ilf-zjrht|bd!&7P7cTg&f!)(0 z`g&kJ{BTC>F`6KS7PS;GoI#sbu#>3qFK?`MD)?qZZMuJyP%z}pF$Yi3Xu)!RYjp6R zjNh?-fOdC_zCb6`vx!3d0zy1OzCIrxw{PRtu+pQ_qp*d^ValSx|G)fCj-xMJl44rx z8zhWI%uz4nQ`XG)nqlhByjgaK!+WCP#tCT1!tf=JiP584S5G-EJjyW@leu(_f zv~U7V!pA5%7C-j?JH@P=EQae=9DEcgAYZxe?{uU=Q5P(r%;qrQ({xXE5xr&OvRNYz zg~_g_- ztuM<$OfYxlzAi~PXYiC5alpicsQCRScw-4&xpUg#TaKXmx}P!`t(F2_i4Mg{D2P6? zE})gz!ffkwZ-~WG5o~q#MZ`^ao>O(|S&U6J^dvQ8TgNXUHd`PfhV`#|P|!@g@sDH! zCicN;UlNEo|D3h))x@EQ0*EBD?wVQoi;^R0ov{$h#& zHQQ|Po{Y^kMGh@h(OLK_tR=68dZ(xxKKCK4Gb8`XSlULY1GD34)F}HjL!(M~YX61f z#WnZwc%~)7WOG+!Ym>Ty%raI^2I5qC(V4Rp$`g&2L?LjKsQCXTo4ppfhzAcKP6FPl z8x(5Pw3Me`$u)p37IOIPyPx4&Z8OJ7wmj_q2RX!r`<}d{M!vPgtw%YUP@HSvyIJo@it^K!Pe z1KWxpG@Yx@{Eoaxq*n+uibb*THHtH6y%jVo8DRfbi4usFdADnZufAgJr%*qf3xd@ny1`!_VF`B*Y?m3;?HZ+G_gSZh7eHDJN}Eg(Uy zYd{>#;xlkqA8~riE(>KVn#b@eHFkIKZu5~zc?NeTaGmjI9!f0jWJAojbcF*L%?d8! zkgv#M5{G(KtNi`h(Ny}7L8F=6Slu11R~@vTzr6%o-eb5b<^7r~hPFuCmNkBfyW%K^ zV|-zR%lF;q&UGGIm6qO(Hg_Y_x515kP~XH3j^>$_%cVaLjBdOxUdSumt;$fQYjjoMOYr6WK<}xe49%_+JRe(ZJU=mZF zg4zjM-=qVrt7E_Bo~(D7wU(oL%B!g1LqZR&xcPz$N<9tu4HHi@X}=X`fOga*Q3VyA zV1mFUoBk-CreCp$fY@7OK|)1a}O8t^IG};M+c6fkHPGWIdik#}!K0E-)d`v@m4wv|e0kUY>cu{ifn!&UfKCj`ajqP)@rV^<~P7FTJ9IpRMV{&hjdX=%rzPTi7(9OU7+89vBZ<@r5k6(Ftzux8{>U{zqcDOhD zpy@aZoxaSRUy+gjug>l=CayJp)Hd!`+$pZb-Ai$IcQ5V^Q{3HMiWGM%E`w9NID>0( z*E#I&|IYiK3?T`&`Fx6KlYPjV6PMYN*sL5Ljz*#c}vug z4k$2)-Dfg)2yg)Q1x4|i?4E-k9LIB|Q_WA0Wkdeh#7hR#fT~2)f{F2G3&`x^$)7;i z1?!?u_!e0@3UL*^egd7X71bL9-;Q|$pG2>zww*U`z993n$z>oC=vTwkdg$`8!xo7-fEmIRpui4dyeY;JkqO1J)}*C zq*ElDY>&ItejIRg2LZUl2H60RT$*7LFse&aa= zykCG%euI^v>&W_Hde#o`r90eXRy6?m< z1(C1(d8ao$>SN~PyYXk&0QmRciu>#N1yC8hl`Kdm1O6iEZMW`7VUT91bKWQd=O)~1 z`~@WUp}*h+_2)*x$!nIoP{*#J7bxN;}+=UxipPnrc5e_8bXQ zx}SM|M4`5-Sn`KTUK^WFZ|*yNB*Ns?=h;RG2{reuS&Awr@$3UMmqA!RwtWYpYRui#+!^pWxQ)wcN6*6^gjZNH+_==@=T5b}|KJ0l)1+XY^cWvA5w_|Z$RV+8 zooUffkL0~LwuzqJeP{?4|v4G&+@|i;v=^ zxK~X03KQFYeL)BF6$4Ll<@UeMRlNn>0-(zm<}sYCwIBTRCp%!z#edaSvyV(Z@vFu} zGVdBKid@Vkj_}Q#p%$vOo7T9PQyh>lz(l39Cx+KHM_O2pB|Fhux^&DG%Q9Dcq#W@~ z(2*X=)NPx&iziP@1*r2JVEu5`Uc)rtL`SiS#9&SOepOlA-YZuu&~}Cn58!nmcA|Uz z!S*)4scd~UzZ+NrN7(#iv$>PhIx$)L>ONPE_*Nff7N(zNK(`?@ju~SxBzN)D%XO;k z1kdahN+f_7D=&FsA`cUx=B9KV71QljE+?QfhVLk!tJ~}XObwZ5Ybc5u_*rQdy-eV_ zoDw@0P@+B>@pZk!&3|U0m2+2P*`EqiTXVfeK|&;UGxE1MiU(-RW& zf;8H*awzs-p`@kMD{jo6p-!=pu7Y!k^=PV`|FC zyj?@$kK|~`j+Gp~EpJ-TD#`6x2}T+ z-bYoRdyGhPP#(eg+mCdQVE1<&j{!4=#7R=T7#2ThZP@SLEMD|eXIWjQgKDCiUf1@B z&@-RE?7tl?rvUf>2usuLLMwNRNjH6jpAjP*gm9d5iylr}_ai6{0j2JulfOX8Hj zC$_TXQ_fRKsEGtyPw?D2DKAAhM*lPKhC z=vO}BvV!I%m4PUKm)KIdU2o3}G9=xb3xu@(thh$?xKEiiA2gIMOa;3RHyr|6wF6V0 zWh*M+?6_Dxp&vcwH^(`*fbRD(DVdC0a%UBIAG1838*Z#&GeJOu>ELu}J>r9+HU>uM zuklx5;co+iiE3Gb{&xfWo39Y7uTgrad48ztd{i|$&o;>wn7mVEwNS;vk<}PP!`dWJ zmN|ihJ=FKAKPbhmlTvVvl`jrp{_JGnFuB2cU8-L*WXw!nP1>wEk$rP$+wJjsIfLcU zTFWQKb!s>HT#5a`x^ZtCYVV%xHzXeNEOQGb-}x{H?M0l{erie*(+(?GBK zmYFE%Tm?5PtlYy30D9;cd{|qqgNV5j?xo;^Rl^WYq=mVc-0%yQy)h08ezc@u6ZOv@8=7C~2cgKJDjBDJ(-#Rsy6njyXdwZpgY!kMkMaqd> zN}!@Xk-2eC%JD;aNs|hl%#gceT{kd-cvkCqO8`CPq{P5Bll=Cx!4YHG&oqISHCe^x z_>Ke<4L)~U*o9Bh6?%*n4xYNr>7TW4F*JQ_eVbS1?Om&Il&0mWmAK3{7-5T|nCC)1 zbm4||qhrf6inLa9*Qh~d$1G`%Y~X3IJD039890XG?4tOz5YGt*c;XKT>=R&ob0M+*8res73k4ZesybqBX#+dzkcSmwO;RJFsXNr4Dk;?OO^8OeE5sc z5V}l-e?CeZq0GqZyf3r}Mzso<5la{`*9F_*@9gv1EuxlGN0+&WJkqU5PVXVKy|1Ac zQ0&S-!0eV(_94&Q`@!T&BhyPV`;P*X{z>}m6XS4{r&XO1IrVmsm}O(r&u)q=wbWRu z-)Uu4$fV}W`&J;XY9>I2Q&5-3yz()`Q0)e_3OsTsf$hxdyAKd$KcDPdU7OFqV`T}3 zEahTk3${T9-4}Aum#l2C6iXiDlXR%9SIw?;Py2qgGS8kvf1M|pRof%aW~@* z)D0o(@dLf|^BXSxMJKYkxji7F}{&(a51F33OV-3HJVQ1fA-_nxKXI2Jjh9 zrDREfA6Iji_Q_11ep=Sd)f(mTiMr${eTbV;5}VTb7!rF>W-h+uOPHzFAd;LEqfgpP zznrfsQM0kp$q&Sarisx_wirgcx;wrF^G7z*!~~xyjiOHj(P1zl0(waUE-t~@an7~Y z{bpHusR?4S)aMEXL;nB3vu@V?6iiLoSnM~8nvCoT$Gxt z=B>p(p3Z}4)M?4`VKS0ll_KHfrf>{iGpQM<&2HluM>Qo9x+&sfBW+ygC@Wae1YkBA zMW39Y4b!@nBD0&by7`lvNf&|CeqOm;*x2>^bp(rAIa?*vu>~u&c0(ni5^A1k=0E2z&T$31zuk8T zF<)s-J}R*0weF5hkLS96%yr7~`^-HbE;*mb+L`ZCW|}MuLAkzAIhc9QbKAdM0p^g@ zk2kZ~#Mn`PN0mX-&?2Fo#GPU_iYxlJ4CGC@*MaM7e?BZ8!+`z$1Iz&SAqWtLt^=%| zK}aIt4I}hS%3UY7n{5fRiDR=%4#`~~`yY!LX>%<1J&(AGpo4@v5R%t_oV@Zbrq5Q= z&yH~KHl6&}SZjrPF8`mnbymOjw=TRkE#pPSFiALhw}<s1{-i^7fW#o;k+uTsw6*z&&Bn@}m9*X$u&?|<}_e@FqqFp2017ZbjqSlt+ zo1B%08P7+l%@gqrj?fHaG+9J8h212gfo&mM6VnZ62urHaeeDw*$W& z1nG|0{@Hx|D2#1|X{iEtO<|c%^cP(wT&4#hM*P`@2s?89PhfNDQ>yi`s+HU>D`pqk zWRz`S2n|Oj)fH*dPEP$cr&o#qprPVZ&A~aALq^f4z4Yo&>hB_Y9@?eq&Yys!fdgcQ zWD>j_^rI;itGUE4=RU#k51Q_l;0fz1DS4l(*`%qQj9tQ&_Z=GNG;O~Es9FWEcOL)$ zXw3EOkK~ef8H@pz3>ppjMT7&9vtxR>Q&e~lG4l2Rafks&9>kwhwE%_D-C6 zD>smB`{5rZr^9+A#J)la8i=?b-X&bh<85&aYEOwuoM#}?y~d$blkd{^rTpEFjWG8? zfgloBeP)C;l((nft_7n~7Kb>w&*$Jk0ukN8@U(;l$tDjer+< z2L;H4mouf$!m-Opo3C;6UhZm&P1a=Z^*cVhY18#)+ft5+YkF~8V^+iM_xgmtQJ){n@$Wfk02_{}FYKPlZ5+m~DgzX@0F=G8RIL83U<#N(JGSpVzE z=8&GMJ+ia^cyeaGfZl(eJZ~@3rl^D66y&5GYXa6Zs~pWh)D39Rw*m;Ilh+?f;7+r#q33l!O3PnO>J z$CI&T{>PK`ga3LmUPf|B=FAS40geAN?>`Sd;js6TF!B6*SL!i3c?vBaJucpmR7Aut z;A**V<~lg}`_xF^FbThKCbzo3$3>t20{lIrxAoX-AcvURuMHv^H1z~ z*{UTfQ`;$TJF`t;R*X4TjYJivrg~$Vyo5YRQxvee1nZGdq*(W*J(_T5vO9CPzuY~# z?;T98356FcsnGiny~kqxB(N&$+7ycO6m{%yOlbYSGUszTSajej;C%$b7!3}hrUD(z zBVhiFD#jN8u~Z#^dlt()e=oZ@_sb$EzX_PoWLjSI6E0%V zbsC^Zrf*SF6NZ|H{bRjj@zU<1U+W32cQz!9TD8Isoo2TFDAa_lBJd0GbYS<~&;W!1 zaz9L=ob7s0##1v!90E?PLTs)xKW8fwC_I$*l{FqE5gAknkPq(?|N5-E$0%oJqb*32 z9+WdjE%&S3lFT2f7l}}(|1LY|!ekDPwjNIs^;&~Tv~o&gO8x> z;)0*=_wFM~Z+d_!8<%08o*v+^h-|8&%Ed~66_bs9Ixh%*lM+;T%HN1L?jhSNa%4=c zy>dGQz|*pvJc0VIchdjTFd3jJ?BzjkO{#r5j0Vw?p6zoPV)W>gh{)rm)Roa0$w=>< z$Y*T&2a;uHva<&ku4rtIl>pcVB*0Lz3m7)=d`=`$pyfAgCv|S4Od8eV*<7Mje_e?^ z$@NGA$@6I(w93heQb;L1mh&ZYK=kAvb} z;kN=+Bk%64h3 zHJugV%XhNK!7xaO?{lxm{)$Mk@j>qFSu$Mg$dyc4ou3Oy1J1gf*iFhpx}<2YNBXl> zC-srfkzYEu0|$B}cQ4+n-bTc6=;&xe@Xu04DI3Hjf@EYd=;-;Yc*6lb4}0ghU3&lq zGe9-l(8=>^AjuW@@ZzG42CNhpAN~NM^_~V(E`0%l54>;}5i#*7mF10(>&A0^ve}*O zMaa>f9!3vJ$Oy?X7G*bly^I(i9II)0yH4_yRQnt97PC z>#OtUP15z(>xXe)XC;mIb>lVIEss+77B?bU8=2Zu=EqNW=njocw-R1ORC8hUVms8H z2lz)Qiq`LSRnnGw!kFujtCG_(wEod&K~@OpYpHc9^HCr@-#0|v+558HU10P9i+rv;Ol+5^u_3Ro@X z{nNX))Q#%lpG^~xrjnlz#}0NG%S(wlKag#!sS=_DJx|9F9hi^`m&dr57A`8SmYZ@0 zFeWuq&uR&p_*A3n`CJK?^0;^j-_H4hTW#jESHLk0P|;!Qg{r!M#r! z3ST)(Gj*ha;63bbKA0F|51#BtJ49iBl(08A_bj}>0$e_?t)Ve&U;~@4@~fV7-Y5?i zUZm133|^E)c!VkJfMbAt=2&(NC(VVxrwRK9f8cym2ve5$WB#?^ACVwytv7fY#a+M< zlSzrlxq(W&Jw3GcP(?7=?XIwHJj;G;U&%QH@+aD)hFI(NuD*KGN!p54%6d#3@~nR zy*(gW;(!~v@H!)YlG#!qD3IvE4H@QC(@A2gwWNq?Wh^QWSn4E!A9~qJQ&s#R$Q)yi zD*UAVu$3n}!g@q@f@ofhUb_m4}z-H%%KC3N(Qzx|_*C6Er#}tG7Py()rTe(^W z!|a)slF8+o1|)E~RAtq$U(bW%ip6E;!?6}&xv{(>Wk}=8Iw-w61=3g?DkbGxZ=cOD zlk@Bm57m8S(v&@>3E_8j4qHPazbiOH@sZXNMTvhX354yW2$zh3d)wTAzDriO=R^Pu zA}F9+8g9A-AV9Vhb(D}t(#y@<(ha0|3S~C*1vTi)n3FM%@y8K7{Z0gKwI=b;-y>Qf zK15Vw0oKA*A5S&mxp5Y1_tD;1M*tBizQc)Io6GZg11y9MrRpv0ymP*`d+cU02Po>M3}18eyc*B1m14m*Tn$(U=&oHU$|K z^tnL{VM}N@jqHYJ>H=}eC8SKv3@%E@jqCvA#PXp_ssvw{iY{ikCZnOn#gZ)au%O{f(d{&f z)NK+G8Zp{5`*BTFi5&(dE1eD!7&-iH`Bw7O6M7Ll+W75NWbUbvtrnX-N3sH1tb~># z^T-CDTi#ooYpAfqjFUnaK%8PCi5SV4VkG{e0AV}=vU0Yo=zG{9oVcd~fj>jl+bvS+ zD>jzb#ui{0J_~mo2wlQE2M(vR zd;ttzS9WI$QqD8td?P5nd|>okqie9kDh8npsE7)tBLiSKsL7}B3^CU*a6(;ba8Wd3Ov)Okequyxy7AC z{?`X&s-Tj-WT>-neJ@uF-%j+9%ZI!{^n4hv;LD>t1PD(bMbi!*;OsH`8 zsN$vG{o2HuoSV+^p&qAq6vrwX88h{boS3U`7{vXNG*g*z1WDoKSRVg;c(Z+TqmUVs zs=QE#dD0n5sml3>|K;|!+2R52kc#TEPVy3QCj)xfXRTK@TOPV%Dq(pzbo=?P+OaZv zT_I8J)MwkW4u1kKdD*)C!B&^t`El4mGl>9c<(zpnrRlo~p1KG>8h|P>crtXZicyH` z@S~N%L!s7y-6TUtDF?&hp6Z-G9NyABSjj=uua7I}UT`1K`hsqCkPdvPox8sN{(Am# zuX?^O8$TC@SDY5IBwi+j-<`V$?bv##1?{*PaK2Hf77_0k{qcvJLh|&K3)e1Ag6(H@ zkE(JkpB?ps3FoyBq(dFI3%CjCH%7f8u5CDU_ju&B2J0+6*#~pmx^fMY=*(aefXYtp zp!z=SS$Fbj07HQ}XJEApni6dO%3E?^+xY#VRpEkag-0Q&u}b-+;G1_=-}&=CI%R;+(} literal 0 HcmV?d00001 diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.001/Chart.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.001/Chart.yaml new file mode 100755 index 0000000..23fcc66 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.001/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +description: Installs the CRDs for rke2-calico +name: rke2-calico-crd +type: application +version: v1.0.001 diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_imagesets_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_imagesets_crd.yaml new file mode 100755 index 0000000..1f0003e --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_imagesets_crd.yaml @@ -0,0 +1,76 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: imagesets.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: ImageSet + listKind: ImageSetList + plural: imagesets + singular: imageset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ImageSet is used to specify image digests for the images that + the operator deploys. The name of the ImageSet is expected to be in the + format `-`. The `variant` used is `enterprise` if the + InstallationSpec Variant is `TigeraSecureEnterprise` otherwise it is `calico`. + The `release` must match the version of the variant that the operator is + built to deploy, this version can be obtained by passing the `--version` + flag to the operator binary. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageSetSpec defines the desired state of ImageSet. + properties: + images: + description: Images is the list of images to use digests. All images + that the operator will deploy must be specified. + items: + properties: + digest: + description: Digest is the image identifier that will be used + for the Image. The field should not include a leading `@` + and must be prefixed with `sha256:`, if other digest prefixes + are needed please submit a feature request. + type: string + image: + description: Image is an image that the operator deploys and + instead of using the built in tag the operator will use the + Digest for the image identifier. The value should be the image + name without registry or tag or digest. For the image `docker.io/calico/node:v3.17.1` + it should be represented as `calico/node` + type: string + required: + - digest + - image + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_installations_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_installations_crd.yaml new file mode 100755 index 0000000..09c7bba --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_installations_crd.yaml @@ -0,0 +1,1202 @@ + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: installations.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: Installation + listKind: InstallationList + plural: installations + singular: installation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Installation configures an installation of Calico or Calico Enterprise. + At most one instance of this resource is supported. It must be named "default". + The Installation API installs core networking and network policy components, + and provides general install-time configuration. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Specification of the desired state for the Calico or Calico + Enterprise installation. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration options + for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip forwarding + will be enabled for containers in the CNI configuration. Default: + Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the Calico + CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create if + none exist. At most one IP pool of each address family may be + specified. If omitted, a single pool will be configured if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the main + IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the IP + Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector that + will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + mtu: + description: MTU specifies the maximum transmission unit to use + on the pod network. If not specified, Calico will perform MTU + auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a CertificateSigningRequest + to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. + This feature requires that you bring your own CSR signing and approval + process, otherwise pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate a + key pair that is associated with the X.509 certificate request. + Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature of + the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to accommodate + for clusters with multiple signers. Must be formatted as: "/".' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management that + will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For CNI + Plugin Calico, this field defaults to Calico. * For CNI + Plugin GKE, this field defaults to HostLocal. * For CNI + Plugin AzureVNET, this field defaults to AzureVNET. * For + CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only if the + CNI plugin is set to Calico, for all other values of the + CNI plugin the plugin binaries and CNI config is a dependency + that is expected to be installed separately. \n Default: + Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in the + Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider AKS, + this field defaults to AzureVNET. * For KubernetesProvider EKS, + this field defaults to AmazonVPC. * If aws-node daemonset exists + in kube-system when the Installation resource is created, this + field defaults to AmazonVPC. * For all other cases this field + defaults to Calico. \n For the value Calico, the CNI plugin + binaries and CNI config will be installed as part of deployment, + for all other values the CNI plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of limits + and requests for compute resources such as cpu and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control plane + nodes on which to run Calico components. This is globally applied + to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which are + then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates any + taint that matches the triple using the matching + operator . + properties: + effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match all + values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod + can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, it + is not set, which means tolerate the taint forever (do not + evict). Zero and negative values will be treated as 0 (evict + immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path for + FlexVolume. If not specified, FlexVolume will be enabled by default. + If set to 'None', FlexVolume will be disabled. The default is based + on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to be + specified. If specified then the specified value will be used as + the image path for each image. If not specified or empty, the default + for each image will be used. A special case value, UseDefault, is + supported to explicitly specify the default image path will be used + for each image. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images to + be pulled. + items: + description: LocalObjectReference contains enough information to + let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider of + the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to automatically + determine the current provider. If the specified value is not empty, + the Operator will still attempt auto-detection, but will additionally + compare the auto-detected value to the specified value to confirm + they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node serves + prometheus metrics on. By default, metrics are not enabled. If specified, + this overrides any FelixConfiguration resources which may exist. + If omitted, then prometheus metrics may still be configured through + FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if type + = "RollingUpdate". --- TODO: Update this to follow our convention + for oneOf, whatever we decide it to be. Same as Deployment `strategy.rollingUpdate`. + See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that can + be unavailable during the update. Value can be an absolute + number (ex: 5) or a percentage of total number of DaemonSet + pods at the start of the update (ex: 10%). Absolute number + is calculated from percentage by rounding up. This cannot + be 0. Default value is 1. Example: when this is set to 30%, + at most 30% of the total number of nodes that should be + running the daemon pod (i.e. status.desiredNumberScheduled) + can have their pods stopped for an update at any given time. + The update starts by stopping at most 30% of those DaemonSet + pods and then brings up new DaemonSet pods in their place. + Once the new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times during + the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for component + Docker images. If specified, all images will be pulled from this + registry. If not specified then the default registries will be used. + A special case value, UseDefault, is supported to explicitly specify + the default registries will be used. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity characteristics + for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling rules + for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects (i.e. + is also a no-op). + properties: + preference: + description: A node selector term, associated with the + corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha serves + prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico or + TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + status: + description: Most recently observed state for the Calico or Calico Enterprise + installation. + properties: + computed: + description: Computed is the final installation including overlaid + resources. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration + options for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip + forwarding will be enabled for containers in the CNI configuration. + Default: Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the + Calico CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create + if none exist. At most one IP pool of each address family + may be specified. If omitted, a single pool will be configured + if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the + main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the + IP Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: + IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector + that will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + mtu: + description: MTU specifies the maximum transmission unit to + use on the pod network. If not specified, Calico will perform + MTU auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a + CertificateSigningRequest to the certificates.k8s.io/v1beta1 + API in order to obtain TLS certificates. This feature requires + that you bring your own CSR signing and approval process, otherwise + pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate + a key pair that is associated with the X.509 certificate + request. Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature + of the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to + accommodate for clusters with multiple signers. Must be + formatted as: "/".' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management + that will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For + CNI Plugin Calico, this field defaults to Calico. * + For CNI Plugin GKE, this field defaults to HostLocal. + * For CNI Plugin AzureVNET, this field defaults to AzureVNET. + * For CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only + if the CNI plugin is set to Calico, for all other values + of the CNI plugin the plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in + the Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider + AKS, this field defaults to AzureVNET. * For KubernetesProvider + EKS, this field defaults to AmazonVPC. * If aws-node daemonset + exists in kube-system when the Installation resource is + created, this field defaults to AmazonVPC. * For all other + cases this field defaults to Calico. \n For the value Calico, + the CNI plugin binaries and CNI config will be installed + as part of deployment, for all other values the CNI plugin + binaries and CNI config is a dependency that is expected + to be installed separately. \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the + component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of + limits and requests for compute resources such as cpu + and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of + compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control + plane nodes on which to run Calico components. This is globally + applied to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which + are then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates + any taint that matches the triple using + the matching operator . + properties: + effect: + description: Effect indicates the taint effect to match. + Empty means match all taint effects. When specified, allowed + values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match + all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to + the value. Valid operators are Exists and Equal. Defaults + to Equal. Exists is equivalent to wildcard for value, + so that a pod can tolerate all taints of a particular + category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of + time the toleration (which must be of effect NoExecute, + otherwise this field is ignored) tolerates the taint. + By default, it is not set, which means tolerate the taint + forever (do not evict). Zero and negative values will + be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path + for FlexVolume. If not specified, FlexVolume will be enabled + by default. If set to 'None', FlexVolume will be disabled. The + default is based on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to + be specified. If specified then the specified value will be + used as the image path for each image. If not specified or empty, + the default for each image will be used. A special case value, + UseDefault, is supported to explicitly specify the default image + path will be used for each image. \n Image format: `//:` + \n This option allows configuring the `` portion + of the above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images + to be pulled. + items: + description: LocalObjectReference contains enough information + to let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider + of the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to + automatically determine the current provider. If the specified + value is not empty, the Operator will still attempt auto-detection, + but will additionally compare the auto-detected value to the + specified value to confirm they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node + serves prometheus metrics on. By default, metrics are not enabled. + If specified, this overrides any FelixConfiguration resources + which may exist. If omitted, then prometheus metrics may still + be configured through FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if + type = "RollingUpdate". --- TODO: Update this to follow + our convention for oneOf, whatever we decide it to be. Same + as Deployment `strategy.rollingUpdate`. See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that + can be unavailable during the update. Value can be an + absolute number (ex: 5) or a percentage of total number + of DaemonSet pods at the start of the update (ex: 10%). + Absolute number is calculated from percentage by rounding + up. This cannot be 0. Default value is 1. Example: when + this is set to 30%, at most 30% of the total number + of nodes that should be running the daemon pod (i.e. + status.desiredNumberScheduled) can have their pods stopped + for an update at any given time. The update starts by + stopping at most 30% of those DaemonSet pods and then + brings up new DaemonSet pods in their place. Once the + new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times + during the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for + component Docker images. If specified, all images will be pulled + from this registry. If not specified then the default registries + will be used. A special case value, UseDefault, is supported + to explicitly specify the default registries will be used. \n + Image format: `//:` + \n This option allows configuring the `` portion of + the above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity + characteristics for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling + rules for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects + (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha + serves prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico + or TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + imageSet: + description: ImageSet is the name of the ImageSet being used, if there + is an ImageSet that is being used. If an ImageSet is not being used + then this will not be set. + type: string + mtu: + description: MTU is the most recently observed value for pod network + MTU. This may be an explicitly configured value, or based on Calico's + native auto-detetion. + format: int32 + type: integer + variant: + description: Variant is the most recently observed installed variant + - one of Calico or TigeraSecureEnterprise + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_tigerastatuses_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_tigerastatuses_crd.yaml new file mode 100755 index 0000000..abfe29c --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.001/templates/operator.tigera.io_tigerastatuses_crd.yaml @@ -0,0 +1,104 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: tigerastatuses.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: TigeraStatus + listKind: TigeraStatusList + plural: tigerastatuses + singular: tigerastatus + scope: Cluster + versions: + - additionalPrinterColumns: + - description: Whether the component running and stable. + jsonPath: .status.conditions[?(@.type=='Available')].status + name: Available + type: string + - description: Whether the component is processing changes. + jsonPath: .status.conditions[?(@.type=='Progressing')].status + name: Progressing + type: string + - description: Whether the component is degraded. + jsonPath: .status.conditions[?(@.type=='Degraded')].status + name: Degraded + type: string + - description: The time the component's Available status last changed. + jsonPath: .status.conditions[?(@.type=='Available')].lastTransitionTime + name: Since + type: date + name: v1 + schema: + openAPIV3Schema: + description: TigeraStatus represents the most recently observed status for + Calico or a Calico Enterprise functional area. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: TigeraStatusSpec defines the desired state of TigeraStatus + type: object + status: + description: TigeraStatusStatus defines the observed state of TigeraStatus + properties: + conditions: + description: Conditions represents the latest observed set of conditions + for this component. A component may be one or more of Available, + Progressing, or Degraded. + items: + description: TigeraStatusCondition represents a condition attached + to a particular component. + properties: + lastTransitionTime: + description: The timestamp representing the start time for the + current status. + format: date-time + type: string + message: + description: Optionally, a detailed message providing additional + context. + type: string + reason: + description: A brief reason explaining the condition. + type: string + status: + description: The status of the condition. May be True, False, + or Unknown. + type: string + type: + description: The type of condition. May be Available, Progressing, + or Degraded. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + required: + - conditions + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/Chart.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/Chart.yaml new file mode 100755 index 0000000..959bb69 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/Chart.yaml @@ -0,0 +1,7 @@ +annotations: + catalog.cattle.io/namespace: tigera-operator +apiVersion: v2 +appVersion: v3.18.1 +description: Installs the Tigera operator for Calico +name: rke2-calico +version: v3.18.1-101 diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/_helpers.tpl b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/_helpers.tpl new file mode 100755 index 0000000..7a9111e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/_helpers.tpl @@ -0,0 +1,7 @@ +{{/* generate the image name for a component*/}} +{{- define "tigera-operator.image" -}} +{{- if .registry -}} + {{- .registry | trimSuffix "/" -}}/ +{{- end -}} +{{- .image -}}:{{- .version -}} +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/certs/certs-node.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/certs/certs-node.yaml new file mode 100755 index 0000000..5830c2a --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/certs/certs-node.yaml @@ -0,0 +1,13 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +apiVersion: v1 +kind: Secret +metadata: + name: node-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.node.cert" .Values.certs.node.cert | b64enc }} + key.key: {{ required "must set certs.node.key" .Values.certs.node.key | b64enc }} + common-name: {{ required "must set certs.node.commonName" .Values.certs.node.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/certs/certs-typha.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/certs/certs-typha.yaml new file mode 100755 index 0000000..4463e89 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/certs/certs-typha.yaml @@ -0,0 +1,23 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +kind: ConfigMap +apiVersion: v1 +metadata: + name: typha-ca + namespace: tigera-operator +data: + caBundle: | +{{ required "must set certs.typha.caBundle" .Values.certs.typha.caBundle | indent 4}} +--- + +apiVersion: v1 +kind: Secret +metadata: + name: typha-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.typha.cert" .Values.certs.typha.cert | b64enc }} + key.key: {{ required "must set certs.typha.key" .Values.certs.typha.key | b64enc }} + common-name: {{ required "must set certs.typha.commonName" .Values.certs.typha.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_bgpconfigurations.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_bgpconfigurations.yaml new file mode 100755 index 0000000..0baa072 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_bgpconfigurations.yaml @@ -0,0 +1,141 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgpconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPConfiguration + listKind: BGPConfigurationList + plural: bgpconfigurations + singular: bgpconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: BGPConfiguration contains the configuration for any BGP routing. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPConfigurationSpec contains the values of the BGP configuration. + properties: + asNumber: + description: 'ASNumber is the default AS number used by a node. [Default: + 64512]' + format: int32 + type: integer + communities: + description: Communities is a list of BGP community values and their + arbitrary names for tagging routes. + items: + description: Community contains standard or large community value + and its name. + properties: + name: + description: Name given to community value. + type: string + value: + description: Value must be of format `aa:nn` or `aa:nn:mm`. + For standard community use `aa:nn` format, where `aa` and + `nn` are 16 bit number. For large community use `aa:nn:mm` + format, where `aa`, `nn` and `mm` are 32 bit number. Where, + `aa` is an AS Number, `nn` and `mm` are per-AS identifier. + pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$ + type: string + type: object + type: array + listenPort: + description: ListenPort is the port where BGP protocol should listen. + Defaults to 179 + maximum: 65535 + minimum: 1 + type: integer + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: INFO]' + type: string + nodeToNodeMeshEnabled: + description: 'NodeToNodeMeshEnabled sets whether full node to node + BGP mesh is enabled. [Default: true]' + type: boolean + prefixAdvertisements: + description: PrefixAdvertisements contains per-prefix advertisement + configuration. + items: + description: PrefixAdvertisement configures advertisement properties + for the specified CIDR. + properties: + cidr: + description: CIDR for which properties should be advertised. + type: string + communities: + description: Communities can be list of either community names + already defined in `Specs.Communities` or community value + of format `aa:nn` or `aa:nn:mm`. For standard community use + `aa:nn` format, where `aa` and `nn` are 16 bit number. For + large community use `aa:nn:mm` format, where `aa`, `nn` and + `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and + `mm` are per-AS identifier. + items: + type: string + type: array + type: object + type: array + serviceClusterIPs: + description: ServiceClusterIPs are the CIDR blocks from which service + cluster IPs are allocated. If specified, Calico will advertise these + blocks, as well as any cluster IPs within them. + items: + description: ServiceClusterIPBlock represents a single allowed ClusterIP + CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceExternalIPs: + description: ServiceExternalIPs are the CIDR blocks for Kubernetes + Service External IPs. Kubernetes Service ExternalIPs will only be + advertised if they are within one of these blocks. + items: + description: ServiceExternalIPBlock represents a single allowed + External IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceLoadBalancerIPs: + description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes + Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress + IPs will only be advertised if they are within one of these blocks. + items: + description: ServiceLoadBalancerIPBlock represents a single allowed + LoadBalancer IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_bgppeers.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_bgppeers.yaml new file mode 100755 index 0000000..57e945e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_bgppeers.yaml @@ -0,0 +1,106 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgppeers.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPPeer + listKind: BGPPeerList + plural: bgppeers + singular: bgppeer + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPPeerSpec contains the specification for a BGPPeer resource. + properties: + asNumber: + description: The AS Number of the peer. + format: int32 + type: integer + keepOriginalNextHop: + description: Option to keep the original nexthop field when routes + are sent to a BGP Peer. Setting "true" configures the selected BGP + Peers node to use the "next hop keep;" instead of "next hop self;"(default) + in the specific branch of the Node on "bird.cfg". + type: boolean + node: + description: The node name identifying the Calico node instance that + is targeted by this peer. If this is not set, and no nodeSelector + is specified, then this BGP peer selects all nodes in the cluster. + type: string + nodeSelector: + description: Selector for the nodes that should have this peering. When + this is set, the Node field must be empty. + type: string + password: + description: Optional BGP password for the peerings generated by this + BGPPeer resource. + properties: + secretKeyRef: + description: Selects a key of a secret in the node pod's namespace. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + type: object + peerIP: + description: The IP address of the peer followed by an optional port + number to peer with. If port number is given, format should be `[]:port` + or `:` for IPv4. If optional port number is not set, + and this peer IP and ASNumber belongs to a calico/node with ListenPort + set in BGPConfiguration, then we use that port to peer. + type: string + peerSelector: + description: Selector for the remote nodes to peer with. When this + is set, the PeerIP and ASNumber fields must be empty. For each + peering between the local node and selected remote nodes, we configure + an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, + and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The + remote AS number comes from the remote node's NodeBGPSpec.ASNumber, + or the global default if that is not set. + type: string + sourceAddress: + description: Specifies whether and how to configure a source address + for the peerings generated by this BGPPeer resource. Default value + "UseNodeIP" means to configure the node IP as the source address. "None" + means not to configure a source address. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_blockaffinities.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_blockaffinities.yaml new file mode 100755 index 0000000..4f03208 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_blockaffinities.yaml @@ -0,0 +1,59 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BlockAffinity + listKind: BlockAffinityList + plural: blockaffinities + singular: blockaffinity + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BlockAffinitySpec contains the specification for a BlockAffinity + resource. + properties: + cidr: + type: string + deleted: + description: Deleted indicates that this block affinity is being deleted. + This field is a string for compatibility with older releases that + mistakenly treat this field as a string. + type: string + node: + type: string + state: + type: string + required: + - cidr + - deleted + - node + - state + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_clusterinformations.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_clusterinformations.yaml new file mode 100755 index 0000000..c0c4149 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_clusterinformations.yaml @@ -0,0 +1,62 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: ClusterInformation + listKind: ClusterInformationList + plural: clusterinformations + singular: clusterinformation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ClusterInformation contains the cluster specific information. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterInformationSpec contains the values of describing + the cluster. + properties: + calicoVersion: + description: CalicoVersion is the version of Calico that the cluster + is running + type: string + clusterGUID: + description: ClusterGUID is the GUID of the cluster + type: string + clusterType: + description: ClusterType describes the type of the cluster + type: string + datastoreReady: + description: DatastoreReady is used during significant datastore migrations + to signal to components such as Felix that it should wait before + accessing the datastore. + type: boolean + variant: + description: Variant declares which variant of Calico should be active. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_felixconfigurations.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_felixconfigurations.yaml new file mode 100755 index 0000000..62a193d --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_felixconfigurations.yaml @@ -0,0 +1,550 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: FelixConfiguration + listKind: FelixConfigurationList + plural: felixconfigurations + singular: felixconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Felix Configuration contains the configuration for Felix. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FelixConfigurationSpec contains the values of the Felix configuration. + properties: + allowIPIPPacketsFromWorkloads: + description: 'AllowIPIPPacketsFromWorkloads controls whether Felix + will add a rule to drop IPIP encapsulated traffic from workloads + [Default: false]' + type: boolean + allowVXLANPacketsFromWorkloads: + description: 'AllowVXLANPacketsFromWorkloads controls whether Felix + will add a rule to drop VXLAN encapsulated traffic from workloads + [Default: false]' + type: boolean + awsSrcDstCheck: + description: 'Set source-destination-check on AWS EC2 instances. Accepted + value must be one of "DoNothing", "Enabled" or "Disabled". [Default: + DoNothing]' + enum: + - DoNothing + - Enable + - Disable + type: string + bpfConnectTimeLoadBalancingEnabled: + description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, + controls whether Felix installs the connection-time load balancer. The + connect-time load balancer is required for the host to be able to + reach Kubernetes services and it improves the performance of pod-to-service + connections. The only reason to disable it is for debugging purposes. [Default: + true]' + type: boolean + bpfDataIfacePattern: + description: BPFDataIfacePattern is a regular expression that controls + which interfaces Felix should attach BPF programs to in order to + catch traffic to/from the network. This needs to match the interfaces + that Calico workload traffic flows over as well as any interfaces + that handle incoming traffic to nodeports and services from outside + the cluster. It should not match the workload interfaces (usually + named cali...). + type: string + bpfDisableUnprivileged: + description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled + sysctl to disable unprivileged use of BPF. This ensures that unprivileged + users cannot access Calico''s BPF maps and cannot insert their own + BPF programs to interfere with Calico''s. [Default: true]' + type: boolean + bpfEnabled: + description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. + [Default: false]' + type: boolean + bpfExternalServiceMode: + description: 'BPFExternalServiceMode in BPF mode, controls how connections + from outside the cluster to services (node ports and cluster IPs) + are forwarded to remote workloads. If set to "Tunnel" then both + request and response traffic is tunneled to the remote node. If + set to "DSR", the request traffic is tunneled but the response traffic + is sent directly from the remote node. In "DSR" mode, the remote + node appears to use the IP of the ingress node; this requires a + permissive L2 network. [Default: Tunnel]' + type: string + bpfKubeProxyEndpointSlicesEnabled: + description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls + whether Felix's embedded kube-proxy accepts EndpointSlices or not. + type: boolean + bpfKubeProxyIptablesCleanupEnabled: + description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF + mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s + iptables chains. Should only be enabled if kube-proxy is not running. [Default: + true]' + type: boolean + bpfKubeProxyMinSyncPeriod: + description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the + minimum time between updates to the dataplane for Felix''s embedded + kube-proxy. Lower values give reduced set-up latency. Higher values + reduce Felix CPU usage by batching up more work. [Default: 1s]' + type: string + bpfLogLevel: + description: 'BPFLogLevel controls the log level of the BPF programs + when in BPF dataplane mode. One of "Off", "Info", or "Debug". The + logs are emitted to the BPF trace pipe, accessible with the command + `tc exec bpf debug`. [Default: Off].' + type: string + chainInsertMode: + description: 'ChainInsertMode controls whether Felix hooks the kernel''s + top-level iptables chains by inserting a rule at the top of the + chain or by appending a rule at the bottom. insert is the safe default + since it prevents Calico''s rules from being bypassed. If you switch + to append mode, be sure that the other rules in the chains signal + acceptance by falling through to the Calico rules, otherwise the + Calico policy will be bypassed. [Default: insert]' + type: string + dataplaneDriver: + type: string + debugDisableLogDropping: + type: boolean + debugMemoryProfilePath: + type: string + debugSimulateCalcGraphHangAfter: + type: string + debugSimulateDataplaneHangAfter: + type: string + defaultEndpointToHostAction: + description: 'DefaultEndpointToHostAction controls what happens to + traffic that goes from a workload endpoint to the host itself (after + the traffic hits the endpoint egress policy). By default Calico + blocks traffic from workload endpoints to the host itself with an + iptables "DROP" action. If you want to allow some or all traffic + from endpoint to host, set this parameter to RETURN or ACCEPT. Use + RETURN if you have your own rules in the iptables "INPUT" chain; + Calico will insert its rules at the top of that chain, then "RETURN" + packets to the "INPUT" chain once it has completed processing workload + endpoint egress policy. Use ACCEPT to unconditionally accept packets + from workloads after processing workload endpoint egress policy. + [Default: Drop]' + type: string + deviceRouteProtocol: + description: This defines the route protocol added to programmed device + routes, by default this will be RTPROT_BOOT when left blank. + type: integer + deviceRouteSourceAddress: + description: This is the source address to use on programmed device + routes. By default the source address is left blank, leaving the + kernel to choose the source address used. + type: string + disableConntrackInvalidCheck: + type: boolean + endpointReportingDelay: + type: string + endpointReportingEnabled: + type: boolean + externalNodesList: + description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes + which may source tunnel traffic and have the tunneled traffic be + accepted at calico nodes. + items: + type: string + type: array + failsafeInboundHostPorts: + description: 'FailsafeInboundHostPorts is a comma-delimited list of + UDP/TCP ports that Felix will allow incoming traffic to host endpoints + on irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. Each + port should be specified as tcp: or udp:. + For back-compatibility, if the protocol is not specified, it defaults + to "tcp". To disable all inbound host ports, use the value none. + The default value allows ssh access and DHCP. [Default: tcp:22, + udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' + items: + description: ProtoPort is combination of protocol and port, both + must be specified. + properties: + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + failsafeOutboundHostPorts: + description: 'FailsafeOutboundHostPorts is a comma-delimited list + of UDP/TCP ports that Felix will allow outgoing traffic from host + endpoints to irrespective of the security policy. This is useful + to avoid accidentally cutting off a host with incorrect configuration. + Each port should be specified as tcp: or udp:. + For back-compatibility, if the protocol is not specified, it defaults + to "tcp". To disable all outbound host ports, use the value none. + The default value opens etcd''s standard ports to ensure that Felix + does not get cut off from etcd as well as allowing DHCP and DNS. + [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667, + udp:53, udp:67]' + items: + description: ProtoPort is combination of protocol and port, both + must be specified. + properties: + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + featureDetectOverride: + description: FeatureDetectOverride is used to override the feature + detection. Values are specified in a comma separated list with no + spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". + "true" or "false" will force the feature, empty or omitted values + are auto-detected. + type: string + genericXDPEnabled: + description: 'GenericXDPEnabled enables Generic XDP so network cards + that don''t support XDP offload or driver modes can use XDP. This + is not recommended since it doesn''t provide better performance + than iptables. [Default: false]' + type: boolean + healthEnabled: + type: boolean + healthHost: + type: string + healthPort: + type: integer + interfaceExclude: + description: 'InterfaceExclude is a comma-separated list of interfaces + that Felix should exclude when monitoring for host endpoints. The + default value ensures that Felix ignores Kubernetes'' IPVS dummy + interface, which is used internally by kube-proxy. If you want to + exclude multiple interface names using a single value, the list + supports regular expressions. For regular expressions you must wrap + the value with ''/''. For example having values ''/^kube/,veth1'' + will exclude all interfaces that begin with ''kube'' and also the + interface ''veth1''. [Default: kube-ipvs0]' + type: string + interfacePrefix: + description: 'InterfacePrefix is the interface name prefix that identifies + workload endpoints and so distinguishes them from host endpoint + interfaces. Note: in environments other than bare metal, the orchestrators + configure this appropriately. For example our Kubernetes and Docker + integrations set the ''cali'' value, and our OpenStack integration + sets the ''tap'' value. [Default: cali]' + type: string + interfaceRefreshInterval: + description: InterfaceRefreshInterval is the period at which Felix + rescans local interfaces to verify their state. The rescan can be + disabled by setting the interval to 0. + type: string + ipipEnabled: + type: boolean + ipipMTU: + description: 'IPIPMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + ipsetsRefreshInterval: + description: 'IpsetsRefreshInterval is the period at which Felix re-checks + all iptables state to ensure that no other process has accidentally + broken Calico''s rules. Set to 0 to disable iptables refresh. [Default: + 90s]' + type: string + iptablesBackend: + description: IptablesBackend specifies which backend of iptables will + be used. The default is legacy. + type: string + iptablesFilterAllowAction: + type: string + iptablesLockFilePath: + description: 'IptablesLockFilePath is the location of the iptables + lock file. You may need to change this if the lock file is not in + its standard location (for example if you have mapped it into Felix''s + container at a different path). [Default: /run/xtables.lock]' + type: string + iptablesLockProbeInterval: + description: 'IptablesLockProbeInterval is the time that Felix will + wait between attempts to acquire the iptables lock if it is not + available. Lower values make Felix more responsive when the lock + is contended, but use more CPU. [Default: 50ms]' + type: string + iptablesLockTimeout: + description: 'IptablesLockTimeout is the time that Felix will wait + for the iptables lock, or 0, to disable. To use this feature, Felix + must share the iptables lock file with all other processes that + also take the lock. When running Felix inside a container, this + requires the /run directory of the host to be mounted into the calico/node + or calico/felix container. [Default: 0s disabled]' + type: string + iptablesMangleAllowAction: + type: string + iptablesMarkMask: + description: 'IptablesMarkMask is the mask that Felix selects its + IPTables Mark bits from. Should be a 32 bit hexadecimal number with + at least 8 bits set, none of which clash with any other mark bits + in use on the system. [Default: 0xff000000]' + format: int32 + type: integer + iptablesNATOutgoingInterfaceFilter: + type: string + iptablesPostWriteCheckInterval: + description: 'IptablesPostWriteCheckInterval is the period after Felix + has done a write to the dataplane that it schedules an extra read + back in order to check the write was not clobbered by another process. + This should only occur if another application on the system doesn''t + respect the iptables lock. [Default: 1s]' + type: string + iptablesRefreshInterval: + description: 'IptablesRefreshInterval is the period at which Felix + re-checks the IP sets in the dataplane to ensure that no other process + has accidentally broken Calico''s rules. Set to 0 to disable IP + sets refresh. Note: the default for this value is lower than the + other refresh intervals as a workaround for a Linux kernel bug that + was fixed in kernel version 4.11. If you are using v4.11 or greater + you may want to set this to, a higher value to reduce Felix CPU + usage. [Default: 10s]' + type: string + ipv6Support: + type: boolean + kubeNodePortRanges: + description: 'KubeNodePortRanges holds list of port ranges used for + service node ports. Only used if felix detects kube-proxy running + in ipvs mode. Felix uses these ranges to separate host and workload + traffic. [Default: 30000:32767].' + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + logFilePath: + description: 'LogFilePath is the full path to the Felix log. Set to + none to disable file logging. [Default: /var/log/calico/felix.log]' + type: string + logPrefix: + description: 'LogPrefix is the log prefix that Felix uses when rendering + LOG rules. [Default: calico-packet]' + type: string + logSeverityFile: + description: 'LogSeverityFile is the log severity above which logs + are sent to the log file. [Default: Info]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + logSeveritySys: + description: 'LogSeveritySys is the log severity above which logs + are sent to the syslog. Set to None for no logging to syslog. [Default: + Info]' + type: string + maxIpsetSize: + type: integer + metadataAddr: + description: 'MetadataAddr is the IP address or domain name of the + server that can answer VM queries for cloud-init metadata. In OpenStack, + this corresponds to the machine running nova-api (or in Ubuntu, + nova-api-metadata). A value of none (case insensitive) means that + Felix should not set up any NAT rule for the metadata path. [Default: + 127.0.0.1]' + type: string + metadataPort: + description: 'MetadataPort is the port of the metadata server. This, + combined with global.MetadataAddr (if not ''None''), is used to + set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. + In most cases this should not need to be changed [Default: 8775].' + type: integer + mtuIfacePattern: + description: MTUIfacePattern is a regular expression that controls + which interfaces Felix should scan in order to calculate the host's + MTU. This should not match workload interfaces (usually named cali...). + type: string + natOutgoingAddress: + description: NATOutgoingAddress specifies an address to use when performing + source NAT for traffic in a natOutgoing pool that is leaving the + network. By default the address used is an address on the interface + the traffic is leaving on (ie it uses the iptables MASQUERADE target) + type: string + natPortRange: + anyOf: + - type: integer + - type: string + description: NATPortRange specifies the range of ports that is used + for port mapping when doing outgoing NAT. When unset the default + behavior of the network stack is used. + pattern: ^.* + x-kubernetes-int-or-string: true + netlinkTimeout: + type: string + openstackRegion: + description: 'OpenstackRegion is the name of the region that a particular + Felix belongs to. In a multi-region Calico/OpenStack deployment, + this must be configured somehow for each Felix (here in the datamodel, + or in felix.cfg or the environment on each compute node), and must + match the [calico] openstack_region value configured in neutron.conf + on each node. [Default: Empty]' + type: string + policySyncPathPrefix: + description: 'PolicySyncPathPrefix is used to by Felix to communicate + policy changes to external services, like Application layer policy. + [Default: Empty]' + type: string + prometheusGoMetricsEnabled: + description: 'PrometheusGoMetricsEnabled disables Go runtime metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + prometheusMetricsEnabled: + description: 'PrometheusMetricsEnabled enables the Prometheus metrics + server in Felix if set to true. [Default: false]' + type: boolean + prometheusMetricsHost: + description: 'PrometheusMetricsHost is the host that the Prometheus + metrics server should bind to. [Default: empty]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. [Default: 9091]' + type: integer + prometheusProcessMetricsEnabled: + description: 'PrometheusProcessMetricsEnabled disables process metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + removeExternalRoutes: + description: Whether or not to remove device routes that have not + been programmed by Felix. Disabling this will allow external applications + to also add device routes. This is enabled by default which means + we will remove externally added routes. + type: boolean + reportingInterval: + description: 'ReportingInterval is the interval at which Felix reports + its status into the datastore or 0 to disable. Must be non-zero + in OpenStack deployments. [Default: 30s]' + type: string + reportingTTL: + description: 'ReportingTTL is the time-to-live setting for process-wide + status reports. [Default: 90s]' + type: string + routeRefreshInterval: + description: 'RouteRefreshInterval is the period at which Felix re-checks + the routes in the dataplane to ensure that no other process has + accidentally broken Calico''s rules. Set to 0 to disable route refresh. + [Default: 90s]' + type: string + routeSource: + description: 'RouteSource configures where Felix gets its routing + information. - WorkloadIPs: use workload endpoints to construct + routes. - CalicoIPAM: the default - use IPAM data to construct routes.' + type: string + routeTableRange: + description: Calico programs additional Linux route tables for various + purposes. RouteTableRange specifies the indices of the route tables + that Calico should use. + properties: + max: + type: integer + min: + type: integer + required: + - max + - min + type: object + serviceLoopPrevention: + description: 'When service IP advertisement is enabled, prevent routing + loops to service IPs that are not in use, by dropping or rejecting + packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled", + in which case such routing loops continue to be allowed. [Default: + Drop]' + type: string + sidecarAccelerationEnabled: + description: 'SidecarAccelerationEnabled enables experimental sidecar + acceleration [Default: false]' + type: boolean + usageReportingEnabled: + description: 'UsageReportingEnabled reports anonymous Calico version + number and cluster size to projectcalico.org. Logs warnings returned + by the usage server. For example, if a significant security vulnerability + has been discovered in the version of Calico being used. [Default: + true]' + type: boolean + usageReportingInitialDelay: + description: 'UsageReportingInitialDelay controls the minimum delay + before Felix makes a report. [Default: 300s]' + type: string + usageReportingInterval: + description: 'UsageReportingInterval controls the interval at which + Felix makes reports. [Default: 86400s]' + type: string + useInternalDataplaneDriver: + type: boolean + vxlanEnabled: + type: boolean + vxlanMTU: + description: 'VXLANMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + vxlanPort: + type: integer + vxlanVNI: + type: integer + wireguardEnabled: + description: 'WireguardEnabled controls whether Wireguard is enabled. + [Default: false]' + type: boolean + wireguardInterfaceName: + description: 'WireguardInterfaceName specifies the name to use for + the Wireguard interface. [Default: wg.calico]' + type: string + wireguardListeningPort: + description: 'WireguardListeningPort controls the listening port used + by Wireguard. [Default: 51820]' + type: integer + wireguardMTU: + description: 'WireguardMTU controls the MTU on the Wireguard interface. + See Configuring MTU [Default: 1420]' + type: integer + wireguardRoutingRulePriority: + description: 'WireguardRoutingRulePriority controls the priority value + to use for the Wireguard routing rule. [Default: 99]' + type: integer + xdpEnabled: + description: 'XDPEnabled enables XDP acceleration for suitable untracked + incoming deny rules. [Default: true]' + type: boolean + xdpRefreshInterval: + description: 'XDPRefreshInterval is the period at which Felix re-checks + all XDP state to ensure that no other process has accidentally broken + Calico''s BPF maps or attached programs. Set to 0 to disable XDP + refresh. [Default: 90s]' + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_globalnetworkpolicies.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_globalnetworkpolicies.yaml new file mode 100755 index 0000000..4360dda --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_globalnetworkpolicies.yaml @@ -0,0 +1,769 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkPolicy + listKind: GlobalNetworkPolicyList + plural: globalnetworkpolicies + singular: globalnetworkpolicy + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + applyOnForward: + description: ApplyOnForward indicates to apply the rules in this policy + on forward traffic. + type: boolean + doNotTrack: + description: DoNotTrack indicates whether packets matched by the rules + in this policy should go through the data plane's connection tracking, + such as Linux conntrack. If True, the rules in this policy are + applied before any data plane connection tracking, and packets allowed + by this policy are marked as not to be tracked. + type: boolean + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + namespaceSelector: + description: NamespaceSelector is an optional field for an expression + used to select a pod based on namespaces. + type: string + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + preDNAT: + description: PreDNAT indicates to apply the rules in this policy before + any DNAT. + type: boolean + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress rules are present in the policy. The + default is: \n - [ PolicyTypeIngress ], if there are no Egress rules + (including the case where there are also no Ingress rules) \n + - [ PolicyTypeEgress ], if there are Egress rules but no Ingress + rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are + both Ingress and Egress rules. \n When the policy is read back again, + Types will always be one of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_globalnetworksets.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_globalnetworksets.yaml new file mode 100755 index 0000000..00a2980 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_globalnetworksets.yaml @@ -0,0 +1,51 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkSet + listKind: GlobalNetworkSetList + plural: globalnetworksets + singular: globalnetworkset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs + that share labels to allow rules to refer to them via selectors. The labels + of GlobalNetworkSet are not namespaced. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GlobalNetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_hostendpoints.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_hostendpoints.yaml new file mode 100755 index 0000000..4824531 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_hostendpoints.yaml @@ -0,0 +1,106 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: HostEndpoint + listKind: HostEndpointList + plural: hostendpoints + singular: hostendpoint + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HostEndpointSpec contains the specification for a HostEndpoint + resource. + properties: + expectedIPs: + description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. + If \"InterfaceName\" is not present, Calico will look for an interface + matching any of the IPs in the list and apply policy to that. Note: + \tWhen using the selector match criteria in an ingress or egress + security Policy \tor Profile, Calico converts the selector into + a set of IP addresses. For host \tendpoints, the ExpectedIPs field + is used for that purpose. (If only the interface \tname is specified, + Calico does not learn the IPs of the interface for use in match + \tcriteria.)" + items: + type: string + type: array + interfaceName: + description: "Either \"*\", or the name of a specific Linux interface + to apply policy to; or empty. \"*\" indicates that this HostEndpoint + governs all traffic to, from or through the default network namespace + of the host named by the \"Node\" field; entering and leaving that + namespace via any interface, including those from/to non-host-networked + local workloads. \n If InterfaceName is not \"*\", this HostEndpoint + only governs traffic that enters or leaves the host through the + specific interface named by InterfaceName, or - when InterfaceName + is empty - through the specific interface that has one of the IPs + in ExpectedIPs. Therefore, when InterfaceName is empty, at least + one expected IP must be specified. Only external interfaces (such + as \"eth0\") are supported here; it isn't possible for a HostEndpoint + to protect traffic through a specific local workload interface. + \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; + initially just pre-DNAT policy. Please check Calico documentation + for the latest position." + type: string + node: + description: The node name identifying the Calico node instance. + type: string + ports: + description: Ports contains the endpoint's named ports, which may + be referenced in security policy rules. + items: + properties: + name: + type: string + port: + type: integer + protocol: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + required: + - name + - port + - protocol + type: object + type: array + profiles: + description: A list of identifiers of security Profile objects that + apply to this endpoint. Each profile is applied in the order that + they appear in this list. Profile rules are applied after the selector-based + security policy. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamblocks.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamblocks.yaml new file mode 100755 index 0000000..6c333a0 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamblocks.yaml @@ -0,0 +1,79 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMBlock + listKind: IPAMBlockList + plural: ipamblocks + singular: ipamblock + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMBlockSpec contains the specification for an IPAMBlock + resource. + properties: + affinity: + type: string + allocations: + items: + type: integer + # TODO: This nullable is manually added in. We should update controller-gen + # to handle []*int properly itself. + nullable: true + type: array + attributes: + items: + properties: + handle_id: + type: string + secondary: + additionalProperties: + type: string + type: object + type: object + type: array + cidr: + type: string + deleted: + type: boolean + strictAffinity: + type: boolean + unallocated: + items: + type: integer + type: array + required: + - allocations + - attributes + - cidr + - strictAffinity + - unallocated + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamconfigs.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamconfigs.yaml new file mode 100755 index 0000000..3d85b16 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamconfigs.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMConfig + listKind: IPAMConfigList + plural: ipamconfigs + singular: ipamconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMConfigSpec contains the specification for an IPAMConfig + resource. + properties: + autoAllocateBlocks: + type: boolean + maxBlocksPerHost: + description: MaxBlocksPerHost, if non-zero, is the max number of blocks + that can be affine to each host. + type: integer + strictAffinity: + type: boolean + required: + - autoAllocateBlocks + - strictAffinity + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamhandles.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamhandles.yaml new file mode 100755 index 0000000..5c875cc --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ipamhandles.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMHandle + listKind: IPAMHandleList + plural: ipamhandles + singular: ipamhandle + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMHandleSpec contains the specification for an IPAMHandle + resource. + properties: + block: + additionalProperties: + type: integer + type: object + deleted: + type: boolean + handleID: + type: string + required: + - block + - handleID + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ippools.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ippools.yaml new file mode 100755 index 0000000..7e41753 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_ippools.yaml @@ -0,0 +1,97 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPPool + listKind: IPPoolList + plural: ippools + singular: ippool + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec contains the specification for an IPPool resource. + properties: + blockSize: + description: The block size to use for IP address assignments from + this pool. Defaults to 26 for IPv4 and 112 for IPv6. + type: integer + cidr: + description: The pool CIDR. + type: string + disabled: + description: When disabled is true, Calico IPAM will not assign addresses + from this pool. + type: boolean + ipip: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + properties: + enabled: + description: When enabled is true, ipip tunneling will be used + to deliver packets to destinations within this pool. + type: boolean + mode: + description: The IPIP mode. This can be one of "always" or "cross-subnet". A + mode of "always" will also use IPIP tunneling for routing to + destination IP addresses within this pool. A mode of "cross-subnet" + will only use IPIP tunneling when the destination node is on + a different subnet to the originating node. The default value + (if not specified) is "always". + type: string + type: object + ipipMode: + description: Contains configuration for IPIP tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling + is disabled). + type: string + nat-outgoing: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + type: boolean + natOutgoing: + description: When nat-outgoing is true, packets sent from Calico networked + containers in this pool to destinations outside of this pool will + be masqueraded. + type: boolean + nodeSelector: + description: Allows IPPool to allocate for a specific node by label + selector. + type: string + vxlanMode: + description: Contains configuration for VXLAN tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. VXLAN + tunneling is disabled). + type: string + required: + - cidr + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_kubecontrollersconfigurations.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_kubecontrollersconfigurations.yaml new file mode 100755 index 0000000..aa23fd9 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_kubecontrollersconfigurations.yaml @@ -0,0 +1,230 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: kubecontrollersconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: KubeControllersConfiguration + listKind: KubeControllersConfigurationList + plural: kubecontrollersconfigurations + singular: kubecontrollersconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: KubeControllersConfigurationSpec contains the values of the + Kubernetes controllers configuration. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host endpoints. + Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation of + host endpoints for every node. [Default: Disabled]' + type: string + type: object + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: 9094]' + type: integer + required: + - controllers + type: object + status: + description: KubeControllersConfigurationStatus represents the status + of the configuration. It's useful for admins to be able to see the actual + config that was applied, which can be modified by environment variables + on the kube-controllers process. + properties: + environmentVars: + additionalProperties: + type: string + description: EnvironmentVars contains the environment variables on + the kube-controllers that influenced the RunningConfig. + type: object + runningConfig: + description: RunningConfig contains the effective config that is running + in the kube-controllers pod, after merging the API resource with + any environment variables. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace + controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host + endpoints. Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation + of host endpoints for every node. [Default: Disabled]' + type: string + type: object + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which + logs are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: + 9094]' + type: integer + required: + - controllers + type: object + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_networkpolicies.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_networkpolicies.yaml new file mode 100755 index 0000000..8e4bd8b --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_networkpolicies.yaml @@ -0,0 +1,750 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkPolicy + listKind: NetworkPolicyList + plural: networkpolicies + singular: networkpolicy + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress are present in the policy. The default + is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including + the case where there are also no Ingress rules) \n - [ PolicyTypeEgress + ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, + PolicyTypeEgress ], if there are both Ingress and Egress rules. + \n When the policy is read back again, Types will always be one + of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_networksets.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_networksets.yaml new file mode 100755 index 0000000..4bb0e21 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crd.projectcalico.org_networksets.yaml @@ -0,0 +1,49 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkSet + listKind: NetworkSetList + plural: networksets + singular: networkset + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: NetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crs/custom-resources.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crs/custom-resources.yaml new file mode 100755 index 0000000..03e656d --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/crs/custom-resources.yaml @@ -0,0 +1,17 @@ +{{ if .Values.installation.enabled }} +{{ $installSpec := omit .Values.installation "enabled" }} +{{ $secrets := list }} +{{ range $name := keys .Values.imagePullSecrets -}} +{{ $item := dict "name" $name }} +{{ $secrets = append $secrets $item }} +{{ end }} +{{ $_ := set $installSpec "imagePullSecrets" $secrets }} + +apiVersion: operator.tigera.io/v1 +kind: Installation +metadata: + name: default +spec: +{{ $installSpec | toYaml | indent 2 }} + +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/00-namespace-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/00-namespace-tigera-operator.yaml new file mode 100755 index 0000000..b7e260e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/00-namespace-tigera-operator.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: tigera-operator + annotations: +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/node-selector: "" +{{- end }} + labels: + name: tigera-operator +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/run-level: "0" +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/01-imagepullsecret.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/01-imagepullsecret.yaml new file mode 100755 index 0000000..b90407c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/01-imagepullsecret.yaml @@ -0,0 +1,15 @@ +{{- $envAll := . }} +{{- if .Values.imagePullSecrets -}} + +{{range $key, $value := .Values.imagePullSecrets -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $key }} + namespace: tigera-operator +data: + .dockerconfigjson: {{ $value | b64enc }} +type: kubernetes.io/dockerconfigjson +{{- end -}} + +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-configmap-calico-resources.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-configmap-calico-resources.yaml new file mode 100755 index 0000000..2270813 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-configmap-calico-resources.yaml @@ -0,0 +1,27 @@ +{{- if eq .Values.installation.kubernetesProvider "openshift" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: calico-resources + namespace: tigera-operator +data: + # To create Calico resources before Calico components are started add + # an entry here and the contents of the resource under the entry. + # The resources here should all be projectcalico.org/v3. + # Multiple resources/entries can be added to this ConfigMap. + # + # If you need to remove a resource that was added to this ConfigMap + # you should remove it from here or else it will be re-created. + # + # example-global-network-set.yaml: | + # apiVersion: projectcalico.org/v3 + # kind: GlobalNetworkSet + # metadata: + # name: a-name-for-the-set + # labels: + # role: external-database + # spec: + # nets: + # - 198.51.100.0/28 + # - 203.0.113.0/24 +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml new file mode 100755 index 0000000..97e5c04 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml @@ -0,0 +1,47 @@ +{{ if ne .Values.installation.kubernetesProvider "openshift" }} +# This should not be rendered for an OpenShift install. +# OpenShift uses SecurityContextConstraints instead. +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: tigera-operator + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'hostPath' + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + # Assume that persistentVolumes set up by the cluster admin are safe to use. + - 'persistentVolumeClaim' + hostNetwork: true + hostPorts: + - min: 0 + max: 65535 + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-role-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-role-tigera-operator.yaml new file mode 100755 index 0000000..9126de6 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-role-tigera-operator.yaml @@ -0,0 +1,249 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tigera-operator +rules: + - apiGroups: + - "" + resources: + - namespaces + - pods + - podtemplates + - services + - endpoints + - events + - configmaps + - secrets + - serviceaccounts + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + # Need to update node labels when migrating nodes. + - 'get' + - 'patch' + - 'list' + # We need this for Typha autoscaling + - 'watch' + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - rolebindings + - roles + verbs: + - create + - get + - list + - update + - delete + - watch + - bind + - escalate + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - statefulsets + verbs: + - create + - get + - list + - patch + - update + - delete + - watch + - apiGroups: + - apps + resourceNames: + - tigera-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - operator.tigera.io + resources: + - '*' + verbs: + - create + - get + - list + - update + - patch + - delete + - watch + - apiGroups: + - crd.projectcalico.org + resources: + - felixconfigurations + verbs: + - patch + - apiGroups: + - crd.projectcalico.org + resources: + - ippools + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - apiregistration.k8s.io + resources: + - apiservices + verbs: + - list + - watch + # Needed for operator lock + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - update + - delete + - watch +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + # When running in OpenShift, we need to update networking config. + - apiGroups: + - config.openshift.io + resources: + - networks/status + verbs: + - get + - list + - update + - apiGroups: + - config.openshift.io + resources: + - networks + - infrastructures + verbs: + - get + - list + - patch + - watch + # On OpenShift, we need to modify SCCs. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - create + - get + - list + - update + - delete + - watch + # For host network access. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - hostnetwork + verbs: + - use + # Need these permissions for the calicoctl init container. + - apiGroups: + - crd.projectcalico.org + resources: + - bgpconfigurations + - bgppeers + - felixconfigurations + - kubecontrollersconfigurations + - globalnetworkpolicies + - globalnetworksets + - hostendpoints + - ippools + - networkpolicies + - networksets + verbs: + - create + - apiGroups: + - crd.projectcalico.org + resources: + - ipamblocks + verbs: + - list + # For AWS security group setup. + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - create + - update + - list + - watch +{{- else }} + # Add the appropriate pod security policy permissions + - apiGroups: + - policy + resources: + - podsecuritypolicies + resourceNames: + - tigera-operator + verbs: + - use + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - get + - list + - watch + - create + - update +# Add the permissions to monitor the status of certificatesigningrequests when certificate management is enabled. + - apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + verbs: + - list +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-rolebinding-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-rolebinding-tigera-operator.yaml new file mode 100755 index 0000000..5689683 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-rolebinding-tigera-operator.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tigera-operator +subjects: +- kind: ServiceAccount + name: tigera-operator + namespace: tigera-operator +roleRef: + kind: ClusterRole + name: tigera-operator + apiGroup: rbac.authorization.k8s.io diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml new file mode 100755 index 0000000..14cd955 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tigera-operator + namespace: tigera-operator diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-tigera-operator.yaml new file mode 100755 index 0000000..d99cfd9 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/tigera-operator/02-tigera-operator.yaml @@ -0,0 +1,85 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tigera-operator + namespace: tigera-operator + labels: + k8s-app: tigera-operator +spec: + replicas: 1 + selector: + matchLabels: + name: tigera-operator + template: + metadata: + labels: + name: tigera-operator + k8s-app: tigera-operator + spec: + nodeSelector: + kubernetes.io/os: linux + tolerations: + - effect: NoExecute + operator: Exists + - effect: NoSchedule + operator: Exists + serviceAccountName: tigera-operator + hostNetwork: true + # This must be set when hostNetwork is true or else the cluster services won't resolve + dnsPolicy: ClusterFirstWithHostNet + containers: + - name: tigera-operator + image: {{ template "tigera-operator.image" .Values.tigeraOperator}} + imagePullPolicy: IfNotPresent + command: + - operator + volumeMounts: + - name: var-lib-calico + readOnly: true + mountPath: /var/lib/calico + env: + - name: WATCH_NAMESPACE + value: "" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: "tigera-operator" + - name: TIGERA_OPERATOR_INIT_IMAGE_VERSION + value: {{.Values.tigeraOperator.version}} + envFrom: + - configMapRef: + name: kubernetes-services-endpoint + optional: true + volumes: + - name: var-lib-calico + hostPath: + path: /var/lib/calico +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + - name: calico-resources + configMap: + defaultMode: 0400 + name: calico-resources + - name: install-resources-script + configMap: + defaultMode: 0777 + name: install-resources-script + initContainers: + - name: create-initial-resources + image: {{.Values.calicoctl.image}}:{{.Values.calicoctl.tag}} + env: + - name: DATASTORE_TYPE + value: kubernetes + command: + - calicoctl + args: + - create + - --skip-exists + - --skip-empty + - -f + - /calico-resources + volumeMounts: + - name: calico-resources + mountPath: /calico-resources +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/validate-install-crd.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/validate-install-crd.yaml new file mode 100755 index 0000000..991eb46 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/templates/validate-install-crd.yaml @@ -0,0 +1,16 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "operator.tigera.io/v1/ImageSet" false -}} +# {{- set $found "operator.tigera.io/v1/Installation" false -}} +# {{- set $found "operator.tigera.io/v1/TigeraStatus" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rke2-calico/rke2-calico/v3.18.1-101/values.yaml b/charts/rke2-calico/rke2-calico/v3.18.1-101/values.yaml new file mode 100755 index 0000000..4f7e47f --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.18.1-101/values.yaml @@ -0,0 +1,31 @@ +imagePullSecrets: {} + +installation: + enabled: true + kubernetesProvider: "" + calicoNetwork: + bgp: Disabled + ipPools: + - natOutgoing: Enabled + encapsulation: VXLAN + cidr: 10.42.0.0/16 + +certs: + node: + key: + cert: + commonName: + typha: + key: + cert: + commonName: + caBundle: + +# Configuration for the tigera operator +tigeraOperator: + image: tigera/operator + version: v1.15.1 + registry: quay.io +calicoctl: + image: quay.io/docker.io/calico/ctl + tag: v3.18.1 diff --git a/index.yaml b/index.yaml index 174c95a..1734bdd 100755 --- a/index.yaml +++ b/index.yaml @@ -1,5 +1,27 @@ apiVersion: v1 entries: + rke2-calico: + - annotations: + catalog.cattle.io/namespace: tigera-operator + apiVersion: v2 + appVersion: v3.18.1 + created: "2021-04-30T08:57:03.418429608Z" + description: Installs the Tigera operator for Calico + digest: 94d1a6c652623c1fd4ceda6edbb9145140e6a6121c4dee90320867089b920675 + name: rke2-calico + urls: + - assets/rke2-calico/rke2-calico-v3.18.1-101.tgz + version: v3.18.1-101 + rke2-calico-crd: + - apiVersion: v1 + created: "2021-04-30T08:57:03.4169331Z" + description: Installs the CRDs for rke2-calico + digest: e17e63092a12fe069943e1acd10192bf448a871dc1949a67b6d07f33b46bf982 + name: rke2-calico-crd + type: application + urls: + - assets/rke2-calico/rke2-calico-crd-v1.0.001.tgz + version: v1.0.001 rke2-canal: - apiVersion: v1 appVersion: v3.13.3