From a6dacebb2bdc6072f14f9ab66260c30fa60c7119 Mon Sep 17 00:00:00 2001 From: actions Date: Wed, 6 Oct 2021 09:10:54 +0000 Subject: [PATCH] Merge pull request #154 from manuelbuil/update_calico_version Update calico to 1.20.1 version --- .../rke2-calico/rke2-calico-crd-v1.0.201.tgz | Bin 0 -> 38406 bytes assets/rke2-calico/rke2-calico-v3.20.101.tgz | Bin 0 -> 5110 bytes .../rke2-calico-crd/v1.0.201/Chart.yaml | 5 + ...d.projectcalico.org_bgpconfigurations.yaml | 141 ++ .../kdd/crd.projectcalico.org_bgppeers.yaml | 111 ++ ...crd.projectcalico.org_blockaffinities.yaml | 59 + ...projectcalico.org_clusterinformations.yaml | 62 + ...projectcalico.org_felixconfigurations.yaml | 562 +++++++ ...ojectcalico.org_globalnetworkpolicies.yaml | 853 ++++++++++ ...d.projectcalico.org_globalnetworksets.yaml | 51 + .../crd.projectcalico.org_hostendpoints.yaml | 106 ++ .../kdd/crd.projectcalico.org_ipamblocks.yaml | 79 + .../crd.projectcalico.org_ipamconfigs.yaml | 54 + .../crd.projectcalico.org_ipamhandles.yaml | 54 + .../kdd/crd.projectcalico.org_ippools.yaml | 97 ++ ...ico.org_kubecontrollersconfigurations.yaml | 241 +++ ...crd.projectcalico.org_networkpolicies.yaml | 834 ++++++++++ .../crd.projectcalico.org_networksets.yaml | 49 + .../operator.tigera.io_apiservers_crd.yaml | 46 + .../operator.tigera.io_imagesets_crd.yaml | 75 + .../operator.tigera.io_installations_crd.yaml | 1455 +++++++++++++++++ ...operator.tigera.io_tigerastatuses_crd.yaml | 104 ++ .../rke2-calico/v3.20.101/Chart.yaml | 7 + .../v3.20.101/templates/_helpers.tpl | 10 + .../v3.20.101/templates/certs/certs-node.yaml | 13 + .../templates/certs/certs-typha.yaml | 23 + .../templates/crs/custom-resources.yaml | 38 + .../v3.20.101/templates/felixconfig.yaml | 6 + .../v3.20.101/templates/ipamconfig.yaml | 7 + .../00-namespace-tigera-operator.yaml | 13 + .../tigera-operator/01-imagepullsecret.yaml | 15 + .../02-configmap-calico-resources.yaml | 27 + .../02-podsecuritypolicy-tigera-operator.yaml | 47 + .../02-role-tigera-operator.yaml | 278 ++++ .../02-rolebinding-tigera-operator.yaml | 12 + .../02-serviceaccount-tigera-operator.yaml | 5 + .../tigera-operator/02-tigera-operator.yaml | 85 + .../templates/validate-install-crd.yaml | 32 + .../rke2-calico/v3.20.101/values.yaml | 58 + index.yaml | 20 + 40 files changed, 5734 insertions(+) create mode 100755 assets/rke2-calico/rke2-calico-crd-v1.0.201.tgz create mode 100755 assets/rke2-calico/rke2-calico-v3.20.101.tgz create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_bgpconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_bgppeers.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ippools.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_networksets.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_apiservers_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_imagesets_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_installations_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_tigerastatuses_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/_helpers.tpl create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/certs/certs-node.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/certs/certs-typha.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/crs/custom-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/felixconfig.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/ipamconfig.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/00-namespace-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/01-imagepullsecret.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-configmap-calico-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-role-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-rolebinding-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/templates/validate-install-crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.20.101/values.yaml diff --git a/assets/rke2-calico/rke2-calico-crd-v1.0.201.tgz b/assets/rke2-calico/rke2-calico-crd-v1.0.201.tgz new file mode 100755 index 0000000000000000000000000000000000000000..8da5de78bd185e53c9cccd58dfd7ff0f71385071 GIT binary patch literal 38406 zcmYg%Q+Q@U({1cbY$p?AV%xTD+qUiGjm?QCwylY6+s=FD|Niqm=k!HC)m>G)_g)v> zyQ*su#lWD0{7(Z?gU}jDDl?i$%CXCOaj_Y*s56?XuvuxVaIq_>tFy~#*jgLen|i4# zIq*rE+1i0ze);$uwj@!-emDfciGKJL0lq4AGTJ$n*u4z2aCyAl#TP7oZg452J{3s0 za>TEKV1ei?aCPo{`6)ss8gh7ANwL^a9uhrQNCk%p7b?Cedt92P&c#wXr&c`P`U<7t z)SWSZoR8NQ|7$D13=w0b=oaKSGbI z=fbP%;t9WMrpLde8L}RT0DpC(RT{a!xy`thcsXugO6S7O0Tkx_V{Z}ga^}iOfyO6nZ%UnFKW@gD5jSOnMbE+o|8kW7!-zh5%nDy$?VlZrxTW z;HNV71SIngE^A*{rRIi5WOCS^F+YREblMbvdD8@;&JYk{z+t%BYPhfRv-x83_QJl3 z&W(l4S$rzkrbx3k(|ka+T2aqgyn@)-I>SY_7SK3|+?^C+Is*yx;cB4} zACL%w1;jD6Gs?ndC1Fg%xeHcEjwjbf89&pOAoqLTMiQoYC^HQV%jPAAF}3sa@#eT3 zjPoQ-nvt|=5ow3g^3%tvzB8K9rW0866Dg(9wHZZGqw|z-5rLk9je7&WW1R7XZ&nP4 zSrqYxhk4sTA2%Ao(gR^vLOV2^Ffod*6fk*+wsm)qfmWKaa+l!S)mU!L5ST`~Q<(!| zIn?c;OaMuj@i3w2Nlvuv)0JV@@i@H~AYCTAd(FsU4jc(0fLZyFnvISiMMh}mEZOWt zwQ05o1araL6lKE!R@lAyjnSCCZI4TJ(A(~M{UV3_DK|znk|(@BzUJ!4$?o!XyBTXq zW7v6O@%ToE=M^`1RZ@((>ev=-c`Os6 zuN7|+tPN2X&uABNRN-+3YDmL%d@QFfv)3mq#X0+&mP zD8I5d&5%S4+vmxd^IHQfp>R)1)qpEojBu0lPyE-w&0m?p1_Ii29PzL7Jt7!nqjlq{ zc&$1kx24l=zxhoHZSkG)g27*Kl9Cf9$^CDJrLKGg)*_Iy`u{xCZwRf@$NBKFThA<> zUS{1cGEd-GRKaF&u{}%jkpu58*}s4S0%5>!;5Y5(A8B#kq9oUG|FITAis_>WN-Auz7*;};zTx--fiy7cnHr)rH~ z`gS|VU=Bn#LntgxKZCVDD(MX7!nzx%36XbW zVm0UcWOUa{8X5be1R3gje29#I^fLCdsd!%GD$ns}!+1jFI5M5)t{6U1mgax-B$^DP zr=saX`swSRfk|(xOZv>+^{A{;%;N2t=#z8>9Wr0n(4{O50f!SNL)3j zdEyWNnAd0UTfLG4Yu#Qz`R^=|_uYePHL9o}j7SPt3{1FRIgCFJwR16uomm@QvZ%!u znipD>2O!@p%_RAL^njKd6Hx~jEH8PNwBYC3MaWMkt-HIj|5)=cX(7y=Hf$lRyrQ&t zDd<*M9LbH+pk!+yh&kM&tTMMAMmt8p&PZVpckh1VH3X&Wch`_-0c>&|p?H*k2*#%E zVGkh*H_1}StK_JC9tP%wEJbWS&{aP-f0?IpqJ)AAv$b11BO0Kj48SD2mF8#nE|+Myljb~ywb{4(3@mcrQpTS z?9(DB7hp5$jE>ZTgO#{gBlyai=a~}(`j2Hv(RD?YQ>WL;g@!^7sjCt=`dQ+0|MWMB}FdB{{3pLh6_K9+KtYZ%Ib_9>W;Ys1<G; zGU4gmx)aI;Ex-A;5b{uC2Aj9~X3p{5GCOURDz!`h zf|N1&JQUxW4Ou+}x4mKUHq}D)!Yb|6oEf_tNAc8;sjzAu zgq}0$>>Jn+S>9M&&gqO+Wmond2AodyWiu`{ZzdK~`EP0>C01oV^1 z?2fGn<|v_&uRMhrf=PgRB%6^+uC6ms#g_6lb8RfloZk1jT93YJTE&be=q$cA`3Y(K z9st8~kpQ0;leh#ipO6c>?DMf)W9GQXElW|UxhXw&ekZml!XaJiR+*XXuN}{UEwij| zbLv%qx1r4Ks5Xx>KHgb-2hSd6TOA|Sq~43K5t?%*^CSi7m^SN3`1Z|Rz?R)|L@|83 zFju)>PIm?&xq(cKbsd6B9?4AfXseGiK^3l99aIq*Ac*}Yvf*+KQ*9J?) zZW0ZPhGBFq4IZCntPHTE?bAfmCz`-ep`E!#x+(2AFy`+#F=rCq6DAsn#{ZV-)Co__ ze!;p?7}v@|h5eB$3?2|RT{s#f8UUhv1WN7s4z%UL^5{!(#Vew$tql^Yk%6uhTVt!u zR7I9Cjxt(nU!Qqc1oiqv9-5pe)*bHZddAh_Eb{Qy^ef_^cWBFbSSnVzeItcYTk)_24{xV=f@HJgJjfe3by*s}3vB=!zX7!gfhO06)w9$iShNT-?> zu?sO)9nZA+j2A&FPQsK$XS}S;+c%a9@EHk>nU$=7H?A+v`0E7o6eMO$y(^Z1Nmcv_ zlAlz`3STW?&HH&p{eAUh*y@r8sy9nW9N(m-PG9XtI1GY6(Er<~_7S=U-%H0~P zE-a`MbRdyb=_3zV+^}}X3Hix8hWWG)&ERt za^Q(MSmUw<`Vt}qoHR&i09r7&7qk2UZ^Gmdl=$A6EIx2xe+ba;;>W!N8tlLGJ_8Xa zJdHU53BC{{3>>(@2Yfadg1B|F^MZD-y>F2azJvM&ZZDpZLc0peGYn&zRaa{BLOcaU zV|D?Jv49!NGkD)<$0Y65?l+_gNKWiKx~b&zRIMUcve8RU4nZ@+2Y70qaFTK^Hs1*r z9&D-zW*H%nY3!xzNv82c8r=Q@co;LMs45>m5mHOL$}u-D(Mkpvju@$HHRbXZ7 zu+}0B@_O#7V`>*mY^lT?C?o#z$ey~_#Ba4|XAPeL-|2WR3M;*7Py|O}JTrwEwHf#F zg_MD%m#D7b&AGQT6So4P`O@leiPqg?m;Xq6^qNobjY6zx3?B6XUTif~ZLo50jr75Y zpN!du$eItYs25flPA*}EhoB`?uO`&I=S&@G2A9Suhwe@_&(yjFxsF-Tpz+VvH<0Q8iXw>me}ZA4a7A#pqt3zPbh1a0AJ99Ed{2aR|Jk>bQ zUrj9;poZj4G|7;Cv5|fZJObpY6{I13&#L1&t4XkEu+wfyLc7sQuIvXH`+s)GO#7CpOU3{J1jOw^M{=C|Tr$C&p%?q0}T}zi9!*M+Iie)gUDD zF;&A2D)rc!!ph%{VXYlKm^=|xnOwt#=|&6sY-8MmfXp!K z2iD;~$&`A*vb3Iae1G80dIr{iw6=avMw|{Zxl+N`A$s4%K};VsCGepjt-%()l7w^0 z+C*g)HHitMc${=<%)<@*4{fx>E3=04(P3f^b$vr51Qkuj+1Qwp%vq9i9wxLsBmty;3`d^)>d(g1bvbQPg*9?}d`l#x@WqJG^`JN45@GyvB zK~3_@6ux62M{xRW6`@$QpnHViRDu~=pgcqI$SOtydO9tahAS)>4wh&YI%%PaXBmZ7 zYV7pbpmGWFlqM#Jd#!oDCfou2T^uAlNEFG+%)9*&(0zlV_Xl>>?9oPcjad7lv zZKvcRs%RCe`|aVeGS1b$D*@j?s;LocLOKzAjYp_%x;Q#5j#>)+3335Ys}MfRtbx(1 zTCT+K2rprD*5f`?2UleOTj(&l&U56r+f(td27JJxr))il63g6CVS6n%J1%DTEx-Kj z(xSE5cr--+V#svw8-6F8%9*R_=jnJj?A2em%1S;woUS?bAvr|~F|xGcf-k?goRs6X zmTMA*KTDzofmBH^4ZIOoSB4o0?YKlsuL-|7Ii@YXkYYIeg{p>~Y`_O1XDj{`=vZ;g zRzy;e^2txt6L&JR)pCw^UPB0i1bo!2&#M!d!g~=p-;bdWbZb2%3xTC>^v&v;r|+x@ zl~!m%QL9Z6!n~-Ks#~V;OLnKOUb5#4$%iJH-jpE+oB3qIF{M$YWA6T;c#O4ke0;f02Yue$2z$hPw_Eb0LU4Y9E01oOU~$Sa7aG9rZ4 z`21N_GCcQN`mu3ne8E^L<>2x$4flel(~D_DO=I`FJooy7{J;PQR*DXYVFLMxMj9ya zOQSGy*y*(S{U1j61fZp4hb0nmlP4@ktypu>sc7T^H9MTeBW~vHf&$O)SBIU?F9$Zb z7%gBVz6NM5IgN|Vsh!3X;_Y974;Yrpz+|=9P+M7jtHTlU-Hi5z`g4~L-J}-*O>XfD z0?x>Yv3~(tzgH@4lsv#z4wZ+Py8fq7l1(wTUbwbkSnk)C`(X!p|)Oer%8=N zn!W6>Om{A!8J{;Th!0e+o3=Ln7}Ejt3?8HI=Y1jY7e*z-X$+EZFc7nQ9NZ)6CTnVV z)s};=Kt{4+br^iKd-ZLWBROrCNly%!7zoEWIBen>ZjB9o+ z=w(*>4A)e3@grl>vwb0fg5(lShOS5v`WxGM_oZoVXM~3YpZ%Cza@h}J;Nks1PCYg( z)uV77<>ZI>F_~@!BEOLpe5s#|?u_cmK0)l%R>ugs?nj4S?inrwc9K03W7^2r(P}js zgR{_r)>;G!MXys*;2VjCEhNL6v_?Zn=K>*kd-+9<^%Y!st(njxAICg|Dj7j$yn`&x zeCGX0;Bc4wXKzlC6dI zDbL0c6XS_sD|LuS$t}Ct44-S^JGI~83O20Ye=>R0UTbm;r~oIrQ`sYtM9_?5JT0l# zd`iwEEbN8m4LtZOzOXF^E?ML|v{}EtWrsg)%?X()1(w4kW<*AV!|q5Y<35`fj}d+j z)YkaVe_FR)^-G#qX^ui}{53Yo&ynd>u{1NO+|+7JmTI4;%TBUz#YD0PQ{N5OceFU5 zk}$5wBkt!XN^w{*+h+RfY$~cz&uabrOJbRcILJZbf+5w{?q+}RW1KLwQ&QhAjVMcIJVLVLMxN|ri#|lmG$Y^6tQ`VG|da18D`Nu!ZInRZ?A^IlSr#nA8|W$59ppb zNH2tfN{W~IRS|wlJ=H&+_DG`W&qoG6Y6XpaoCsZ2PZbhqneLU_C$jWMx0F5@glm-8 z`rW^pWUR51z>B_V{Rp}mT3&ZDZU&b?cO@7>FzPq1``qH1UQTGUY2}BsY-;FVGw5f- z`wx`JWg==KdkUiMozKs!j~5QAbTeD?G1g*I<*Sw&7#+sh3j!L*%{F714X)?yAEd)S z&}x|S#xixG(Rhh*ifOSpkkM|0lELu$grzN#*RUN=XbflSeHg;(h0nH10~>`Ad&XKs z78h=y87EwrdJS>nAQW3bn%G2(88+b}Sz2|+Q_os;J;dmHVDklfyIu`cZZF!oxo=i3)uvVVeT`8A$G><8{ zO0n(Cw4Xa|3HaGT(R?Udhe(bPyX-M26VWkXaKfr4HnLJ>wjt;eBg1JBv<}v}1 zbLNiP32;>52GWeVEevm9ter9Daz^t(@~GR+m7lxxr3iUMERzM(csX&C!KxW1)?yVy zp&%gPtCi`P@cPLSb2-ac+wqo?d69JQ?xUeUaB0-Ic|m)E;4=@v;}nge|3DWa3rC% zI^+{sl{f^ajU6q9IRqwb)*OKroD`J2daAWbdA&!Y$8f$8$5)Lh$anPN=3gTVhn0EegK&R2ERB_HTW>51d>xX}bfmzhUhg0v(duJgna(O}ahc*}Fiv{r z3vC(t%^$x2ET8hJH)d4QoYVwcM}x?}Sw=GmkHt1I)dT*1y2#OlAVpg84ITKm0lQJ8 z=AFUk&F_Kr3a$W)OC-~q_w&o+PSVL`q6*2Q`vh@}%iXQDCm>uvs98H1qrY%Yi#Mmbq4;s+ma}C=578|H(1^zEQw5XGX9)4b?0E* zfPsQaQNF-*g zd0D%TsXQ>@ zccRouIqNu9uHE=;f~m?eZV@=6_^$touHWTHt5=kLUp|uL6My62Ll?saU zE3NL9g9NNUn2#e&|Ip2kGwuJQv?z%I&hdM|8X#P-PDkg6^^71m6%Efc~krQPjlG1tGylQ@z)bsHXe(axVr_={IO zlQM?wwMLFB+~QP-?t!U~;@nW=yock8niiG$p4aQ+h#3OT_MEQHw|=tOZ?t_glHK}7 z0v?N@Ox>mmq#dQk+&Ti%$a$}~MjmGeG-nyRPL$zqv&&NTWa4NeYZX=Jso*vg;y}c> zbeOZ2o`=>T14dTfAzK*fZKejCEl@t!KxXSTs_zT9lf^uYr;lO+lfuv2oxg|icIL(Q zg)fcYu9b?fGzcm$ofw9^o6n2Udx3>ymF9{d21_|3y2*UUw*<2YDv84@=zeo1=+#-i zE7*ArQg$0Rs(i00%Ed_C>nOT{H6u8)tC^n;v>J14KSvAj;-lMnuyX*FzU!0syto*K zU^=p}lTBKVS)qBa7S{A9;6 zv4u2JEuQb3_}rbPZhSAvLODA!eS4fyyA7V(_$@RbSlhv2&RcPbW1acmNOa>hBqpJm zp<~AIF3FnVueWIJG@aVI%I%vp5^>bEvO#AugQ^|d$Sat>n{>sJjB8+1%g@68t z2wf%}I1)Ta0+_1)@^xKVpWpfmj*@oa7YpMlvAkYyX7|QFZLaA_(ddnI!+Dx<^l!`T zez-|RJf<8*46#hqS43cM7SK96qsxSg)TqZ3wK7_n zE>tE?h%AjMv=3vhzlVnq?0JIH z8lzh(CCC2#4R;gx=0TUenNZoR~7jP zQd&fo1quB(&U#(7YHvER=1KbxtkW>QT6u#U--q{XO>3!QnY8Gq56j{arSg2I#UqI+ zJtnAoqJx0A&2QE!Zlw4&MzTtAPIX0;diE=E2_uRVKa82yrQ$rYnP@ujt;u}dHhDmf z4_}DZpIw%e2mkQh*6)7ln7ozC9#9nH zeB=fu0xO<{S=~+0_ zS+yMdrE7G@FbL*zQY@6$RIVeeNMup)<^{O!1$l{5ScqO(Mfl(83USv}SPI+sXrDJd zR&C(D;H(EUlgh`0fSuf({i4DSpm#fvm^<t4tsyXOm**dk$@;d9TS?|Yjw#M{Y zBcjh=be_}@Z;yvTEGkII@7gSBnI?#2Xqgn%MeWajXNi-XU5zzy^OAtKY%`fqT&v=v z%owaJZnmAQ(8|u(3~2jc*w7FpQbx29EJ{m5T@NV?Vj)?3s+QJfF&|Sooke5PB^t$1 z-(QVg?x)@%`&5Hv>lshv65?4-Q3x-qUS{|%p3ZLrfvz`4_q!3djh)(zg&y|OqNZ*d z#C_ik#vPIghgvsS!TO0r7pPvYIGKzKW2Ozm!VyauxV1h>OzPh@I3Rv*?gy9sVYdvg z$DcRUI&&Bq6D%r3gk|$gJE>kvRTY;NWiaN<3|Vns^pW9=hVW<5>^DhoA3fh~0T5y3d~~;X3JP3&)8XYFEF7R12`lS)C6G!j9|V+$6Q~#-Ea-EKh6=ANW&S5auOG zLflDif2I!Z8rl0XiO?|;x^K2^J zjiyAw$mAJQbee^|88?|qyk}ZTmH~fX%QQ~e-t@Jtuzc-he1Fn}nc!ayTigQClwl)M68`wr1pj}~-{4Aasf#i_R^m6NzZ-D+@x zGOnkvCv{6I?QzN0b{MXVoE!M5T1^qrvD60b#$JK>k=kok zYlt3i&@%rtN{!u18%f%bSBR`Kw~8u!ZUbEUinQH-RReMHUbD!k99l@yE$(c%o6zn< zJu<^L7i6FHZ^HD3tKZ!i`zxuFrvoLjh1J;6RSC(eY{0F|E|>d)MB_(~GGlib!qo~e z6qS`P0v_%XY4okluB*7*?Ce&f%jti4+7XT4v67G&P;dRG{QBdog(G`)GY9Uu!KJYT zx&1_>H@v)=O>}gPon)DGmWxoIiV}>=9Cz|N>f`rDkt4xByKiF>)V)DH)l*-{rg285 z{-|I5?vPJLxg$VhpnOM1q?iYjh(celAWc@*P-Dm8velQL*`!;A@-Z4+)5@Uc z9a=Q|sS$L>=tPk$%iMCc%VS^0wapqmAhrERv{K4s6dGEEF+<);EjlKnbMrAw3CY?S zD_6DNFwGP;ol51e+8O)jmxXE8Y9di6b$J8E_14Wu0BzfClC>&}E$S)7Nm;U_QCr_> zY$a{3674D$j_XU2a#lHA;W?d@<_M!eX}PWM)~k7CM}xvMs}>mLi$QeLhjXNawH0#l zU%ikD{uCnPUvGl|MUr7}YIpqAiMz6d)HKO~N*g{rTO$19RQwxoTQ<@yu}oh)gyV=3Cj}EIxEB zy=-o4WgK1CgWuat2MVo2E=4#tG3-_!u${Cf{X1xo#R&_%6nKaY%+u@>nHI(A3c zu!2!jm5ONLKTBnQw~|2<5!3lfKM>Fp2DE4LTHVvA;(94=S2bA-$pfx_NGrFS8)?E} zrS7*K9sI&-z<#|tT-LiH1m^H{=HGjZ0v%#^obTXv8II`ILA#oPFL#sws_wd0FM(h0 z!xx3Xmy9-k8Q=}48Lu7m?adyZ#w#KMPGF}R{OuT;4qsn!B549uXP|>X(>JeOUqsKA z$j)`4gU2K)Z=-{UjKLM}?DEa9$Ldv`h%QexUo4dOjsYx`u!!H%X5dHG2MP|1m>Tw2 zx#ZPP+p>Gb zoXErNnWIxPhL&aP?JB4SJcM}k+f)XNwBb6!#cU}3I`$T!&nz^{poU8I^(AE@kxe!n z06rUo2nc&9HyJ(0zEqTQ&&!sI)r!KVVvxZ;+siIUw!?=05EbJwyevA#x;~HM1d_4d zSQU4su&DiTYWap_%|ty=w`Keh{Pr6~(jNApZWd#Vzx5m)wS7_jC<`)@Yww}Hw9^A- zpE7J&%7~dxWyeuElqlcfd|t+upjV;P6sQXJ#RZmSbO>cj@4j*?l~OdPpJ$z#BmEdw zYf)r^T!*_`aJqkVjpfHFF!z60bw&nHgED*U619DD<=Z%QdXP_FZD;0~0c7G~q2qs? zXK{59YMA+HS+|8d7iCIZ9`EvSCyWEC2e2e)6v;61Nc9+^vTMW;Wrw~|uwSX;w<6{H zyzm8Q8E8O?yA8O{_y2}RV|u!!k09cnbHpi~EG<18Eyw-Nav@&lTVuMP5n5jULeNj9dOZJ@)Ti_gy+-7~Axkx5zQGQUOzQOQR}0vPW{(*M)Me;Yn5X zwO5*}U;2W)Uu2PClcm4&5}tk_4kfX4jLwhGLqxGv%eCCZxlo1(bZtdm;HGF4{&SG} z(0YOd_id#G7R&&cjAD+dkSp&fs1>C%9qg++k+8pdem9=rv z&t>}DHMTKXWDY{*IFE;@>A|bYj54;h)+y+Xj53byQ!;nn}2BA zs2@JVwGpHAt}E=|$Zct?hiwDu0Isy&50$l7*Qik*dn#8CwVs-}3R~LZZtywh%Z*hV z-Rfs%hU$EoY1>-mSL$XPu?|ZZYG&gs)0wThpw$DoJ>K*PU+C0{$oj1{-t}l;+2~u# zN!{HviXo-z%MK2Zi_Iaw@<%Q(pdUOM9=9VF`)~eTaBP4Y=cZkD(twf zy@Xq?;PlBtnvZ5fk{#=V1qtQ!^hU_`3sYHv zab(78&Lj+t1bx;<(RWE(eF%p(x|wE*eqpRiu}?Yq5I!#;>Md7QyM_PTgU#o9LLlcb zv!^xp|7zrV=Y#gTo&`0F&uy15fP7#Pd#L&kI@MFsm`n)5#=5qyD9myniuC+6Cb9?Nu^a@Y$F8C@M;wPl~E9_5u%;T=7N z(wii)#q#B=;_gnLB^qOp5V&@Z+*$h9RB5204weE^D|fk=n;P6tTGVy7@LH(RXBh2N zh{~PF7VmC@iC2hkT?YrLufSUo*PwKrw}$5nq2TDZJN zYFv}pb*#z{Fr2HzRs6xfh9{YcF{%5+gv%DT|03X4tP=M)YPM6CS#YP;7 zJ&ccSFRC4$y@Lyu?`=V8#At50A=t8?){u-qgAB2k`1LouutMG&dd0^y0 zg_-mcO>T;sD@O`euCP#=fGbB?taf{+i)*-mjv`h&#VmsN>-+o)=uYP>hdug@e@N!L zPgXLOnD82wz;8^mo!#8A>sVYGhxie#*$|N}*&cI#E@bwU)|wec^Uy3^5$IrG)3c)F zYDKK^1f!aG4E^jdvc`lWG(!dD>EB8^*%zTZ*7e-Pk?UstL&vaLchS~9vKmmcK>%Y8 ztewk;Sstt~?k`FZb zv-n4PN|aTNLGW!869my2wV3IRu>6i;KX55#BI44?6KbQ)ttM(2%R)U)&CakM2u35g za4NEiybz~tjkKEK5jXsNY!;7mlinY`hZ$cHTMJ9Q>UDQJD<>S!D9egb2w?GDgnO5HF7YLs@huRpDc|V}?{P$kRxStq>qwNWB~x)x zOL6&me@Y`pDT@>>CQ=>Mk-QlGXL?`dpDtXq(txPxe}(_r|C_@!{O3Q$_8&LkEA2o3 zrMmx5O`=rwkaX;x7#gcfzdTm6tdyL;%<^P-dCt8ELN0LVC z{^v1|3B3a%=t^Jz_4vP*{}yRKD%^C2T>bCLgcJ0gHvf4CLTQ_hi~Nc|$Ny2`>;K2{ z-jPDIHlT>b=zmQn=#h@nBb+Da+Y$aRO8@)iB1NhP8vg;Z%5ITF>0Be-hw=X*`BZJF z{vSyHYy1!0C9umxDvb7j2>vrC3JCk>{Qm!`|A}7%6Z9{)3!^KoU$*&1tYW3S62uIw z)`(+go0TzcF{Lowc8Cj6wUFpx*O`MpAF`9}%H_II3Zv$M4KDwJ#Moc%vW{$JCVxg# zm-iv_b<8}F#5Y0~Hu!LGGG>0Sn+r;Zwz7E5q6-HrMS>b;jgfPV5JGQSYZyq!1B4-`J(?pZ2 z^t;rbCkbtV9?0q-qC*g}W4$35;nmuG-e|$MOax!7af|eXzOK(q2TaoJIY)N*S7+Vk$2cU)rjz-^{)(* zWSSggxdn5U0+oUFMe6C}K0}!6Q#mBC!#e`sNt@Su$6s6r;nZ1MBk{XB%qjY3+k>dY>+v(0Wm?-%{IRerm^ zq?tIZhEzXd3)G2|SanVVQ(FcxX_5O*w(v(W+9g&Kpb zT}|Q7F|Bx6CVBmHi>k#Mg)Akj#ZN6oF|)iw(MQa&u z;^%RK61UtM+{g#wTEUVX|2(Pn;#Dl)QTfHGOukH{GqHEmkbMz4Ck^*3*{!)M^vM?( zYJ!b~8M5Dzw#d+G#1{WwYIEr8x=Pjr)JA&nSKS)0B^2q|=z zD75t}rOL?NwFmJ0uf+dhCl$lWPms!$Iyvn~Iy-2smD+F{3wffQrV{UZJ*%^O_Z9Sn z$6CC&4X|BiqP$h7_|UO_^91lXPOVQQ>;_c$vA0mROE!`|`L~5?15mf?#7R6KVYOzU z#eE1@DlZbdqrlZg!p#_$cA0Xa32m~TgicOKMS{0}TX_X0eI44G2i?|UH+NFDlex;b zMd6e%h5 zAE6HL!IA{_HSnJL`Q%`5P(kOmmil_2(Hkza)sUjJ-(^C>$7%}@u_^ffIf3-@cPkC5 z5BW?~nuf?V=Hdw}t^lzfCs$Y3$M++dSK$2o{4vm=%irmK>2C5M#X(-bm)HB>VE!Lf zu;=ZV*7=bfS+bd_2e?e2u#w`_l1Y=_}er(ZCmm03756JA}aQ4U85?tPuG@|ix-O+o6jFe@8LXe|~rLI-E%c&E5^$Jx$W z#}l646hU_?CbsJ8!#&_1PcZ!-PY^2gJ8kFOU;`ZPq?>yrC>c^G-D`r`V&B&J?I7l2 zeHIVFgZ6iKx-3{frm9@Kl4{NPQRt~L_dN(iXy>h`^>QW*eid);!LP z&|@s!Sr(OfuP_`+?1>26juu~J41hOmUG@F()^R3o$0|yf0lt6w9eDu#^-q0_Q)VN^ zQJ#cb?LKTAQW_WOZxQ{2 zb<5w?-b3=e(4gx*9;}8idGDsdTpsKi#bciBT(f?HgVSPNQvex z4KFourXJ(cYrM>{eqO@@LC;JQv+X61%wV--{Ox1DRE2}FS zDb{YP<=<{zU!U&g%RW7Potei1{*~<0-5caG=czx#yL_=9_S`O~Picf$iEP8)_z`M3 zAcsLISt5sNr|(jW6(%A*qJ^|%O1oXrz%(dug(~UEcgU@|du<&&i7s1Yq%6s-O8o0D zPPWI6tw_v;J9CmYx@9`iELe@y;o7%09Ldw&Ef^`xmAAcO1YT~2b2#|J=_PBra~6vv znVyI?S7!deUIu3|nQ9M-w&;K_&j~vm+1REg1?FrwuC%Dm7!u()H@!U85KKSiFqB_w z=F|qH#8^f}D?k0fvOvH&d>(@-K4%g>m1};ryo^PdV0%}rzsF|#`Ae1ID&5ze%O%Ml zUY#DcosHkIl}&r@1O4Zq*eteMkuH6!<5I=*Lm1SJx(e$;&0RHPJZDv&IxZ!KrN;bN z%loodNSM6C%lDJ}O&^bNwPQ;o!?X@Vv_j3H9+ZA+>IZZ|qnZ7(Nw5LT0V|_x&;@&* zQC+((6Zsspj=23q2#vN&p()d-A>mDw6OED$By?+{V8C;GqxkJQkF+peI4~(vc;stVuynTFzU0&*RMAEKq-#Wk4Q9YReYSQl>OnbVbG`Ln<_GhLH z9711{0GW?f{$>3+P3X{Dvm2e6N3e;G5 zx?#xHq0{oKfGIaf>sClhkCEqf*yi5N^s`SHYS|YrxU}X`+89nsLQv@gj;t7Xe#Q|l ziNdCs#@VV4(6$E79Ni|tY<-LuIbuf%kv(65QPK!uA_>p;Y>`el>dHM z%zo0C#wMXw(cBIpT^>Zz&U-JSTXi;kLD}2@r=DOwe$AdaXN@1$F1>DC0R!9~-4fJ;XXL_##z>iju-L~f_u78&Y+ZQ_Irfz*# z#~!G^tl!WtUS*@9Q@6xVKhsj0iis0uuFhe13NuIY$U1ol6t>?s=n@#NQY#u`<`x4u zNQr^2Q_86ze~lbc9=`}A!%n`d9sy ziHF%o7S@SiCa8}gPfQR%3&JHlNup9&7TR$o3@r!f7kNE=Zz@FsKsJ)9!ar7NBb0WZ zl-7u>?4Gq8V+b?61%b}bZ+ntWhA6+sAfFOgA}2Rz^y`Ib9&#`H&HBi#*UI>?xa@vb zXfw06Z^~MU^MELH7XBMWkk0*H1HT7j6`;@4zULgUXXt6|Q9uDlp$;T(a0~?z*+EoI z5L!+YTK3a21eKF2CyK$*n{{QS|5)D^XkmCugED zso>YhjQO;U?N9{S=C|~E@ruv!)`(5`mMQToe0jPz8UOr_JU>0_;hWWcZfR6$>h~86 zvDhJh7h>`^4h!O|?VcF+VXwf~&qBBLBNRsu{FQ!}bg8-W1AJhqrD*e=nIZOb7)YGMyu;&R2FSMqDJc&a0SzvJOM=C=;M?U*lpFDKSHzgPSP z^SG}#rY!BdOi|=K^by~?q3|&bR9OotHKT@%XqUdx{hU4!Ku zW5hP(0%<2aH-0YP12%>*LUx&G=Ohl7B05KR*)nvhqjIBHITb8mluF6}RCn1dr;uZe zDh>$fFRS@JW%F298*_)xt$i*7~;OZXF=bIY{FpW2!lIBKy}I;~6r$q%$n&S&?1Z4U8+no=RCv)Yy$-{;#8}wWZXxk=yb#J2jsV z|M#}>kXFz&1_fUBoobTM)<>^ooj7+pMk*r#54dvCON zU2bEZYUSIVNJ{S79%nos%R!aZr_&VBdS^Inm*EyuaLWTdYn-a+UJFY@?48vXf#vgk z+dMWiV9eXdj z>@Ssm7U$*9Bk9#8mh@iuzs%{0!*|Ps^QCd|^E$~3kHm@gFcpzY+N`D+Hx5DY*|s0% zGC9ADi#}JRD~w-3x0R4abpIfcm(3Ws0*=iY-m99b@sZZ1_--tFeJ-V^Eyt&z)lxUI zzEW3SH`CU2e?zNnh{)}go^*tW_sM~UR-gvXb&cv?LuW{29Ii`I8)P#3=4c<0kX#x_utD`go@@qbMU`-g69}NqW z;GWN_pv>0PYlsrqm_;}mjXl8pw&F?Xa|!jaqbYJiM^`gl zdLt}bC?3S*T7Jch1){lLIAE}2<<^V=RxPS#f=z45={ z-T?<;r1?bG_R!U?*XF3`6k*db*Yx4{0{*ZP>cN88g+~50DPxlGcNG1^A>Hu(mP~8O z{x8|vGFVB;)TSoosE@&8!MG#DO)6THBpMVYL6UWhftiKCY{1+U%?vtC#-(cRa&Dlh zlt=2sVE*J&smkWCzv05b^E=Kqt(~cZk2R@<&GJgPfwU9gx61=)FHU+E^3^p0S2FeS zgsq7K99s zV7&6rwD8?nQ3?l8$Dq>MXa@A9-j;xKFaO);~t?nWO4iwq>7uWk0kI zoOFy0>s9SWi+i`BOg7Th-Vfz%06cCotZ90aX9%hCg&ke}+(;7SN-B_mQ?1 z8mfwGzt0U^Q<#QbsuihKYT6PIe8p6h>{neg{}_Z#YBL%a{^3ZaPG_k0T=}l$dnArd zKX#FVHrJbJKJrlfJ~XM`99ujP;GR1JPH9gw2345>?Q|jpL3b>QBqMkFt0%XYiOb#m zlpHNFZK5KeU5`a;cQqO-9m7srD-Ex;HBYMOXzRhBsil(Q>N!86mSL7xWu4RnjaFT< zN!!Jf&zb6!=F}-bzE!eS4S8v@Z5{8IBX@tnuGo+W(#CrCrJxs@T}4OylmNmlYL$#U zj+`-{5j}Xwj2Sk5U=38n?);Y-%~r-4JkWkr5bX0Scff4Z_t*&h;BNWj9W#!56eRti zJbJ8%{xQ*q+wamqjtrii%2m2zor4=Ig?l6#qC0!!D28xDX13`24W_FTmfIUXO0(HB9FU5qZfQrbLL5F=_?DFM?+?M&nS;a+C?jQW8-*_ zK2>_wMQG-g=TuGUtB+@htoZyq zDu{DP>yn?<^f#xE`~CgnxXJf-s?c{Sy`y)^N3P6-+j>+kH4ZMS^-H(pUHR6=#Mzo3 z^qN-sF!HvxsyTOYD-kY}YsgeKq2md9PW!@sdg#a28OO?{9$eE#b91d#I?vmV>wMy$f`{Z{DI#d0GSKB#kzui_8P?`s zc5{nwxd0$G`GQG~jG-w9tB|N2B(!VU(6kQV3h`l5#;% zN@sSR?33GkA4DFfNA*$<{lUWCl0WcedNI~51CbEZEHJvYde7K1tPKrbvp=miT2=sS zlPNZe4&eNjp!7xB7!+w+^~9^vxD!Qo1s`G7j7eZV{mz=($#nuu5sij$;`Od;{%Q!MI# zP=ViD`TFE?SihELexp`aC?nc*A!>NObHZGMkd9VYr_2q1?#2Nzy4)Ol1w11AwxzKw zo()!xN-EU*@LT#CEv_-TzOUi!X>+oMP})m=8Gh7O!~0-uB{R|!(@lw2Aja(cfo<*Z zK-!&2*jIl14UYMQl!il^V2PH6GiF*Hkr!D$o|fz(uj-I%f!l!MyM9`@qH)B1HPh{2 z>ynL`ZE6=}nc=HT9L?4NN`!zM3xIQuEf`c=n6ZdlxmH%86oYiu@MPPYqesxl66G z2WFZwyh*X^vU#WS8ry-Uvxu_#y)^SNt!iJzDbp;*oTdJ0skr>`ZHM(zU^c>P(P>M} z<(0BO7R^$Nk0&(^vFWX`6yw!{YrE*S+0OqX@n6B;7L#i_0GL+NbLmoNFt{c~z)(`W ze~yD(T`<;0#jw$BdLEG75?fFnkwYtE<3Mi$Y&+q`{Q49$v2p)>wZEwndWk=NwQY;0 z#IIT78Gu!sKdF3-2cT?c{e*xKl_E_d1HF#4$)cPbyUGE- zbFqzTJe2}%+qGwqORP9as+thER z85)IwOF3?Qz5p_}A;+|RO|Zc<)e=4QRx$|^b9HRVZGSx%Mg}k7auOz^vJEltzMBq0 zIQdMX#v5YCs&A3a=ln*+FR5)&`P>>5%-mD_*gYq;CxF(fCevlq|o*YlCW_e``9!liK zMk3*1a6F5=;x4srK)evc*MZi=KHMSXWn!Mx2Y?t#@RA3WN|~k3rMZAjS*X(-96c6< z2-ZlWbf!BqV!GkSR6;nPtKAEeVWUDvZ9W;=Thx#}`Wk6ay}axnyc%LI?}8y`Cg7RO zhRlI<`GMyQezbGec!Yb$0ixh4>f0-*TDmdVE_@9PWb-*arFXI;nYe^1|2nMnh)(L;G!NWZ8{oi4eB5 zN*oDtXx_8EQ%`QlyaS2+23ZDh9dh#A6G4|qa}3@oUkVc6v^Bd;yuk}+_9!xzwRjpk zOiQgkkG3YBsHcI-m0pIs$8ZE0 z^L_Qgh)&Ld#d7}P{YI5~8lOPWBpLIsOsN8>=iJmHrtcZIn|j*^QPeK7ja9gEhfp&g z>Sj?m1_oq|FIyrd&euV7&*(glr^a=KQH*gB-axamq0o@^^rnZd7~L?9f%)4c&=P#R z{TEnnM_NG@}C{&(dC#l z#|dro-sM=$;)FU`(K#%pGbOZ=_dGYOtKZ^=&l>a&Z3Cv<1)96@%YF@e(ik&AE$yF7 zvmk`gsfig3^H`Dd^iajBALA;Qg{eDS1Nd8p(PVs!^c-Y-Qj+ZKS?@#-2Bl)62tZNS`ul~A3B_>EkRwNGzL(iBt+xc zeva>%BkCoC1Fjg^sC4efdR=h7`^m4t>$7v+%9WR!iwEp?%Y!h6K1~~pA40pgvg1il z7!!jN`&*~mqN&uE&ST^yNC*6!6^!y}GR5Lr^SYOlM6wy~KUn|L?cRSwdrDu}cJP1k zYSi5MIEsHz^jq4}zgGS$8}Rd7GXOV~`H#&%tJ$$E&&dQvhZgms zHjie2_}oX@)!SQ@w4LZb1pVK1UCstmANvQY%M1S({Abnq!S+@y|Ml=E3lK}*_aCJH z_#$R%y%|A7BxpsR!t6b?Tx{%Obm1@-fOkCy)<8-Vp+Y2<>0tGeQ3mQ}_uBh@CL~H`xE#4L{#AS{L_U@rV}rABeB3 ze%=2cyQ(%o{eSM1pQHeE-Ou9i-$@GJ4^%v);`5dNXc9;92usVotdsp-_uB#K!+wR>}2ZyAM49)aWa(| zj?JKe#G@b{A(jiEOrE8f*Qifb=FYI^hl5ZOGbEv`p9S)?4}OmkiJqe^!-{b9l}oWf z{LwGsuEknjuW zgCLIXq}lO*bNZ)E<9~B{vU6iGK1V^~A5Pz@`93TBy!J0nPn`F^IenA-i1@!a{jH^G zX6*kbr@#AOoSt#yy>vp0-1HWuo%ObN=L_w-X;zEAh^a8BvS=5qh}nyRY2Wu#b-{8T z?i1#QueH^&A}vwxL=vq%Sr!2F#PpO-h>jr5w4R~I zd|`vT86d`-DZ=XEJH3k*;NdoPRlxC)qlSP*KPg*JI>wj%p}t@;sD}ipflJ853(_KY zR%~J=ML=eA@Lvc%lBUh#F=gx&(9Ef#rLsj6JSQjUv~QrH2e6-IJKJ##skveGlrYmG zw^WG&9bi3;g}=^0AfZFQ2X^3aGFyN!G5S8i>mi4j=@P2UfL!~<1*_x0Zd3~qc>V^_ zm;x2@?t~o3C|ZWg^jXNMFE?_}F6Act}DIrEq(UiQj(tyS^o ze+vFFsmjwrlrCX_ELB*sQZmcKnq7$PzMAiXEsIidnO>t?mr(-XpEBs5DH|{K91!u6 zdWH@0P@_z5=7yu3rY)8p*809&cqhZ3k{}lvea`9;ltm| z|7DOr<4~O^!uQ3MV*OUv%Pajiz-RS2IQ_XjPNv>||M-ZfzkA*8&L36(r-%3_50?9n zhqwm>2+F$b?fi6ZXFY4P_OO8Sxx6~)ILn(!8lXD%#;0^t3$G@ocjWWm?q7@!M0yOf zIh7~~Me%+gQNf9@`I(icuIAZ50x!vZ_$4iQ2w~KG7=9D2Oy8ZhyA(^sjWs})G0L`o zM8A8uolD5(?$YM34H2&swjZ^SnC;`$G4@G6nqTAfs;P92Os%h%{f?&x7m&KxS{Hwt zr4`Xje(0Wpbly|khb@?i8a1oUEX=B-m1wcP9?*qgbv-CR!Tpj61$Jf-pcy7|-#=mF zk~6>NL3((=?2{<3l)r={P!&TcQpVbMed$M+`L2OErb})Ig7qgRs_jtnoxLPhgc;va z6~gp*@Kv5>s0g*D4k;JO=SxFF9c_4E$sO8hK-e#Y?35qO^^4|1DK+aapWlIkS|hEfq}tM{o2PjL(Kv|@^Tl%icWZARZxoHeJFNgub$5T; zdAj_dhcfn`34zB;n%oN2;_d|*JY{Vk%8LSpMoXd`?YgC3v!N0?za>LLQsVz1@uX)_ zrZoF$Hc8mvYgf7Z7AfB}$_m6wtGAqrPE$v-EGK4`bNm~~oyw=sHFU2xM|YL5uQ$UN zg#usi|1zslabemj&XruEyAu(;{4kO`vyHg-iJjJ=9;h(b^4czWNbeK%eAtiMAtYT$ zygfne3}ZK|%|4|oZKDvVAe>>QumIZP=s4|M%!VYa=@W*O+uv$&b6IhEYdq_kdtq$G zLK57GNtc8%Vt;s8{!+pM9W6j61%A93AC2m!wYg~{LuON@GEL`?*XM^M^J=%Q_O-1% zOTCr>2DqlkQlu~dE`iSRCv-f&`E;q%1amrZlIi8NCs5}w$v{mniZf=+n~&fSaJ#|h z2v?DaXCA5iWwtvd`F`&G#vC5ZKIHEyax6(-llizv_}0no;#*Jp*1^Mtz28Y~%TfE< zpqf%S1}mG(3cvfA23-g+rBq~S`~G`w_F>?q1Qkb`&zt_?W-hkLhW(b?S~Q9j0J}H$ z{RL_y2A|1$E;U+JIS#ECmo&Q<^hks2zd=(DB%lZM%#11$Yfh5?EMZ_9BSViY_+)*D6^4PXTD8L?P@3JqRZDHaIa5w%~* zpqh+R{f%`sadZD3fRuz^MG*AmsU$?uJ>@LpP|1=$(HkdvGf{sjR$cT&Cy17x>nNb& zk)RM>bcgHdn=t4}w_|RlQAkg8FQr`S-a&SXzmx$a|r+^7@`_8rO_O$)` zpAwo*RM_QJBNK#RzphFac%^2Vcg?U)gLA|lo#0uzU3q?Oo=t`_ml6Mra>_u9NVh2( zoi7rQk3IRIIoTL)eJjHRR7&C`qo@*>9q$j{OeqFHVh6Q>i6fffvYl8D0a=}HzRy)1 z?^e=f9J2M=B8CEx{SE})jf?Xb7ijwftF}KObBjod@;MT2d25O}GsHy(=GC-|JG447 z5RfYHs(|g>_ezgjvE|a&a&1n4FoGqQ zPLBp&AJZ>w?&Z( zPWb&C&ZOWU0o{$?w-Ul|$xfO#$iPynm}3tur zD-TyOHSwmXqco0p0hsmuq#oUHb-!Jk{P`DfNY@(RUAVatsgdzg>O>tBnICB{)x9Ib8cO!rs3Ea`JKd`}X>5FTWvbyUNW!3`mOh1dZnTG)$v&5Ajrdt_pqW#n8$fg(kGi-z@904z$4w8rW$Cx|Ey7zSnwMF=`^$p zJw4~|4}AGx8+cB&P8Y}m)TVH@ctC4RKsT>EOtw+*Y0C*cL`8%=RL2~(HnUqGlBS)* zpR2p~4v(5JLKpVmo5`6wR=~(cL{U+U0B;pLZ6z8N9X;W;kx0?3Nr*_Mso9f)qUiYb z!B~ZyEH}RyBtB2gf)*i_3CW`cS9)B~(gt%HIZ0loURQ6Cihr97UfGiG@CtiqWfY9g z_jbPO8*0-2%dDPq1OcneT|^MPI|4}uyO7E^-rck?EQc-rp|V?FS_hi1FRg*WDVeS> z2Ul6a;_rf1m!ED z;qSSur&EolU+L^$;89IrL(6QOs$g)C$S+fEA>%-J{a*E4xn{E=vGvk9QPgYX9#s%6 zI=mp;j(S*8a}XV^FCwOz$&qQWtivX$w*bnrX(Bn!J?Z2JR|de^vdR-!TbrI5^f62a zskEm=fpUILp4+y~WnHrOc=|OJ2VjrQaiM)&o2H<){tGF?|JS1SQZ4iqo~KkIsm_Me z_uKRMZ7^lwz9cea?k27xCL6nkEGTIpP$%Z?K2d3P{nGkg+9y5FTGdHW(2Bc6s(kd( zC6W_u8*&gmAmm9G-!O6OR5bR?q2iRdqStsP3`ij3ZKzB%>;=sD-eWuxX<*r)gvK_* z{B2ZfvIp@+4KF{3we2Q+okR5&LA10}SS_{24?d*P2%iCFK!S}2_QW&iQdB8N%$znV zAB#edfZY{fqaKYga3Vg;7Q^I?7Sdu%ZqVy@aE(#h&uVWZ_unEqaHy^3sWOB=Ycq0m z`Idh#?bxeqqy=Zc^JQk~8#^sp#mECBeP2Alkvk0xU5||AT-5QJ7rGi2f@^-dxs77x zqqnUVWb4@~Uwps(T}*3g=t_0DtuG7l1QzfA6n1V$meQno*U|@JOKkpp#>hLwrid)&zlQ*9>jj7qOzbtYc#&J4&eXLZvO`)m4f87jUcu3 zreFr$vLU@jx%W}euiAF?tu5{1nhq!>yrta4K;c*~?$^W8&Xt(Qw9pg_LNB@KgW;sJh}hV%>l<@j79eJlHj*S7AL z-eNJ&=K0#3Dt(Bi_v=fgPvAyaRu5mlOYOyd3a>j}!LrTs-$@^CvDU2z@>u)p<)^Uha}-;o>nqixw`mg@3hTRnW-CAwj^s=dqy zsX#)<()*k?G~V;5Ef;og0vt&S3_L{KR#eDO!e{aNAMy3@aNAY+(}VlRpTM#4 zk3{Gm@*$v1EQwz8gUi&Ez%Fiw9k$)c0UQ5RRypTRpEID280}po_4M`ez%9Da_&IUQ z$atpRBK;JJcuuVybh3_AD~l?ZIjgm4jBE-*Y{y>*1@y$`{PNzi3QOl2b*TrCtf!E+ zpF^W?#*$dIdm$&8cT{w*4qqHHyU(gl8%rNESZb}BX$6eZBhNFSu2>p1fK`SC;~5`P zMuuIfiWqf?+6Rp5@HZS1$8LS8XG^)m^MQ{ZmDD>r4NX%Xbf6+D)R3O%C1k6k`!LnK zTLfv=DPW~(vNQxb+Gs7+_c(mHA~DL8K_T&0l5H(LAA)!d$eM=eu4GtcEVZHx-rhoR z#cJo+UQ}eOSWY&Oipo~n0wLnZg%r|$2<$tWCm(1%V7p4mW>AAFvihx-NJ#nmKg?cScO1QYky$XJPJq=pw! zf@8ju{8mQm33j|2{9>fLfv)6ZousYOX2AKO$$2jtUrie8qH&BMG4Xp~N(LnJ5oRGu z$T1z=c-MmkYy}0SRZUKsbD`m|S?cw2BUO!bs|e{QC)#i_B0Eo|Y4&JjcdY|Ivt~* z3amG17}kfoYnwzyU{x!z$oyPWy2?SBlg*XVOm3g&vOoYrC9yZuoNrROIs;cBzG4PV z1In}#iC85~QJAyKTMNAGvLyHWJvDmX z?z4|kDL*;V+Rpc}ZoyUu{uT$W=}<7%xI<9k9RuxKt_=pQk^6q=!fzhZ;8W#kvk?0N zZ;P}E6ypmSaO=09(gB84b>}pR`1<4k{tT~1p(e7ZsY*CqRDM0kDKp?Ncb0C>!H{Zfej^TH|<-@(H~Z?_l#jMtiy)9fNU{GF$H5u zrvul;$}iVvBhfS)q%pEncS^AS)mzLk$cpN@xxhM%!qjwCBRFI42SvVkS@EY`KVXeu4WIi{k`M>VH4!1=U?=Ypsy)I?*D<9WhB(YzH z*HF~y2im=7d}eEsb5{DBEHAK|G4IiV9>~=6!oy>#$^l}>7uYR)zc}F7GV7(g?+fm% zFXia9Tf1~OdUYPp(uCefdsro6`GQMyj$|;vVc^SIg3rd!9Et}<=1B_+nBr+XP`!zk zFd|7kUWr!nq}V#}6f&h>Zy>Hece7M*NwtJS#q#pfAggHJg@J2!d>J53!p zkAS#CYnz}ecd$q-ro<4g6;M{ILw`41>CH>)uFkQz(FUDA^HNvK5^pU9J{c(py%#;vwMmJfu||p(=tOQ#5Xj(8v>m zm^1__RC{8~pu1dc-b-J_j{DXrU~N`%Dt|1a>Ncn78qe@*#1l7w^Fu#7wi|JR8(#GA zQp}~{86eQRUW-r+o4u@qYX9EPde+0T4VP(3aaHTbDV9$+Cn*5`W9_o<7#SyVxO+l^baX>lp(U?YE?&otC<)>H}hf?IgX#dwn+TWwo|O(;r7+ z{%bmt_>!o<{sIS3$#AyF7S2Y}G4TYnbzp6r8$GqF;fW>Q-qu!Mk~TVLD?YIwjIcwo zPN5%(407WtZHR(=Ue3j zmA$}k&pMC(r}^x^%)D*l%e$JpuPJYM$3__?|*>rUJLZ z$$P=Vj>pKs&)PfS92X8VcbDy5y+URZH>Bz;A2$&vbO_AhPX*Q*5W_eiaP!QZLDqum z=40uEP~r#}F_4Ta9+)%~RCNMfCwK0?3_ZUAD+m<=2@Sw$+}#dCHN@hwzaI~P^Mbb{A%lryp`Z8HU6{E_t3wz>Zatb}!O^HN&b1LE5 zhIWz#vku++dk5Qcd$jGl_ILL<5V6CX%lw16F3fZo&T~t*8Y83nt-9{tXUHUzFn~1S zmc%$t&rzlE#vcXo5vO&Lv}bkqmY=GdU)J9WF1_hMzWjQsql9wMO6msT0O5$1yFQ;9 zRa7;}w2P=(jK{__zIa=8b)XbhRLlDi)Q>M`Xu}r9KJKDcKX82fbA zQNVOy^xb^lr>~y>L{aM{lji>=6)ceR(#AZ+Hi@2=K_q`&NkS=88549zEW^`J+1p&fO(&IP5GO=*{s{2!RpQ*<32ICbDPgWZ32Y4U$rrFwlsYeI~z4> z(f+!D8Rvy?+^^eiT(w2chGb$iS2uvtnwO}JQx7-FMZ@O77+7j9;V`rZZ0%qSw6APN zmRdcx4>&5&i>QYJ=*lEZZrz2FodThGt2carEPLL?J;+w zTeSrJNrnm{vMZ$2xgv{JievpMET)g^e;p_^s_}VJsL+A)ZoT=V(6QJVh(hTWOcA+8 z&7w!(V0K4WilI&oiPt}iq;MFE(@$yBOw@+ z4vF2NZ%JTWQA#?u5rTXhE=*v-sF!r*i*X`uVk{ROkhZVSe>ZT2sy_P1x{&AoIh??vw$! zJdMU8T)-pCFxt-MJ?w}XI-`CwgH#b71jxCpe{71m!H6^j@$q#yfLD@#{?@(EM5>?K znqO#1bbVHQa&Ra`^UAM?rr+kFNj`w+FId-YFF5Yl5b&i_UN&6Qg1-xw+)d*@cYl6^ z6LI63wYg7FBtjOVT2KeB!kbZFYV_d*@CJ;zmDKddzb<{%^mm#3dag@5IhZ>rEF_GP zq7{`)fKDi}A0KO^7R}s~9=)8Wv}BtCYFWr#%=$hJJ*a$We6ZC`m<*VM3RsAW&zfCF zdleR0V_$x6cVWA?9`8fE(oB3!7&gGBp`jX^dx*3Yr>*M;JH=@YCL`eJWbw~LOkmbP zQOwvPcmn=$`2tr%tEgYli|SF(9aDH3_5gK^G=%ujzGSHyNB3~3Be_h1jF%N8Qyp3K zGcy%-l}SCxB6g&1a5^LuaA&EmM0cRck*lt~77l^lY}XeMG>@sPQ(}%wF7ZfGL-2+Y znW$>oTLo41{H`*Fog;q8NKv8~!CLxE>;^YXG~#@_n=+)rp*vz?h~s;!Z`nAEgv zxd2G*yU!+j;#}oO)vGzW0Lnw`v=o&prat@jjiCrygTmWo1clm_ z@=N8XKu~Bj0dyYW`sgA5JBMyeTjzDSL9{q3Tpgd_Tvsb4^@(y5+rq1-E__c%QiHg5 zbfc8n7KTPyBX72L0;*SOQMm>}ItSkZJEO^;tg(9khCle2Tz-Kvjlq?eJcUx*(9|Zm zq}sLvj$Gmto@)a8uGkoIz}dz$vF?fBwJ_x-dFF(TnULScokg=^zV-YU%K?1c?E_)8 zo(c?%s@@o?SEIu1eRz4GyOe?;z|{2>M{A@m4GkRNgU_R+M+4QB*9omMIb8&vrm3y7 zPw-<0H?-ausMINU~N+T{+Q%svwU`=DlC^=KHhr;Gs!nqw8Jk3GM7I*JuPm zNqff}DVfG@%x~{?1`}IY>@I}vf5Xs*x4#O-gc5T&zM5{0 zX^V(q`Q()x`bE5b1yO_NRm&^RU8{8;Q5FRk86UijQ0QV%DUh(+D0p}@0Tu(=HmR1P zs*Ct?H+hiD{8cf-HZ*l40k_%f#sPM(ZeNe~E;{TVljV1*gGo{|unQUUAgB)8E~h^3 z_dJ@45zOyXC)x1}h3J*D$B1rfdT*>`q0P!9sVYcA88{T6e65s{LgNpa49NnZ{zVKKZh%IU)2vHocA z4s9x!@y6)XHq)pac;RB<<<0cCA3YS*#j@S|;*esfe3h*PYEmVkb!iOpAcEh9lV{Zz z{+qQVRC0T21K>ot7#M3wic8$>o6=@;A^^nK!mfltO*(C$nn4%FCSWkMX=IbD9=!z; z()#>6h~YMRJBUrCyU|?Q1#~mS91KX+RlS!ZkS|*fAerZOFJM2!nNq7m_iuyHWdY{4>mN{eUWtBOHg8c8$l6avFu2T9&=AfY3=#R+2WRv`T@PEpy!A6prm6 z*kHHX#q=1LI$|z5&K1wOiaUOwR*@1K?Xl!1#X42UjmYog*}0;sLn~Jc@q7IE@+O7=&29IGi{JT?@U$4sbIWwAjj|-W{M%U}o{(V0Yzm*=(W3$CKvb6T=u1QhCz*WU# z_PS~_JGry5!QI95s88>^e|EwjES(R}L=NNw7u5+aK87-$(7X2m78Z;xP3h5TT$v$Z zu8?`pv48j@;+5dnKB0$7Jaxc+G9P$d0ZHHCIpk)g}sTygkZoDe{#*h>`lheZht(+cgr!#e- zbtl}rGIFc9pGh{lpFz+(!Uzu)?c;%mr=L8GQ2N#^ka`0RxtA0^Is7GX#0jl0{ zLx($~v#~w*>W+QdeN;zl!!=~1{C3T0x4Nr|g{HcEo5IVA1XZsM4=GJ4voSp$@yqv< zqq@P<#XslEZy*~zHItf8hwf1pomUI=gDIsp8z-`YNTlIQe@6i1?)fvCTR6==)CQ{#HS{-gtuRb+XW( za%o`1!-mI-S^14&v2G{P6eV|4$Di920@LVMQ!$+nvx(Y*OYs`eg&Af1hsPoOQ@{b7 z&my)RKJd$6ziu2I7-i=)hgGT9+Y^iARaKpm!kP!A;!z~^{Epsvd^QhMwq2JF=d%EAQXiJa$3p zit8>Q{mc9P>8}9G&u|Y3WI>1`cZ7nwUbu(Alv(hG3PyB9!$p~eD?z`44qZ;$%SdkV z+N!ykng3+01bJ8}iJ^;E_Tm~_*F;1c9%BNPx4;MK*DUFy#yH2232Y*ma8BxkWs!>X zQZ>OXbOdAvR_o_{`@sL)i zI%~o*ZK!oizFA_~!q|Se*v$DWbu&Ce2Hk*{sj8G|ban?t)3<=Dq)sAIop>A?cNZRJ z$y=WqeI`u5d2*QZH|4RGPz;Q@u9%BpqWz!?VEqINXy;!-im2H$FEV(#y`}dgr8BM! zrKCkoTX&^wi2S4H3LS>!Er+`VKUyTcS}F=rSj$N@CzvYkOH4%cze7H1SZ3StXldzM z0k$y9%xrQOCyuwC!pjh-D^RG1rS5Y*`9IHA=DyfHJ^AsXd){7UJ^7>eV(EX%FTR() zPGsNTe>U`ZKVLl_oy~fEui%SxclCdNc03bve{#l;eSNWiGp#m*C)3#E*o5)eX();; z#`>2a#PbdP&|9Ww4CK|EBg6aODQ{D`>Nlm}G)_Yf6e1M&q#!a}~M=R)$v2`A2?JwZOSkg)b& z+@uofng@1`U~E_cszy5hCwUTv?Z_!Df|g4J$%9_#Yj3k8i53dV3(GR{Tb1Cm`}&5h53r^_o6T6JUSXzA_%6O^;_I5_|JwfbDx?#q z=)>59-Ho@0C%WZ*IkU3O35STn^VPa9pvW#A`;QFrOf$E zD{@5kutW@BE?LgORK9NyZgiZ)hVAA2zKEqcrd>H<2+7>_9^4@*TzQbd3LTjxPsF;3m=LbXjx6Rkh1R4<|AZzGiL#c za4Vy@3GwC7CFhZW&o&p?6;ulCAOOzrs)9AdS`POyIYy$i0Do%yto^=XCr(CJo}Wj_ zO%unu)dzTWNQu`YZiNAKhyRlxu!K%v5<)(FU9vf^RJne2__gB(_jk!={QedG=bSFt ztC#rqNYVML4}qRQkPffR=5(F`V=A#w10THCeE{ncv_1Cdjb6b#dm0IJYN z3mBTY(TE5a70>a@iY`rB;fiKKOG1h%Mr`8?e*`{o!(yg`YHK^Uyk+GrXLpANba-^f z)na4{2_C|z4*wbciRz-)7bh1l$#I^WV4b>Rv%0WlUkF|C_pGeA6bIyni~NApJpU$U zGXL#0)J;VzVOMQNptaOf558&@k5Dt~=0V4<3aT`J8vHEGm9$hwuF7l@lCQaJbagFf z`hjnq5d`bGDy6>*D|efT_~nud+yYr$YVLF09dGm?K-BdMZl9sPRm$&SJ9#vuj7@73 zJK4AsiZxi}jj6ev=x;A~G7>q`olcaSGhPB}={jch42O~gQ+-C{^z9_@O(_0rM2>^M zxmYnVS@2mX^WsEiH>?~0nHt!ZLgp-5et`6WMWj|B5aDPWEKBf7ixA-Bt8*qkQ;W=! z13G|MlQ*p3_pkj;*|;h~dKemP=-R>+`?$iOGWLu^H-~)?zI%D`@oG`Rk+<2q{(%mo zs}0#$^x}LE)rBWmEhS(N-&pQf(nO;I96~iFmuR>|yl@_~SOUE5pULM}ekVR3lhJ5o zj$!-=nN>+LlUkRJP?R;m#@{jl>Lg|Z~R(+(Rg=sfHb#r*O3Y{`H^rpx7%Ew24+#kw| zIqvk8SNf3Anj6IBmU8L$c)BK~tVKQ?p;WJow?Cu8;0YZ$uTP`xJRXzNd%9c|>?I@) z3{X`je!y5BpC0}3K+gg|+&?|~qn(89X4O>c2jBr`b}nlnEEix*0eFn|_&Dk!C9asv z*of$J=!JE*=KH`!P$f()7%y=pDw7)a$JVR_W*J1k&P zz|svxhHZ+Zc$C$HL-0OrM%T4Iq2%tj^OW?;CcrjR4WFw}}jEEUq621%~ zJ#8eIUWXwKOt$nTs(58lW$etc`&G#RZoL{bd)db#Ou%jQ0BlxV!Bsz7NUe!bTpoDq zEtf?!@DLxsDJ;oSmd-ltb?phZ1 zDRe!^gDyT+0#TH`nJi0It)#$`bFdUCwQsjAR1T|f+Hh)W!Q9`bbUkU6uZJS&i3QrX zuJ^k|8T(|K1j>&ml(OH3A{4zJE@!_5$!!YXlLr;QC)*alC%;`0eDc6T_~fA_p&wEZ zpZs=3@kv@?{B38nWP`==w2FmapFDh#wk?!T(u?J9Iq;q!#csj;Eh%o6itj6$ zza`PlAj*xx`P;H(Z&mwl@%)eICY0LmEug<8(am!EeMR)QB-&SUzps$~mSp?N?stpn zZ%J~?();8g<@d?MxAOL7_{r9#_{mn~_{sJq`N{TW`N;!D4hr8Jh!FWb>3Sw+WvA=y zbiJLfx6}24gWKtP{bSqddOKZjr|Siu{}*+=tzLi@#;uK>KcJ1cTLr*n&8KeZwz<=< zpnMHxR0H^m1=$~u9v>a0aOgG#=E+t?=F>T9ASlNl|FDa~#WO9zAWo$Ctxc>`okO%04fQe4cX_9aI?V~qjq((p=n`7L28k+vQkp!q-3;`!eqvftF1VC;8j{nUCSCGspd5;sZfkH zmy}QXE{vQn?&!Kg1*EEHGoEpMH8qY<*>Zz=J7Y*5o?l#_zWlV^HL-C`qAslN@!JV@ z_5is4R`NW}zpWo|(F3~AEiY9~i;=CG-j*2Km>WV8BLks?`A{e|NF|qA4h$vmyBH}g zGMJq$vd6~rG0AHSorU2?`v+d${Qz0Ltz`-SXj!JpHAJP{GNI?9SR+(`lUB1*4pHO^ zV+{skxYDov-LpAC@9SK4Ef8ABlB6`%l;iz+!LTt1|BI_w;Yj-=tEyd_QC$=+>9eQ9 z>9)6)%NxTeTL&CQ4=nYVl87FkpO~C?axGV~kn^>_J{Y;~P~6h){*+Yp)YuR-vz>Pq zedmdeJv-}U>a(*>ran9CWa!yhCwJD#opo|&oecM4XPx{VS|@j&=$)+N*Covs(|#ZK4z9qM{py&#oz+C+{v4b}-h(}AugVqgUuK>pr#h&|VxpF|;h zRHXjZZ-m+N@lZCmwB%Hz%*CVk*wiLGuS%KM2!U_vy6IgYAQ3NG)K8Y=n$KBDCoHQ= z=2h+N6cy}up2Xm#BJUjqUK*LTfNYAe8DtGlSkH8B;uTJqn@ZuK+qv(i3=niGmLC|; zeXnZ*p$^@zY=y_>*KoA@O$-8A)1q&$U}`uwDc1(xqhdYkT4b)4svek$ch}$BNdRby zl4VS&Vol@}wv2@zn@NDtuzvTR9>2T(-t*D}hKrwA?%_q5Jat(%V8n*s`h=7~OmGLF z){iR{--xkI7~Fszgznbf3(QqhtAO1m~@`gPb;kh@;%KT8VcN`rZ9ldz=4E{YjI_muU_~`M`lRrFu_V~%aK6&x%=;@O`96fpV?D?}l zkfZ;J38*VY%Rd}_^t-x)`#X6Wkkglht~k3_OkmFa&6j|@di(e@+&QlS)XrAhJYf(? z!ln3Z$rR10qOk9Tkjk&al({OQqd61fn|jKoH7{~j0&)B5+oSQ*@zG}nO_sD7ZM?~f zpK1L~zhPd=di9d@v_M*|&2QuwkcE#6Ua7YmUwy|b)shnJ?w};%0_qmDztplLlUlC5 zF6v6b8F6dH$Y)xV`gOwK9{E}p_0rDPs1qK#U=Z_$8SNHd#=>1uk!#^MEgX=}e^*if zd_EZ)V5>&7{rJt^|2Nh$_s@TRbZl{r9_{};uA1qv)9=3jEFjpE`pGLqdaCqXk!(T5 zyfL$+cJ;E9^Abq}I_tIg*zV?RUedhL(NjBlVtyCsq5V3sdk~jn>$|xAJ*t{zF=rkr zXr;`=Zr$e=4`@QyB^4F4yXFof5eG2gP4q4HKBo#lzy`OEaZ_Xqwxsr8mMbQXFVEgT zowPpg-pss>*R6#U(2mUL+gMDE7DVme-i2gViww7&zK?m}Fa2h6Pb#()nf5(O4-Q)q ztm}xqHXGhxb}T7g2)H-8J~VGc?MHQJOeT7yWo5%Z0qC-XxsY?ge{r-c1O7|k%-*=g z=n2qcHkvZjBc^LoGJpfGg-6d?n0uhO=Umy-Ad|~wEx1}Af?(&@Plo%;5uM?>6D9YJhIRzS;c6Zz`da+`^^;7wPjlWT`? z3yaa6eFR8v_^(+4Jz-n`{0;;^A|MwdOym&ih}*Q_n`ODHdJ08FT{USX0Zh$Y!Z5y3 zU+eU}Wyy-ywCb<<`6(Ab&vZ4?6PvaK{^{Orym585r*dGu{JlO|v8=Ui3rsaI9camycn`wPHSaDFzX-l|4ZBhgx3bqAbOAM#doF`m2Ly}U*=qmC z-r;7h(jAy3cLwzN0K9V*?${@t!?AgSR^#C8yTP|>*|{OQ;+6eI9oa^$Z^qoye8>;F zdGsY0-UKvAMVG5hfrB`&aEhA}EkSFjg`qd6b)cQKOK6cXQalJ^JZOwxvZ~UT>XboV zxO!Fxgp!;o$_tiT5(YRQR8gnZhKDJIV)sEW;b6ZpMDc zVQyr3R8em|NM&qo0PKBPa~rp^a9%(DiZ0q!wo~DVq$DaItMZ^oO2Rs^#FBiId!Ah2 zOq0YB2ABXC$~?0F`z^^SV|lm6hSd)WW3+dJ$Jj=zKM^ODh=Ql*LfuKVP+ z>Ye)!NrZEuiKc?9VGAH6nlLd7LZUUpfQkc7VpItUaR{2uP?C;FP!cU#@WCR33>i#?gfqJiTc*h&lvZYIQN!Eq zwf^pb`(KjE{J$V9MfLmwUJ5bBt1E>u+lSbr|i6_u>gkCo|>IdDRd(a#Bf(aAh?G61m4xxY40&tT?^n3_yNq9I%+0L^i zPU)v1v|}ozkQjOH?zCG*VBerzpd79YKr2M4E&XPkT|dmY+doX1|4YQN;Fm@~w*d4q znUfvsnt}W|K2j}{zfV2s#0jV@2hNHvpx>N_xhmT$s7`(&>20W zGY(q-5@%Ftxg0_y!dsL96)guCYPJLRP&3nOGAk5ZYsSQcSYWkO8sl@El9cJ|yeYSc zSgJJ2v(fqW;;12SVDs{E0f~R5RAK~^CHzTwB<_@*7}cT)iCrbzrj|6+r_(9rR4?Vg0`XKtI;V0e>j`cNy(s5MCSEhe}v&rpit*vRrwF?On|o^h8TI&L{t@f zAj@DzVVUaN>V5_-X?&ATjSOuc*v=oUG`a?h8|u!NFT)L$ydGQW%=65DGyhv-!2Q2t z)XvlP1Y7vO*IlvyPma2K`~O9f<$pQ_!j~Wl*056_n5hRLYq{3y18NKs4V*IYa>1av zqk1k<4R1riL!#lW+fz2+eYd8}Vt@C}BL4EF>SO4&ZYht3;Pxu57&VEAwic-K8Q497 z#pAQqcrNrZ!695Fa+T0Ltra3RJv~quMMa{EGntl2f({}l98S+UA zV4M6u9Mt{4Cxh-_FaKX6ee3ey34FH=eNU3QK3G)&7QPdb%?cow`I%1wKDRc>QO5*X z?YbDPmcnPCJVLJF=*yQ@r_*UYP>cC4d{s5(Np8?%Mag3nnS*Z7WO>13Rhg%2tuCvV z@0HmuX^s4s>L5&&7I8 zYOSF#uEZ2e?D9 zT8KmuPz}UX<9G+7u|fU=L@owot*1(02MCXRgaszEq*XGJjMelO<3ukv^>Xko>sh=U zjR)suy_eQ~9$sog`yyjE-_=c6Go*yE(Gw=U!oek6^~nf~FenX68`_tGV|$ei?esV_ zzZ)4bEEu?izcd&gu1evCzCgQDwY|D<)^&D;wr!A;SyG;sN?$9cVD30|hFw6#L2ez6 zO0+lFh<=r~RD$7fMLvH9E&fSjR+yrF+xV&()U5w)>?gEF_cI&^*n0lwcu?E_4UYT$ zz5aiRR9=pujDkdpe_^QIiU@?96)WTW>1v!YXaw3D?_VP|^FK{U z{A}#MmH!X>_4wc5@bGZY|1Xgq!2hH1>3hegJMew|U_y!EixUh%wU%=TG@V^&hF-0? zmk|$5&HP_;G#zxio!kx8sYiXcN{DUzf80B%?f;Jk`}p6>q(;x=Wj5DM&dHh&5}M1*Div+ov)2VKQ54`6&_5iYou%nP+=#KWa^C-Bj&Bz3^gLlmoK0iq^ z{p$fYoC%jn25%{k`A*-{SHIcx_`j7Q-f}hs8n6uJ#taS+GMeCvc}ao#FZ~Wg0Ok z9BJiffQy?{j}g~lD`#!K!oizwB<;xm{f--%m?YU@*xdsITll|seAKJ!|C8gr|NlkO zla*s5OBeClRj#ftpWS%-6?_m7N+cTnH6h3`zyzm4=K1+~MFm76nEBNh0f{1uhj2iy zd=9{x4vms zfYoA3vN-2rmz$#aCFrq#$tg$3YzttXt*P49V&~(pzuU{ z3{=BZirDo>NI<4+<{fpNlGt%G5EZoGClV(NJI>kM;m!xzQQkrr!e?6zpuA3+M#ook z>*rUC%{x?YQ2WC2VtNII#YgP!q%#$=qvyt0)Om%%JapdxQZO6>e$ps8VI6~SLKONM z+5Xj|M_q#LK=1$m7##P4Ubh=`5BfirO8VWypd0jhho;~t(-+^qw%A$zCn8c9rjqJq zA{Y&qyYBQ??B)MUBp;K)$BKU=3#rNk2^ZQ43L`WzatFvcTqVeF z3gi3Hh#4+yh|S1JZ0VNBd%G?rpY8QLxL5Z-+MCU=1)k}fF28Ad~x5@tn= z1sZ1s7b+y#MX;zbAJbGh=+o@7%>=jC4hF%#h`G;%Y2EWn-CQGM6 zU7!(26jSb0FPWmzKB>aMw_d|>#t4l~Q>GKy9lPunlkJ%B*U~x=Q$B>QouHU}8p7cC z`0&_Q8;#G3A+&I#^U|26{8asya`)cMr_lg!-ls}mo03bxuZ6H7{wqW@0^m#{gIDf=Q**n22RK0>rzd3ZR+IoI31b1`f5Yw3?+GqreqEG~H zX3iS$Ux}fs^liHICU50W^t(`F0~%xRgFPEgQZ0;WL;0+Lyvr~(c5&_6Ti0`MZ5Xkn znldMp8--Vtt<8LaS#@8g^vX~=+vEZt*cs0>DO;{SMw7NG>>Dq2>Ahq!*K{L6fvu6JM&kD&Eg3IGqBB-GAxd@|4A_P23j7@eGMWq{^kdM+aJ49cgHC@s@ar?Po2cQgvJ1^EiD z)(vkgB062d&Doh+JEFP6ZI|w3l|$z-3=5Cp*XMT^0-6fO#GP3wW~T#Gf#7Ue<+c!| zrc)ZaL+D8=6QP{F?QrB3xsWkoY-tv%GOLsn`yhL-a?Kf(pSo~2r{NqX%fu=KGsF)6 zZ{iLYC=IeI85)&VKUil_-ab{PW#6!+rPRK1AtZ}6>nks0%Umd3W*ovJ$lQ|NTL~l# zQN7I6uQ4wTMUIL_TTvAv(~OKlNKnR9na#1vpQy^;ivr52wsAv3Im-1?Vpog9ZV_fl zgJt1M63oopO?K06#){ z1%=xAbQ=kp-DeLC18hD2 z**~uN|Brh|`}3bKl2+XMKf5_@?Hm}`9tKe9#Arb^Y;_&+R&^2OOj+~{;x(t9wY*`@qh2A9{)QY4EFawUnH$LkzHZWUCz*K zVAQ|6i~F=8?acp=3;o-)h5wHR$Nl>KkHKIc|9_EG=6{kTstEO;=TWw&3V`Y*t=k_} zha^dZnc&aONlX|GiE`(W@|#~4*lxXlFJW6xP_~*qV5tiLRf;xYacM2hP&zVf(TE6d zDimAr%E3XQhQKIKKlyT9eNaE!-ek|#=daf1W#yOd-9z_{VA&)3+u>A2-d}DQil$?F z0M3_5m3u5@g7#pb-8Po$o4ule$WNA+&kSaf54aQjjkbG3w#bl2T)ESnxsCS=l}i6f z_53%7-&f3?ag~AGJhl0w@Avoll3Dw*agbdHEJ2P_#xn9o(@UYp5*2b?suzklCOjIJ zvY-@yE@eAk>3e(Fq+Z?iV?ktx(Mk5pC{Rh+NxjP4WGOaS-LD25EQmZ{baJqQ1^J@6 z-9Jx1oc;Fk^7Q@1&G_`}qK4bvu^MIvRqC+gt8)w41oVp(@vv3^Fr~;MZ{0VRxqf6^ z9hi0+o4y)fT%Ufpx?bD&5ly#~k12a`fTj=>6%h7a#w)xV{-(T{dIC zzu)|>b7esxU#yNt7UOwOlEx8n^c6BDGu2fmbJDJW2pb(Gtg=o@r;4jxU%TWo7k`ze zq;ZKo%Prh8RSoxuvXqZkl`#KC!Fv(m5V}X*ZfkWI*J90@^;8!%I_?*a9@_lL$w@== zTd-43_1Oj?=RAWQQ;ibVI5xSo%U@5-T-;8`*~iFN%QTtQS8B7II6wVxdh_Ax`r_k< ze~#C1Trt_(g=9`bDWAyMigc_vMYGIKN8Qq-gH zd8O*tzDU$;|1Sumky}Y_J%%#+YVSWD9v;{4|8)C@`~Clmq*q=p&osPc$l)y$;x)`qtE@7+7-+WXP3><=fro{E%5`I~h`fqgN}6}H#CICJpxuj9&-P;GbF z;1OuXi1M+}OoX@D<1~-N;m2uI1oj?@X!Z52M`(8>^iLjw30|MckNS$5m_f_5fHL6@;VD-+{?v+0NZe6=i Y`?OE{^ev_T2><~9|8w]:port` + or `:` for IPv4. If optional port number is not set, + and this peer IP and ASNumber belongs to a calico/node with ListenPort + set in BGPConfiguration, then we use that port to peer. + type: string + peerSelector: + description: Selector for the remote nodes to peer with. When this + is set, the PeerIP and ASNumber fields must be empty. For each + peering between the local node and selected remote nodes, we configure + an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, + and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The + remote AS number comes from the remote node's NodeBGPSpec.ASNumber, + or the global default if that is not set. + type: string + sourceAddress: + description: Specifies whether and how to configure a source address + for the peerings generated by this BGPPeer resource. Default value + "UseNodeIP" means to configure the node IP as the source address. "None" + means not to configure a source address. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml new file mode 100755 index 0000000..4f03208 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml @@ -0,0 +1,59 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BlockAffinity + listKind: BlockAffinityList + plural: blockaffinities + singular: blockaffinity + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BlockAffinitySpec contains the specification for a BlockAffinity + resource. + properties: + cidr: + type: string + deleted: + description: Deleted indicates that this block affinity is being deleted. + This field is a string for compatibility with older releases that + mistakenly treat this field as a string. + type: string + node: + type: string + state: + type: string + required: + - cidr + - deleted + - node + - state + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml new file mode 100755 index 0000000..c0c4149 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml @@ -0,0 +1,62 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: ClusterInformation + listKind: ClusterInformationList + plural: clusterinformations + singular: clusterinformation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ClusterInformation contains the cluster specific information. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterInformationSpec contains the values of describing + the cluster. + properties: + calicoVersion: + description: CalicoVersion is the version of Calico that the cluster + is running + type: string + clusterGUID: + description: ClusterGUID is the GUID of the cluster + type: string + clusterType: + description: ClusterType describes the type of the cluster + type: string + datastoreReady: + description: DatastoreReady is used during significant datastore migrations + to signal to components such as Felix that it should wait before + accessing the datastore. + type: boolean + variant: + description: Variant declares which variant of Calico should be active. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml new file mode 100755 index 0000000..89cf320 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml @@ -0,0 +1,562 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: FelixConfiguration + listKind: FelixConfigurationList + plural: felixconfigurations + singular: felixconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Felix Configuration contains the configuration for Felix. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FelixConfigurationSpec contains the values of the Felix configuration. + properties: + allowIPIPPacketsFromWorkloads: + description: 'AllowIPIPPacketsFromWorkloads controls whether Felix + will add a rule to drop IPIP encapsulated traffic from workloads + [Default: false]' + type: boolean + allowVXLANPacketsFromWorkloads: + description: 'AllowVXLANPacketsFromWorkloads controls whether Felix + will add a rule to drop VXLAN encapsulated traffic from workloads + [Default: false]' + type: boolean + awsSrcDstCheck: + description: 'Set source-destination-check on AWS EC2 instances. Accepted + value must be one of "DoNothing", "Enabled" or "Disabled". [Default: + DoNothing]' + enum: + - DoNothing + - Enable + - Disable + type: string + bpfConnectTimeLoadBalancingEnabled: + description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, + controls whether Felix installs the connection-time load balancer. The + connect-time load balancer is required for the host to be able to + reach Kubernetes services and it improves the performance of pod-to-service + connections. The only reason to disable it is for debugging purposes. [Default: + true]' + type: boolean + bpfDataIfacePattern: + description: BPFDataIfacePattern is a regular expression that controls + which interfaces Felix should attach BPF programs to in order to + catch traffic to/from the network. This needs to match the interfaces + that Calico workload traffic flows over as well as any interfaces + that handle incoming traffic to nodeports and services from outside + the cluster. It should not match the workload interfaces (usually + named cali...). + type: string + bpfDisableUnprivileged: + description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled + sysctl to disable unprivileged use of BPF. This ensures that unprivileged + users cannot access Calico''s BPF maps and cannot insert their own + BPF programs to interfere with Calico''s. [Default: true]' + type: boolean + bpfEnabled: + description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. + [Default: false]' + type: boolean + bpfExternalServiceMode: + description: 'BPFExternalServiceMode in BPF mode, controls how connections + from outside the cluster to services (node ports and cluster IPs) + are forwarded to remote workloads. If set to "Tunnel" then both + request and response traffic is tunneled to the remote node. If + set to "DSR", the request traffic is tunneled but the response traffic + is sent directly from the remote node. In "DSR" mode, the remote + node appears to use the IP of the ingress node; this requires a + permissive L2 network. [Default: Tunnel]' + type: string + bpfExtToServiceConnmark: + description: 'BPFExtToServiceConnmark in BPF mode, controls a + 32bit mark that is set on connections from an external client to + a local service. This mark allows us to control how packets of + that connection are routed within the host and how is routing + intepreted by RPF check. [Default: 0]' + type: integer + + bpfKubeProxyEndpointSlicesEnabled: + description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls + whether Felix's embedded kube-proxy accepts EndpointSlices or not. + type: boolean + bpfKubeProxyIptablesCleanupEnabled: + description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF + mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s + iptables chains. Should only be enabled if kube-proxy is not running. [Default: + true]' + type: boolean + bpfKubeProxyMinSyncPeriod: + description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the + minimum time between updates to the dataplane for Felix''s embedded + kube-proxy. Lower values give reduced set-up latency. Higher values + reduce Felix CPU usage by batching up more work. [Default: 1s]' + type: string + bpfLogLevel: + description: 'BPFLogLevel controls the log level of the BPF programs + when in BPF dataplane mode. One of "Off", "Info", or "Debug". The + logs are emitted to the BPF trace pipe, accessible with the command + `tc exec bpf debug`. [Default: Off].' + type: string + chainInsertMode: + description: 'ChainInsertMode controls whether Felix hooks the kernel''s + top-level iptables chains by inserting a rule at the top of the + chain or by appending a rule at the bottom. insert is the safe default + since it prevents Calico''s rules from being bypassed. If you switch + to append mode, be sure that the other rules in the chains signal + acceptance by falling through to the Calico rules, otherwise the + Calico policy will be bypassed. [Default: insert]' + type: string + dataplaneDriver: + type: string + debugDisableLogDropping: + type: boolean + debugMemoryProfilePath: + type: string + debugSimulateCalcGraphHangAfter: + type: string + debugSimulateDataplaneHangAfter: + type: string + defaultEndpointToHostAction: + description: 'DefaultEndpointToHostAction controls what happens to + traffic that goes from a workload endpoint to the host itself (after + the traffic hits the endpoint egress policy). By default Calico + blocks traffic from workload endpoints to the host itself with an + iptables "DROP" action. If you want to allow some or all traffic + from endpoint to host, set this parameter to RETURN or ACCEPT. Use + RETURN if you have your own rules in the iptables "INPUT" chain; + Calico will insert its rules at the top of that chain, then "RETURN" + packets to the "INPUT" chain once it has completed processing workload + endpoint egress policy. Use ACCEPT to unconditionally accept packets + from workloads after processing workload endpoint egress policy. + [Default: Drop]' + type: string + deviceRouteProtocol: + description: This defines the route protocol added to programmed device + routes, by default this will be RTPROT_BOOT when left blank. + type: integer + deviceRouteSourceAddress: + description: This is the source address to use on programmed device + routes. By default the source address is left blank, leaving the + kernel to choose the source address used. + type: string + disableConntrackInvalidCheck: + type: boolean + endpointReportingDelay: + type: string + endpointReportingEnabled: + type: boolean + externalNodesList: + description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes + which may source tunnel traffic and have the tunneled traffic be + accepted at calico nodes. + items: + type: string + type: array + failsafeInboundHostPorts: + description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow incoming traffic to host endpoints + on irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all inbound host ports, use the value + none. The default value allows ssh access and DHCP. [Default: tcp:22, + udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + failsafeOutboundHostPorts: + description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow outgoing traffic from host endpoints + to irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all outbound host ports, use the value + none. The default value opens etcd''s standard ports to ensure that + Felix does not get cut off from etcd as well as allowing DHCP and + DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, + tcp:6667, udp:53, udp:67]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + featureDetectOverride: + description: FeatureDetectOverride is used to override the feature + detection. Values are specified in a comma separated list with no + spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". + "true" or "false" will force the feature, empty or omitted values + are auto-detected. + type: string + genericXDPEnabled: + description: 'GenericXDPEnabled enables Generic XDP so network cards + that don''t support XDP offload or driver modes can use XDP. This + is not recommended since it doesn''t provide better performance + than iptables. [Default: false]' + type: boolean + healthEnabled: + type: boolean + healthHost: + type: string + healthPort: + type: integer + interfaceExclude: + description: 'InterfaceExclude is a comma-separated list of interfaces + that Felix should exclude when monitoring for host endpoints. The + default value ensures that Felix ignores Kubernetes'' IPVS dummy + interface, which is used internally by kube-proxy. If you want to + exclude multiple interface names using a single value, the list + supports regular expressions. For regular expressions you must wrap + the value with ''/''. For example having values ''/^kube/,veth1'' + will exclude all interfaces that begin with ''kube'' and also the + interface ''veth1''. [Default: kube-ipvs0]' + type: string + interfacePrefix: + description: 'InterfacePrefix is the interface name prefix that identifies + workload endpoints and so distinguishes them from host endpoint + interfaces. Note: in environments other than bare metal, the orchestrators + configure this appropriately. For example our Kubernetes and Docker + integrations set the ''cali'' value, and our OpenStack integration + sets the ''tap'' value. [Default: cali]' + type: string + interfaceRefreshInterval: + description: InterfaceRefreshInterval is the period at which Felix + rescans local interfaces to verify their state. The rescan can be + disabled by setting the interval to 0. + type: string + ipipEnabled: + type: boolean + ipipMTU: + description: 'IPIPMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + ipsetsRefreshInterval: + description: 'IpsetsRefreshInterval is the period at which Felix re-checks + all iptables state to ensure that no other process has accidentally + broken Calico''s rules. Set to 0 to disable iptables refresh. [Default: + 90s]' + type: string + iptablesBackend: + description: IptablesBackend specifies which backend of iptables will + be used. The default is legacy. + type: string + iptablesFilterAllowAction: + type: string + iptablesLockFilePath: + description: 'IptablesLockFilePath is the location of the iptables + lock file. You may need to change this if the lock file is not in + its standard location (for example if you have mapped it into Felix''s + container at a different path). [Default: /run/xtables.lock]' + type: string + iptablesLockProbeInterval: + description: 'IptablesLockProbeInterval is the time that Felix will + wait between attempts to acquire the iptables lock if it is not + available. Lower values make Felix more responsive when the lock + is contended, but use more CPU. [Default: 50ms]' + type: string + iptablesLockTimeout: + description: 'IptablesLockTimeout is the time that Felix will wait + for the iptables lock, or 0, to disable. To use this feature, Felix + must share the iptables lock file with all other processes that + also take the lock. When running Felix inside a container, this + requires the /run directory of the host to be mounted into the calico/node + or calico/felix container. [Default: 0s disabled]' + type: string + iptablesMangleAllowAction: + type: string + iptablesMarkMask: + description: 'IptablesMarkMask is the mask that Felix selects its + IPTables Mark bits from. Should be a 32 bit hexadecimal number with + at least 8 bits set, none of which clash with any other mark bits + in use on the system. [Default: 0xff000000]' + format: int32 + type: integer + iptablesNATOutgoingInterfaceFilter: + type: string + iptablesPostWriteCheckInterval: + description: 'IptablesPostWriteCheckInterval is the period after Felix + has done a write to the dataplane that it schedules an extra read + back in order to check the write was not clobbered by another process. + This should only occur if another application on the system doesn''t + respect the iptables lock. [Default: 1s]' + type: string + iptablesRefreshInterval: + description: 'IptablesRefreshInterval is the period at which Felix + re-checks the IP sets in the dataplane to ensure that no other process + has accidentally broken Calico''s rules. Set to 0 to disable IP + sets refresh. Note: the default for this value is lower than the + other refresh intervals as a workaround for a Linux kernel bug that + was fixed in kernel version 4.11. If you are using v4.11 or greater + you may want to set this to, a higher value to reduce Felix CPU + usage. [Default: 10s]' + type: string + ipv6Support: + type: boolean + kubeNodePortRanges: + description: 'KubeNodePortRanges holds list of port ranges used for + service node ports. Only used if felix detects kube-proxy running + in ipvs mode. Felix uses these ranges to separate host and workload + traffic. [Default: 30000:32767].' + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + logFilePath: + description: 'LogFilePath is the full path to the Felix log. Set to + none to disable file logging. [Default: /var/log/calico/felix.log]' + type: string + logPrefix: + description: 'LogPrefix is the log prefix that Felix uses when rendering + LOG rules. [Default: calico-packet]' + type: string + logSeverityFile: + description: 'LogSeverityFile is the log severity above which logs + are sent to the log file. [Default: Info]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + logSeveritySys: + description: 'LogSeveritySys is the log severity above which logs + are sent to the syslog. Set to None for no logging to syslog. [Default: + Info]' + type: string + maxIpsetSize: + type: integer + metadataAddr: + description: 'MetadataAddr is the IP address or domain name of the + server that can answer VM queries for cloud-init metadata. In OpenStack, + this corresponds to the machine running nova-api (or in Ubuntu, + nova-api-metadata). A value of none (case insensitive) means that + Felix should not set up any NAT rule for the metadata path. [Default: + 127.0.0.1]' + type: string + metadataPort: + description: 'MetadataPort is the port of the metadata server. This, + combined with global.MetadataAddr (if not ''None''), is used to + set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. + In most cases this should not need to be changed [Default: 8775].' + type: integer + mtuIfacePattern: + description: MTUIfacePattern is a regular expression that controls + which interfaces Felix should scan in order to calculate the host's + MTU. This should not match workload interfaces (usually named cali...). + type: string + natOutgoingAddress: + description: NATOutgoingAddress specifies an address to use when performing + source NAT for traffic in a natOutgoing pool that is leaving the + network. By default the address used is an address on the interface + the traffic is leaving on (ie it uses the iptables MASQUERADE target) + type: string + natPortRange: + anyOf: + - type: integer + - type: string + description: NATPortRange specifies the range of ports that is used + for port mapping when doing outgoing NAT. When unset the default + behavior of the network stack is used. + pattern: ^.* + x-kubernetes-int-or-string: true + netlinkTimeout: + type: string + openstackRegion: + description: 'OpenstackRegion is the name of the region that a particular + Felix belongs to. In a multi-region Calico/OpenStack deployment, + this must be configured somehow for each Felix (here in the datamodel, + or in felix.cfg or the environment on each compute node), and must + match the [calico] openstack_region value configured in neutron.conf + on each node. [Default: Empty]' + type: string + policySyncPathPrefix: + description: 'PolicySyncPathPrefix is used to by Felix to communicate + policy changes to external services, like Application layer policy. + [Default: Empty]' + type: string + prometheusGoMetricsEnabled: + description: 'PrometheusGoMetricsEnabled disables Go runtime metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + prometheusMetricsEnabled: + description: 'PrometheusMetricsEnabled enables the Prometheus metrics + server in Felix if set to true. [Default: false]' + type: boolean + prometheusMetricsHost: + description: 'PrometheusMetricsHost is the host that the Prometheus + metrics server should bind to. [Default: empty]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. [Default: 9091]' + type: integer + prometheusProcessMetricsEnabled: + description: 'PrometheusProcessMetricsEnabled disables process metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + removeExternalRoutes: + description: Whether or not to remove device routes that have not + been programmed by Felix. Disabling this will allow external applications + to also add device routes. This is enabled by default which means + we will remove externally added routes. + type: boolean + reportingInterval: + description: 'ReportingInterval is the interval at which Felix reports + its status into the datastore or 0 to disable. Must be non-zero + in OpenStack deployments. [Default: 30s]' + type: string + reportingTTL: + description: 'ReportingTTL is the time-to-live setting for process-wide + status reports. [Default: 90s]' + type: string + routeRefreshInterval: + description: 'RouteRefreshInterval is the period at which Felix re-checks + the routes in the dataplane to ensure that no other process has + accidentally broken Calico''s rules. Set to 0 to disable route refresh. + [Default: 90s]' + type: string + routeSource: + description: 'RouteSource configures where Felix gets its routing + information. - WorkloadIPs: use workload endpoints to construct + routes. - CalicoIPAM: the default - use IPAM data to construct routes.' + type: string + routeTableRange: + description: Calico programs additional Linux route tables for various + purposes. RouteTableRange specifies the indices of the route tables + that Calico should use. + properties: + max: + type: integer + min: + type: integer + required: + - max + - min + type: object + serviceLoopPrevention: + description: 'When service IP advertisement is enabled, prevent routing + loops to service IPs that are not in use, by dropping or rejecting + packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled", + in which case such routing loops continue to be allowed. [Default: + Drop]' + type: string + sidecarAccelerationEnabled: + description: 'SidecarAccelerationEnabled enables experimental sidecar + acceleration [Default: false]' + type: boolean + usageReportingEnabled: + description: 'UsageReportingEnabled reports anonymous Calico version + number and cluster size to projectcalico.org. Logs warnings returned + by the usage server. For example, if a significant security vulnerability + has been discovered in the version of Calico being used. [Default: + true]' + type: boolean + usageReportingInitialDelay: + description: 'UsageReportingInitialDelay controls the minimum delay + before Felix makes a report. [Default: 300s]' + type: string + usageReportingInterval: + description: 'UsageReportingInterval controls the interval at which + Felix makes reports. [Default: 86400s]' + type: string + useInternalDataplaneDriver: + type: boolean + vxlanEnabled: + type: boolean + vxlanMTU: + description: 'VXLANMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + vxlanPort: + type: integer + vxlanVNI: + type: integer + wireguardEnabled: + description: 'WireguardEnabled controls whether Wireguard is enabled. + [Default: false]' + type: boolean + wireguardInterfaceName: + description: 'WireguardInterfaceName specifies the name to use for + the Wireguard interface. [Default: wg.calico]' + type: string + wireguardListeningPort: + description: 'WireguardListeningPort controls the listening port used + by Wireguard. [Default: 51820]' + type: integer + wireguardMTU: + description: 'WireguardMTU controls the MTU on the Wireguard interface. + See Configuring MTU [Default: 1420]' + type: integer + wireguardRoutingRulePriority: + description: 'WireguardRoutingRulePriority controls the priority value + to use for the Wireguard routing rule. [Default: 99]' + type: integer + xdpEnabled: + description: 'XDPEnabled enables XDP acceleration for suitable untracked + incoming deny rules. [Default: true]' + type: boolean + xdpRefreshInterval: + description: 'XDPRefreshInterval is the period at which Felix re-checks + all XDP state to ensure that no other process has accidentally broken + Calico''s BPF maps or attached programs. Set to 0 to disable XDP + refresh. [Default: 90s]' + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml new file mode 100755 index 0000000..97fd972 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml @@ -0,0 +1,853 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkPolicy + listKind: GlobalNetworkPolicyList + plural: globalnetworkpolicies + singular: globalnetworkpolicy + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + applyOnForward: + description: ApplyOnForward indicates to apply the rules in this policy + on forward traffic. + type: boolean + doNotTrack: + description: DoNotTrack indicates whether packets matched by the rules + in this policy should go through the data plane's connection tracking, + such as Linux conntrack. If True, the rules in this policy are + applied before any data plane connection tracking, and packets allowed + by this policy are marked as not to be tracked. + type: boolean + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + namespaceSelector: + description: NamespaceSelector is an optional field for an expression + used to select a pod based on namespaces. + type: string + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + preDNAT: + description: PreDNAT indicates to apply the rules in this policy before + any DNAT. + type: boolean + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress rules are present in the policy. The + default is: \n - [ PolicyTypeIngress ], if there are no Egress rules + (including the case where there are also no Ingress rules) \n + - [ PolicyTypeEgress ], if there are Egress rules but no Ingress + rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are + both Ingress and Egress rules. \n When the policy is read back again, + Types will always be one of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml new file mode 100755 index 0000000..00a2980 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml @@ -0,0 +1,51 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkSet + listKind: GlobalNetworkSetList + plural: globalnetworksets + singular: globalnetworkset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs + that share labels to allow rules to refer to them via selectors. The labels + of GlobalNetworkSet are not namespaced. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GlobalNetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml new file mode 100755 index 0000000..4824531 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml @@ -0,0 +1,106 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: HostEndpoint + listKind: HostEndpointList + plural: hostendpoints + singular: hostendpoint + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HostEndpointSpec contains the specification for a HostEndpoint + resource. + properties: + expectedIPs: + description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. + If \"InterfaceName\" is not present, Calico will look for an interface + matching any of the IPs in the list and apply policy to that. Note: + \tWhen using the selector match criteria in an ingress or egress + security Policy \tor Profile, Calico converts the selector into + a set of IP addresses. For host \tendpoints, the ExpectedIPs field + is used for that purpose. (If only the interface \tname is specified, + Calico does not learn the IPs of the interface for use in match + \tcriteria.)" + items: + type: string + type: array + interfaceName: + description: "Either \"*\", or the name of a specific Linux interface + to apply policy to; or empty. \"*\" indicates that this HostEndpoint + governs all traffic to, from or through the default network namespace + of the host named by the \"Node\" field; entering and leaving that + namespace via any interface, including those from/to non-host-networked + local workloads. \n If InterfaceName is not \"*\", this HostEndpoint + only governs traffic that enters or leaves the host through the + specific interface named by InterfaceName, or - when InterfaceName + is empty - through the specific interface that has one of the IPs + in ExpectedIPs. Therefore, when InterfaceName is empty, at least + one expected IP must be specified. Only external interfaces (such + as \"eth0\") are supported here; it isn't possible for a HostEndpoint + to protect traffic through a specific local workload interface. + \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; + initially just pre-DNAT policy. Please check Calico documentation + for the latest position." + type: string + node: + description: The node name identifying the Calico node instance. + type: string + ports: + description: Ports contains the endpoint's named ports, which may + be referenced in security policy rules. + items: + properties: + name: + type: string + port: + type: integer + protocol: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + required: + - name + - port + - protocol + type: object + type: array + profiles: + description: A list of identifiers of security Profile objects that + apply to this endpoint. Each profile is applied in the order that + they appear in this list. Profile rules are applied after the selector-based + security policy. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml new file mode 100755 index 0000000..6c333a0 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml @@ -0,0 +1,79 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMBlock + listKind: IPAMBlockList + plural: ipamblocks + singular: ipamblock + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMBlockSpec contains the specification for an IPAMBlock + resource. + properties: + affinity: + type: string + allocations: + items: + type: integer + # TODO: This nullable is manually added in. We should update controller-gen + # to handle []*int properly itself. + nullable: true + type: array + attributes: + items: + properties: + handle_id: + type: string + secondary: + additionalProperties: + type: string + type: object + type: object + type: array + cidr: + type: string + deleted: + type: boolean + strictAffinity: + type: boolean + unallocated: + items: + type: integer + type: array + required: + - allocations + - attributes + - cidr + - strictAffinity + - unallocated + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml new file mode 100755 index 0000000..3d85b16 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMConfig + listKind: IPAMConfigList + plural: ipamconfigs + singular: ipamconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMConfigSpec contains the specification for an IPAMConfig + resource. + properties: + autoAllocateBlocks: + type: boolean + maxBlocksPerHost: + description: MaxBlocksPerHost, if non-zero, is the max number of blocks + that can be affine to each host. + type: integer + strictAffinity: + type: boolean + required: + - autoAllocateBlocks + - strictAffinity + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml new file mode 100755 index 0000000..5c875cc --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMHandle + listKind: IPAMHandleList + plural: ipamhandles + singular: ipamhandle + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMHandleSpec contains the specification for an IPAMHandle + resource. + properties: + block: + additionalProperties: + type: integer + type: object + deleted: + type: boolean + handleID: + type: string + required: + - block + - handleID + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ippools.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ippools.yaml new file mode 100755 index 0000000..7e41753 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_ippools.yaml @@ -0,0 +1,97 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPPool + listKind: IPPoolList + plural: ippools + singular: ippool + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec contains the specification for an IPPool resource. + properties: + blockSize: + description: The block size to use for IP address assignments from + this pool. Defaults to 26 for IPv4 and 112 for IPv6. + type: integer + cidr: + description: The pool CIDR. + type: string + disabled: + description: When disabled is true, Calico IPAM will not assign addresses + from this pool. + type: boolean + ipip: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + properties: + enabled: + description: When enabled is true, ipip tunneling will be used + to deliver packets to destinations within this pool. + type: boolean + mode: + description: The IPIP mode. This can be one of "always" or "cross-subnet". A + mode of "always" will also use IPIP tunneling for routing to + destination IP addresses within this pool. A mode of "cross-subnet" + will only use IPIP tunneling when the destination node is on + a different subnet to the originating node. The default value + (if not specified) is "always". + type: string + type: object + ipipMode: + description: Contains configuration for IPIP tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling + is disabled). + type: string + nat-outgoing: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + type: boolean + natOutgoing: + description: When nat-outgoing is true, packets sent from Calico networked + containers in this pool to destinations outside of this pool will + be masqueraded. + type: boolean + nodeSelector: + description: Allows IPPool to allocate for a specific node by label + selector. + type: string + vxlanMode: + description: Contains configuration for VXLAN tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. VXLAN + tunneling is disabled). + type: string + required: + - cidr + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml new file mode 100755 index 0000000..4806b19 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml @@ -0,0 +1,241 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: kubecontrollersconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: KubeControllersConfiguration + listKind: KubeControllersConfigurationList + plural: kubecontrollersconfigurations + singular: kubecontrollersconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: KubeControllersConfigurationSpec contains the values of the + Kubernetes controllers configuration. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host endpoints. + Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation of + host endpoints for every node. [Default: Disabled]' + type: string + type: object + leakGracePeriod: + description: 'LeakGracePeriod is the period used by the controller + to determine if an IP address has been leaked. Set to 0 + to disable IP garbage collection. [Default: 15m]' + type: string + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: 9094]' + type: integer + required: + - controllers + type: object + status: + description: KubeControllersConfigurationStatus represents the status + of the configuration. It's useful for admins to be able to see the actual + config that was applied, which can be modified by environment variables + on the kube-controllers process. + properties: + environmentVars: + additionalProperties: + type: string + description: EnvironmentVars contains the environment variables on + the kube-controllers that influenced the RunningConfig. + type: object + runningConfig: + description: RunningConfig contains the effective config that is running + in the kube-controllers pod, after merging the API resource with + any environment variables. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace + controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host + endpoints. Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation + of host endpoints for every node. [Default: Disabled]' + type: string + type: object + leakGracePeriod: + description: 'LeakGracePeriod is the period used by the + controller to determine if an IP address has been leaked. + Set to 0 to disable IP garbage collection. [Default: + 15m]' + type: string + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which + logs are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: + 9094]' + type: integer + required: + - controllers + type: object + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml new file mode 100755 index 0000000..a82b09f --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml @@ -0,0 +1,834 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkPolicy + listKind: NetworkPolicyList + plural: networkpolicies + singular: networkpolicy + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress are present in the policy. The default + is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including + the case where there are also no Ingress rules) \n - [ PolicyTypeEgress + ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, + PolicyTypeEgress ], if there are both Ingress and Egress rules. + \n When the policy is read back again, Types will always be one + of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_networksets.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_networksets.yaml new file mode 100755 index 0000000..4bb0e21 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/calico/kdd/crd.projectcalico.org_networksets.yaml @@ -0,0 +1,49 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkSet + listKind: NetworkSetList + plural: networksets + singular: networkset + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: NetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_apiservers_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_apiservers_crd.yaml new file mode 100755 index 0000000..c46b996 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_apiservers_crd.yaml @@ -0,0 +1,46 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: apiservers.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: APIServer + listKind: APIServerList + plural: apiservers + singular: apiserver + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: APIServer installs the Tigera API server and related resources. + At most one instance of this resource is supported. It must be named "tigera-secure". + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Specification of the desired state for the Tigera API server. + type: object + status: + description: Most recently observed status for the Tigera API server. + properties: + state: + description: State provides user-readable status. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_imagesets_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_imagesets_crd.yaml new file mode 100755 index 0000000..d09ae1c --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_imagesets_crd.yaml @@ -0,0 +1,75 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: imagesets.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: ImageSet + listKind: ImageSetList + plural: imagesets + singular: imageset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ImageSet is used to specify image digests for the images that + the operator deploys. The name of the ImageSet is expected to be in the + format `-`. The `variant` used is `enterprise` if the + InstallationSpec Variant is `TigeraSecureEnterprise` otherwise it is `calico`. + The `release` must match the version of the variant that the operator is + built to deploy, this version can be obtained by passing the `--version` + flag to the operator binary. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageSetSpec defines the desired state of ImageSet. + properties: + images: + description: Images is the list of images to use digests. All images + that the operator will deploy must be specified. + items: + properties: + digest: + description: Digest is the image identifier that will be used + for the Image. The field should not include a leading `@` + and must be prefixed with `sha256:`. + type: string + image: + description: Image is an image that the operator deploys and + instead of using the built in tag the operator will use the + Digest for the image identifier. The value should be the image + name without registry or tag or digest. For the image `docker.io/calico/node:v3.17.1` + it should be represented as `calico/node` + type: string + required: + - digest + - image + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_installations_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_installations_crd.yaml new file mode 100755 index 0000000..51cf387 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_installations_crd.yaml @@ -0,0 +1,1455 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: installations.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: Installation + listKind: InstallationList + plural: installations + singular: installation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Installation configures an installation of Calico or Calico Enterprise. + At most one instance of this resource is supported. It must be named "default". + The Installation API installs core networking and network policy components, + and provides general install-time configuration. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Specification of the desired state for the Calico or Calico + Enterprise installation. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration options + for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip forwarding + will be enabled for containers in the CNI configuration. Default: + Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the Calico + CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create if + none exist. At most one IP pool of each address family may be + specified. If omitted, a single pool will be configured if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the main + IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the IP + Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector that + will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + linuxDataplane: + description: 'LinuxDataplane is used to select the dataplane used + for Linux nodes. In particular, it causes the operator to add + required mounts and environment variables for the particular + dataplane. If not specified, iptables mode is used. Default: + Iptables' + enum: + - Iptables + - BPF + type: string + mtu: + description: MTU specifies the maximum transmission unit to use + on the pod network. If not specified, Calico will perform MTU + auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a CertificateSigningRequest + to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. + This feature requires that you bring your own CSR signing and approval + process, otherwise pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate a + key pair that is associated with the X.509 certificate request. + Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature of + the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to accommodate + for clusters with multiple signers. Must be formatted as: `/`.' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management that + will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For CNI + Plugin Calico, this field defaults to Calico. * For CNI + Plugin GKE, this field defaults to HostLocal. * For CNI + Plugin AzureVNET, this field defaults to AzureVNET. * For + CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only if the + CNI plugin is set to Calico, for all other values of the + CNI plugin the plugin binaries and CNI config is a dependency + that is expected to be installed separately. \n Default: + Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in the + Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider AKS, + this field defaults to AzureVNET. * For KubernetesProvider EKS, + this field defaults to AmazonVPC. * If aws-node daemonset exists + in kube-system when the Installation resource is created, this + field defaults to AmazonVPC. * For all other cases this field + defaults to Calico. \n For the value Calico, the CNI plugin + binaries and CNI config will be installed as part of deployment, + for all other values the CNI plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. Node, Typha, and KubeControllers + are supported for installations. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of limits + and requests for compute resources such as cpu and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control plane + nodes on which to run Calico components. This is globally applied + to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which are + then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates any + taint that matches the triple using the matching + operator . + properties: + effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match all + values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod + can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, it + is not set, which means tolerate the taint forever (do not + evict). Zero and negative values will be treated as 0 (evict + immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path for + FlexVolume. If not specified, FlexVolume will be enabled by default. + If set to 'None', FlexVolume will be disabled. The default is based + on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to be + specified. If specified then the specified value will be used as + the image path for each image. If not specified or empty, the default + for each image will be used. A special case value, UseDefault, is + supported to explicitly specify the default image path will be used + for each image. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + imagePrefix: + description: "ImagePrefix allows for the prefix part of an image to + be specified. If specified then the given value will be used as + a prefix on each image. If not specified or empty, no prefix will + be used. A special case value, UseDefault, is supported to explicitly + specify the default image prefix will be used for each image. \n + Image format: `//:` + \n This option allows configuring the `` portion of + the above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images to + be pulled. + items: + description: LocalObjectReference contains enough information to + let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider of + the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to automatically + determine the current provider. If the specified value is not empty, + the Operator will still attempt auto-detection, but will additionally + compare the auto-detected value to the specified value to confirm + they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node serves + prometheus metrics on. By default, metrics are not enabled. If specified, + this overrides any FelixConfiguration resources which may exist. + If omitted, then prometheus metrics may still be configured through + FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if type + = "RollingUpdate". --- TODO: Update this to follow our convention + for oneOf, whatever we decide it to be. Same as Deployment `strategy.rollingUpdate`. + See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that can + be unavailable during the update. Value can be an absolute + number (ex: 5) or a percentage of total number of DaemonSet + pods at the start of the update (ex: 10%). Absolute number + is calculated from percentage by rounding up. This cannot + be 0. Default value is 1. Example: when this is set to 30%, + at most 30% of the total number of nodes that should be + running the daemon pod (i.e. status.desiredNumberScheduled) + can have their pods stopped for an update at any given time. + The update starts by stopping at most 30% of those DaemonSet + pods and then brings up new DaemonSet pods in their place. + Once the new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times during + the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for component + Docker images. If specified, all images will be pulled from this + registry. If not specified then the default registries will be used. + A special case value, UseDefault, is supported to explicitly specify + the default registries will be used. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity characteristics + for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling rules + for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects (i.e. + is also a no-op). + properties: + preference: + description: A node selector term, associated with the + corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: 'WARNING: Please note that if the affinity requirements + specified by this field are not met at scheduling time, + the pod will NOT be scheduled onto the node. There is no + fallback to another affinity rules with this setting. This + may cause networking disruption or even catastrophic failure! + PreferredDuringSchedulingIgnoredDuringExecution should be + used for affinity unless there is a specific well understood + reason to use RequiredDuringSchedulingIgnoredDuringExecution + and you can guarantee that the RequiredDuringSchedulingIgnoredDuringExecution + will always have sufficient nodes to satisfy the requirement. + NOTE: RequiredDuringSchedulingIgnoredDuringExecution is + set by default for AKS nodes, to avoid scheduling Typhas + on virtual-nodes. If the affinity requirements specified + by this field cease to be met at some point during pod execution + (e.g. due to an update), the system may or may not try to + eventually evict the pod from its node.' + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: A null or empty node selector term matches + no objects. The requirements of them are ANDed. The + TopologySelectorTerm type implements a subset of the + NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + type: array + required: + - nodeSelectorTerms + type: object + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha serves + prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico or + TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + status: + description: Most recently observed state for the Calico or Calico Enterprise + installation. + properties: + computed: + description: Computed is the final installation including overlaid + resources. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration + options for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip + forwarding will be enabled for containers in the CNI configuration. + Default: Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the + Calico CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create + if none exist. At most one IP pool of each address family + may be specified. If omitted, a single pool will be configured + if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the + main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the + IP Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: + IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector + that will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + linuxDataplane: + description: 'LinuxDataplane is used to select the dataplane + used for Linux nodes. In particular, it causes the operator + to add required mounts and environment variables for the + particular dataplane. If not specified, iptables mode is + used. Default: Iptables' + enum: + - Iptables + - BPF + type: string + mtu: + description: MTU specifies the maximum transmission unit to + use on the pod network. If not specified, Calico will perform + MTU auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a + CertificateSigningRequest to the certificates.k8s.io/v1beta1 + API in order to obtain TLS certificates. This feature requires + that you bring your own CSR signing and approval process, otherwise + pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate + a key pair that is associated with the X.509 certificate + request. Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature + of the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to + accommodate for clusters with multiple signers. Must be + formatted as: `/`.' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management + that will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For + CNI Plugin Calico, this field defaults to Calico. * + For CNI Plugin GKE, this field defaults to HostLocal. + * For CNI Plugin AzureVNET, this field defaults to AzureVNET. + * For CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only + if the CNI plugin is set to Calico, for all other values + of the CNI plugin the plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in + the Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider + AKS, this field defaults to AzureVNET. * For KubernetesProvider + EKS, this field defaults to AmazonVPC. * If aws-node daemonset + exists in kube-system when the Installation resource is + created, this field defaults to AmazonVPC. * For all other + cases this field defaults to Calico. \n For the value Calico, + the CNI plugin binaries and CNI config will be installed + as part of deployment, for all other values the CNI plugin + binaries and CNI config is a dependency that is expected + to be installed separately. \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. Node, Typha, and KubeControllers + are supported for installations. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the + component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of + limits and requests for compute resources such as cpu + and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of + compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control + plane nodes on which to run Calico components. This is globally + applied to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which + are then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates + any taint that matches the triple using + the matching operator . + properties: + effect: + description: Effect indicates the taint effect to match. + Empty means match all taint effects. When specified, allowed + values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match + all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to + the value. Valid operators are Exists and Equal. Defaults + to Equal. Exists is equivalent to wildcard for value, + so that a pod can tolerate all taints of a particular + category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of + time the toleration (which must be of effect NoExecute, + otherwise this field is ignored) tolerates the taint. + By default, it is not set, which means tolerate the taint + forever (do not evict). Zero and negative values will + be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path + for FlexVolume. If not specified, FlexVolume will be enabled + by default. If set to 'None', FlexVolume will be disabled. The + default is based on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to + be specified. If specified then the specified value will be + used as the image path for each image. If not specified or empty, + the default for each image will be used. A special case value, + UseDefault, is supported to explicitly specify the default image + path will be used for each image. \n Image format: `//:` + \n This option allows configuring the `` portion + of the above format." + type: string + imagePrefix: + description: "ImagePrefix allows for the prefix part of an image + to be specified. If specified then the given value will be used + as a prefix on each image. If not specified or empty, no prefix + will be used. A special case value, UseDefault, is supported + to explicitly specify the default image prefix will be used + for each image. \n Image format: `//:` + \n This option allows configuring the `` portion + of the above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images + to be pulled. + items: + description: LocalObjectReference contains enough information + to let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider + of the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to + automatically determine the current provider. If the specified + value is not empty, the Operator will still attempt auto-detection, + but will additionally compare the auto-detected value to the + specified value to confirm they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node + serves prometheus metrics on. By default, metrics are not enabled. + If specified, this overrides any FelixConfiguration resources + which may exist. If omitted, then prometheus metrics may still + be configured through FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if + type = "RollingUpdate". --- TODO: Update this to follow + our convention for oneOf, whatever we decide it to be. Same + as Deployment `strategy.rollingUpdate`. See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that + can be unavailable during the update. Value can be an + absolute number (ex: 5) or a percentage of total number + of DaemonSet pods at the start of the update (ex: 10%). + Absolute number is calculated from percentage by rounding + up. This cannot be 0. Default value is 1. Example: when + this is set to 30%, at most 30% of the total number + of nodes that should be running the daemon pod (i.e. + status.desiredNumberScheduled) can have their pods stopped + for an update at any given time. The update starts by + stopping at most 30% of those DaemonSet pods and then + brings up new DaemonSet pods in their place. Once the + new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times + during the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for + component Docker images. If specified, all images will be pulled + from this registry. If not specified then the default registries + will be used. A special case value, UseDefault, is supported + to explicitly specify the default registries will be used. \n + Image format: `//:` + \n This option allows configuring the `` portion of + the above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity + characteristics for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling + rules for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects + (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: 'WARNING: Please note that if the affinity + requirements specified by this field are not met at + scheduling time, the pod will NOT be scheduled onto + the node. There is no fallback to another affinity rules + with this setting. This may cause networking disruption + or even catastrophic failure! PreferredDuringSchedulingIgnoredDuringExecution + should be used for affinity unless there is a specific + well understood reason to use RequiredDuringSchedulingIgnoredDuringExecution + and you can guarantee that the RequiredDuringSchedulingIgnoredDuringExecution + will always have sufficient nodes to satisfy the requirement. + NOTE: RequiredDuringSchedulingIgnoredDuringExecution + is set by default for AKS nodes, to avoid scheduling + Typhas on virtual-nodes. If the affinity requirements + specified by this field cease to be met at some point + during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from + its node.' + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: A null or empty node selector term + matches no objects. The requirements of them are + ANDed. The TopologySelectorTerm type implements + a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + type: array + required: + - nodeSelectorTerms + type: object + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha + serves prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico + or TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + imageSet: + description: ImageSet is the name of the ImageSet being used, if there + is an ImageSet that is being used. If an ImageSet is not being used + then this will not be set. + type: string + mtu: + description: MTU is the most recently observed value for pod network + MTU. This may be an explicitly configured value, or based on Calico's + native auto-detetion. + format: int32 + type: integer + variant: + description: Variant is the most recently observed installed variant + - one of Calico or TigeraSecureEnterprise + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_tigerastatuses_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_tigerastatuses_crd.yaml new file mode 100755 index 0000000..abfe29c --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.201/templates/operator.tigera.io_tigerastatuses_crd.yaml @@ -0,0 +1,104 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: tigerastatuses.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: TigeraStatus + listKind: TigeraStatusList + plural: tigerastatuses + singular: tigerastatus + scope: Cluster + versions: + - additionalPrinterColumns: + - description: Whether the component running and stable. + jsonPath: .status.conditions[?(@.type=='Available')].status + name: Available + type: string + - description: Whether the component is processing changes. + jsonPath: .status.conditions[?(@.type=='Progressing')].status + name: Progressing + type: string + - description: Whether the component is degraded. + jsonPath: .status.conditions[?(@.type=='Degraded')].status + name: Degraded + type: string + - description: The time the component's Available status last changed. + jsonPath: .status.conditions[?(@.type=='Available')].lastTransitionTime + name: Since + type: date + name: v1 + schema: + openAPIV3Schema: + description: TigeraStatus represents the most recently observed status for + Calico or a Calico Enterprise functional area. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: TigeraStatusSpec defines the desired state of TigeraStatus + type: object + status: + description: TigeraStatusStatus defines the observed state of TigeraStatus + properties: + conditions: + description: Conditions represents the latest observed set of conditions + for this component. A component may be one or more of Available, + Progressing, or Degraded. + items: + description: TigeraStatusCondition represents a condition attached + to a particular component. + properties: + lastTransitionTime: + description: The timestamp representing the start time for the + current status. + format: date-time + type: string + message: + description: Optionally, a detailed message providing additional + context. + type: string + reason: + description: A brief reason explaining the condition. + type: string + status: + description: The status of the condition. May be True, False, + or Unknown. + type: string + type: + description: The type of condition. May be Available, Progressing, + or Degraded. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + required: + - conditions + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/Chart.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/Chart.yaml new file mode 100755 index 0000000..277cc29 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/Chart.yaml @@ -0,0 +1,7 @@ +annotations: + catalog.cattle.io/namespace: tigera-operator +apiVersion: v2 +appVersion: v3.20.1 +description: Installs the Tigera operator for Calico +name: rke2-calico +version: v3.20.101 diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/_helpers.tpl b/charts/rke2-calico/rke2-calico/v3.20.101/templates/_helpers.tpl new file mode 100755 index 0000000..3ac4a1c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/_helpers.tpl @@ -0,0 +1,10 @@ +{{/* generate the image name for a component*/}} +{{- define "tigera-operator.image" -}} +{{- if .Values.global.systemDefaultRegistry -}} +{{- $_ := set .Values.tigeraOperator "registry" .Values.global.systemDefaultRegistry -}} +{{- end -}} +{{- if .Values.tigeraOperator.registry -}} + {{- .Values.tigeraOperator.registry | trimSuffix "/" -}}/ +{{- end -}} +{{- .Values.tigeraOperator.image -}}:{{- .Values.tigeraOperator.version -}} +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/certs/certs-node.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/certs/certs-node.yaml new file mode 100755 index 0000000..5830c2a --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/certs/certs-node.yaml @@ -0,0 +1,13 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +apiVersion: v1 +kind: Secret +metadata: + name: node-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.node.cert" .Values.certs.node.cert | b64enc }} + key.key: {{ required "must set certs.node.key" .Values.certs.node.key | b64enc }} + common-name: {{ required "must set certs.node.commonName" .Values.certs.node.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/certs/certs-typha.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/certs/certs-typha.yaml new file mode 100755 index 0000000..4463e89 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/certs/certs-typha.yaml @@ -0,0 +1,23 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +kind: ConfigMap +apiVersion: v1 +metadata: + name: typha-ca + namespace: tigera-operator +data: + caBundle: | +{{ required "must set certs.typha.caBundle" .Values.certs.typha.caBundle | indent 4}} +--- + +apiVersion: v1 +kind: Secret +metadata: + name: typha-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.typha.cert" .Values.certs.typha.cert | b64enc }} + key.key: {{ required "must set certs.typha.key" .Values.certs.typha.key | b64enc }} + common-name: {{ required "must set certs.typha.commonName" .Values.certs.typha.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/crs/custom-resources.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/crs/custom-resources.yaml new file mode 100755 index 0000000..702fe0e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/crs/custom-resources.yaml @@ -0,0 +1,38 @@ +{{ if .Values.installation.enabled }} +{{ $installSpec := omit .Values.installation "enabled" }} +{{ $secrets := list }} +{{ range $name := keys .Values.imagePullSecrets -}} +{{ $item := dict "name" $name }} +{{ $secrets = append $secrets $item }} +{{ end }} +{{ $_ := set $installSpec "imagePullSecrets" $secrets }} +{{ $defaultRegistry := get $installSpec "registry" }} +{{ $finalRegistry := coalesce .Values.global.systemDefaultRegistry $defaultRegistry }} +{{ $_ := set $installSpec "registry" $finalRegistry }} +{{ $defaultipPools := get .Values.installation.calicoNetwork "ipPools" | first }} +{{ $defaultCIDR := get $defaultipPools "cidr" }} +{{ $finalCIDR := coalesce .Values.global.clusterCIDRv4 $defaultCIDR }} +{{ $_ := set $defaultipPools "cidr" $finalCIDR }} +{{- /* +If there is a defined ipv6 CIDR, we must add it as a new IPPool, disable any encapsulation and enable bgp +*/}} +{{ if not (empty .Values.global.clusterCIDRv6) }} +{{ $myIP6Dict := dict "natOutgoing" "Enabled" "cidr" .Values.global.clusterCIDRv6 }} +{{ $allIpPools := get .Values.installation.calicoNetwork "ipPools" }} +{{ range $allIpPools }} +{{ $_ := set . "encapsulation" "None" }} +{{ end }} +{{ $finalIpPoolList := append $allIpPools $myIP6Dict }} +{{ $calicoNetwork := get .Values.installation "calicoNetwork" }} +{{ $_ := set $calicoNetwork "ipPools" $finalIpPoolList }} +{{ $_ := set $calicoNetwork "bgp" "Enabled" }} +{{ end }} + +apiVersion: operator.tigera.io/v1 +kind: Installation +metadata: + name: default +spec: +{{ $installSpec | toYaml | indent 2 }} + +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/felixconfig.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/felixconfig.yaml new file mode 100755 index 0000000..9d030ba --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/felixconfig.yaml @@ -0,0 +1,6 @@ +apiVersion: crd.projectcalico.org/v1 +kind: FelixConfiguration +metadata: + name: default +spec: + featureDetectOverride: {{ .Values.felixConfiguration.featureDetectOverride }} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/ipamconfig.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/ipamconfig.yaml new file mode 100755 index 0000000..22dba0e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/ipamconfig.yaml @@ -0,0 +1,7 @@ +apiVersion: crd.projectcalico.org/v1 +kind: IPAMConfig +metadata: + name: default +spec: + strictAffinity: {{ .Values.ipamConfig.strictAffinity }} + autoAllocateBlocks: {{ .Values.ipamConfig.autoAllocateBlocks }} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/00-namespace-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/00-namespace-tigera-operator.yaml new file mode 100755 index 0000000..b7e260e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/00-namespace-tigera-operator.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: tigera-operator + annotations: +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/node-selector: "" +{{- end }} + labels: + name: tigera-operator +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/run-level: "0" +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/01-imagepullsecret.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/01-imagepullsecret.yaml new file mode 100755 index 0000000..b90407c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/01-imagepullsecret.yaml @@ -0,0 +1,15 @@ +{{- $envAll := . }} +{{- if .Values.imagePullSecrets -}} + +{{range $key, $value := .Values.imagePullSecrets -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $key }} + namespace: tigera-operator +data: + .dockerconfigjson: {{ $value | b64enc }} +type: kubernetes.io/dockerconfigjson +{{- end -}} + +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-configmap-calico-resources.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-configmap-calico-resources.yaml new file mode 100755 index 0000000..2270813 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-configmap-calico-resources.yaml @@ -0,0 +1,27 @@ +{{- if eq .Values.installation.kubernetesProvider "openshift" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: calico-resources + namespace: tigera-operator +data: + # To create Calico resources before Calico components are started add + # an entry here and the contents of the resource under the entry. + # The resources here should all be projectcalico.org/v3. + # Multiple resources/entries can be added to this ConfigMap. + # + # If you need to remove a resource that was added to this ConfigMap + # you should remove it from here or else it will be re-created. + # + # example-global-network-set.yaml: | + # apiVersion: projectcalico.org/v3 + # kind: GlobalNetworkSet + # metadata: + # name: a-name-for-the-set + # labels: + # role: external-database + # spec: + # nets: + # - 198.51.100.0/28 + # - 203.0.113.0/24 +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml new file mode 100755 index 0000000..97e5c04 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml @@ -0,0 +1,47 @@ +{{ if ne .Values.installation.kubernetesProvider "openshift" }} +# This should not be rendered for an OpenShift install. +# OpenShift uses SecurityContextConstraints instead. +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: tigera-operator + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'hostPath' + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + # Assume that persistentVolumes set up by the cluster admin are safe to use. + - 'persistentVolumeClaim' + hostNetwork: true + hostPorts: + - min: 0 + max: 65535 + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-role-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-role-tigera-operator.yaml new file mode 100755 index 0000000..f40bf57 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-role-tigera-operator.yaml @@ -0,0 +1,278 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tigera-operator +rules: + - apiGroups: + - "" + resources: + - namespaces + - pods + - podtemplates + - services + - endpoints + - events + - configmaps + - secrets + - serviceaccounts + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + # Need to update node labels when migrating nodes. + - 'get' + - 'patch' + - 'list' + # We need this for Typha autoscaling + - 'watch' + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - rolebindings + - roles + verbs: + - create + - get + - list + - update + - delete + - watch + - bind + - escalate + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - statefulsets + verbs: + - create + - get + - list + - patch + - update + - delete + - watch + - apiGroups: + - apps + resourceNames: + - tigera-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - operator.tigera.io + resources: + - '*' + verbs: + - create + - get + - list + - update + - patch + - delete + - watch + - apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - create + - update + - delete + - get + - list + - watch + - apiGroups: + - crd.projectcalico.org + resources: + - felixconfigurations + verbs: + - create + - patch + - list + - get + - watch + - apiGroups: + - crd.projectcalico.org + resources: + - ippools + - kubecontrollersconfigurations + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - apiregistration.k8s.io + resources: + - apiservices + verbs: + - list + - watch + - create + - update + # Needed for operator lock + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - update + - delete + - watch +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + # When running in OpenShift, we need to update networking config. + - apiGroups: + - config.openshift.io + resources: + - networks/status + verbs: + - get + - list + - update + - apiGroups: + - config.openshift.io + resources: + - networks + - infrastructures + verbs: + - get + - list + - patch + - watch + # On OpenShift, we need to modify SCCs. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - create + - get + - list + - update + - delete + - watch + # The following rule is only for operator certification purposes. + # The operator normally runs in a namespace with openshift.io/run-level=0 which bypasses SCC. + # However in certification tests, the operator is run in a normal namespace so this + # rule is needed for host networking and hostPath volume access. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - hostaccess + verbs: + - use + # Need these permissions for the calicoctl init container. + - apiGroups: + - crd.projectcalico.org + resources: + - bgpconfigurations + - bgppeers + - felixconfigurations + - kubecontrollersconfigurations + - globalnetworkpolicies + - globalnetworksets + - hostendpoints + - ippools + - networkpolicies + - networksets + verbs: + - create + - apiGroups: + - crd.projectcalico.org + resources: + - ipamblocks + verbs: + - list + # Need this permission for the calicoctl version mismatch checking + - apiGroups: + - crd.projectcalico.org + resources: + - clusterinformations + verbs: + - get + # For AWS security group setup. + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - create + - update + - list + - watch +{{- else }} + # Add the appropriate pod security policy permissions + - apiGroups: + - policy + resources: + - podsecuritypolicies + resourceNames: + - tigera-operator + verbs: + - use + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - get + - list + - watch + - create + - update + - delete +# Add the permissions to monitor the status of certificatesigningrequests when certificate management is enabled. + - apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + verbs: + - list +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-rolebinding-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-rolebinding-tigera-operator.yaml new file mode 100755 index 0000000..5689683 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-rolebinding-tigera-operator.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tigera-operator +subjects: +- kind: ServiceAccount + name: tigera-operator + namespace: tigera-operator +roleRef: + kind: ClusterRole + name: tigera-operator + apiGroup: rbac.authorization.k8s.io diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml new file mode 100755 index 0000000..14cd955 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tigera-operator + namespace: tigera-operator diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-tigera-operator.yaml new file mode 100755 index 0000000..e705255 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/tigera-operator/02-tigera-operator.yaml @@ -0,0 +1,85 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tigera-operator + namespace: tigera-operator + labels: + k8s-app: tigera-operator +spec: + replicas: 1 + selector: + matchLabels: + name: tigera-operator + template: + metadata: + labels: + name: tigera-operator + k8s-app: tigera-operator + spec: + nodeSelector: + kubernetes.io/os: linux + tolerations: + - effect: NoExecute + operator: Exists + - effect: NoSchedule + operator: Exists + serviceAccountName: tigera-operator + hostNetwork: true + # This must be set when hostNetwork is true or else the cluster services won't resolve + dnsPolicy: ClusterFirstWithHostNet + containers: + - name: tigera-operator + image: {{ template "tigera-operator.image" . }} + imagePullPolicy: IfNotPresent + command: + - operator + volumeMounts: + - name: var-lib-calico + readOnly: true + mountPath: /var/lib/calico + env: + - name: WATCH_NAMESPACE + value: "" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: "tigera-operator" + - name: TIGERA_OPERATOR_INIT_IMAGE_VERSION + value: {{.Values.tigeraOperator.version}} + envFrom: + - configMapRef: + name: kubernetes-services-endpoint + optional: true + volumes: + - name: var-lib-calico + hostPath: + path: /var/lib/calico +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + - name: calico-resources + configMap: + defaultMode: 0400 + name: calico-resources + - name: install-resources-script + configMap: + defaultMode: 0777 + name: install-resources-script + initContainers: + - name: create-initial-resources + image: {{.Values.calicoctl.image}}:{{.Values.calicoctl.tag}} + env: + - name: DATASTORE_TYPE + value: kubernetes + command: + - calicoctl + args: + - create + - --skip-exists + - --skip-empty + - -f + - /calico-resources + volumeMounts: + - name: calico-resources + mountPath: /calico-resources +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/templates/validate-install-crd.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/templates/validate-install-crd.yaml new file mode 100755 index 0000000..4d2a69c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/templates/validate-install-crd.yaml @@ -0,0 +1,32 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "crd.projectcalico.org/v1/BGPConfiguration" false -}} +# {{- set $found "crd.projectcalico.org/v1/BGPPeer" false -}} +# {{- set $found "crd.projectcalico.org/v1/BlockAffinity" false -}} +# {{- set $found "crd.projectcalico.org/v1/ClusterInformation" false -}} +# {{- set $found "crd.projectcalico.org/v1/FelixConfiguration" false -}} +# {{- set $found "crd.projectcalico.org/v1/GlobalNetworkPolicy" false -}} +# {{- set $found "crd.projectcalico.org/v1/GlobalNetworkSet" false -}} +# {{- set $found "crd.projectcalico.org/v1/HostEndpoint" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPAMBlock" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPAMConfig" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPAMHandle" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPPool" false -}} +# {{- set $found "crd.projectcalico.org/v1/KubeControllersConfiguration" false -}} +# {{- set $found "crd.projectcalico.org/v1/NetworkPolicy" false -}} +# {{- set $found "crd.projectcalico.org/v1/NetworkSet" false -}} +# {{- set $found "operator.tigera.io/v1/APIServer" false -}} +# {{- set $found "operator.tigera.io/v1/ImageSet" false -}} +# {{- set $found "operator.tigera.io/v1/Installation" false -}} +# {{- set $found "operator.tigera.io/v1/TigeraStatus" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rke2-calico/rke2-calico/v3.20.101/values.yaml b/charts/rke2-calico/rke2-calico/v3.20.101/values.yaml new file mode 100755 index 0000000..59da797 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.20.101/values.yaml @@ -0,0 +1,58 @@ +imagePullSecrets: {} + +installation: + controlPlaneTolerations: + - key: "node-role.kubernetes.io/control-plane" + operator: "Exists" + effect: "NoSchedule" + - key: "node-role.kubernetes.io/etcd" + operator: "Exists" + effect: "NoExecute" + enabled: true + kubernetesProvider: "" + calicoNetwork: + bgp: Disabled + ipPools: + - natOutgoing: Enabled + encapsulation: VXLAN + cidr: 10.42.0.0/16 + blockSize: 24 + imagePath: "rancher" + imagePrefix: "mirrored-calico-" + +apiServer: + enabled: true + +certs: + node: + key: + cert: + commonName: + typha: + key: + cert: + commonName: + caBundle: + +# Configuration for the tigera operator +tigeraOperator: + image: rancher/mirrored-calico-operator + version: v1.20.3 + registry: docker.io +calicoctl: + image: rancher/mirrored-calico-ctl + tag: v3.20.1 + +global: + systemDefaultRegistry: "" + clusterCIDRv4: "" + clusterCIDRv6: "" + +# Config required by Windows nodes +ipamConfig: + strictAffinity: true + autoAllocateBlocks: true + +# Config required to fix RKE2 issue #1541 +felixConfiguration: + featureDetectOverride: "ChecksumOffloadBroken=true" diff --git a/index.yaml b/index.yaml index 860aaac..e0cd246 100755 --- a/index.yaml +++ b/index.yaml @@ -60,6 +60,17 @@ entries: urls: - assets/rke2-calico/rke2-calico-v3.1906.tgz version: v3.1906 + - annotations: + catalog.cattle.io/namespace: tigera-operator + apiVersion: v2 + appVersion: v3.20.1 + created: "2021-10-06T09:10:54.524014269Z" + description: Installs the Tigera operator for Calico + digest: a0bc24a6418f6881573a83949300fb6b4ebe4be8e76773849fb761f7e62f5c57 + name: rke2-calico + urls: + - assets/rke2-calico/rke2-calico-v3.20.101.tgz + version: v3.20.101 - annotations: catalog.cattle.io/namespace: tigera-operator apiVersion: v2 @@ -171,6 +182,15 @@ entries: - assets/rke2-calico/rke2-calico-v3.18.1-101.tgz version: v3.18.1-101 rke2-calico-crd: + - apiVersion: v1 + created: "2021-10-06T09:10:54.507676167Z" + description: Installs the CRDs for rke2-calico + digest: 0a17462a6a6e9e31d2303b79442402497432242d9d06a875c68ba797a81c5907 + name: rke2-calico-crd + type: application + urls: + - assets/rke2-calico/rke2-calico-crd-v1.0.201.tgz + version: v1.0.201 - apiVersion: v1 created: "2021-09-24T16:25:47.199074596Z" description: Installs the CRDs for rke2-calico