From ba05165f3c5d894435d6477cf84e660fb91cd4c1 Mon Sep 17 00:00:00 2001 From: actions Date: Fri, 14 Jan 2022 18:03:06 +0000 Subject: [PATCH] Merge pull request #210 from manuelbuil/update-chart-with-v3.20.3 Update Chart.yaml with the newer version --- .../rke2-canal-v3.20.3-build2022011406.tgz | Bin 0 -> 27854 bytes .../v3.20.3-build2022011406/Chart.yaml | 13 + .../templates/NOTES.txt | 3 + .../templates/_helpers.tpl | 7 + .../templates/config.yaml | 84 ++ .../templates/crds/bgpconfigurations.crd.yaml | 144 +++ .../templates/crds/bgppeers.crd.yaml | 115 +++ .../templates/crds/blockaffinities.crd.yaml | 62 ++ .../crds/clusterinformations.crd.yaml | 65 ++ .../crds/felixconfigurations.crd.yaml | 565 ++++++++++++ .../crds/globalnetworkpolicies.crd.yaml | 856 ++++++++++++++++++ .../templates/crds/globalnetworksets.crd.yaml | 55 ++ .../templates/crds/hostendpoints.crd.yaml | 109 +++ .../templates/crds/ipamblocks.crd.yaml | 82 ++ .../templates/crds/ipamconfigs.crd.yaml | 57 ++ .../templates/crds/ipamhandles.crd.yaml | 57 ++ .../templates/crds/ippools.crd.yaml | 100 ++ .../templates/crds/networkpolicies.crd.yaml | 838 +++++++++++++++++ .../templates/crds/networksets.crd.yaml | 52 ++ .../templates/daemonset.yaml | 260 ++++++ .../templates/rbac.yaml | 170 ++++ .../templates/serviceaccount.yaml | 6 + .../v3.20.3-build2022011406/values.yaml | 82 ++ index.yaml | 17 + 24 files changed, 3799 insertions(+) create mode 100755 assets/rke2-canal/rke2-canal-v3.20.3-build2022011406.tgz create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/Chart.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/NOTES.txt create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/_helpers.tpl create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/config.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/bgpconfigurations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/bgppeers.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/blockaffinities.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/clusterinformations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/felixconfigurations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/globalnetworkpolicies.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/globalnetworksets.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/hostendpoints.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamblocks.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamconfigs.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamhandles.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ippools.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/networkpolicies.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/networksets.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/daemonset.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/rbac.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/serviceaccount.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/values.yaml diff --git a/assets/rke2-canal/rke2-canal-v3.20.3-build2022011406.tgz b/assets/rke2-canal/rke2-canal-v3.20.3-build2022011406.tgz new file mode 100755 index 0000000000000000000000000000000000000000..8a09be1b2c4cf0b73c9faf449289419edecab597 GIT binary patch literal 27854 zcmYg%V{j%>({`+lZQHhO+qP|MW81cEY_h=}CmY+=#<;(IpSPZRzxi>hyU*2UPF*!K zJ=NWZC>91C zGQr@%EgYG^K*Bo6JJOJ}Bkt@Drnh1bapcU1hzJj(iwpupQd;X4FW%BAcr12>0pBgF zpr9b&SgX|?@ayaA7_xw;BW(Cdkl9*6HL_iqO9^~xqe0MHY znlUila6Qb&0e_{PsN$!-4I|F9JQPZej(+VgC<5Heye;>ByA>lSpt{}+puGpjuSnuEn@kqO#}Mah=YCjXpTpe z8M8u(bYy*8$?{$>D9Z`XKL?Y!-0QsVDp8ZY+5j5Ais*#WX}DVb z?LXGszOMJ7na5}SZDzt;W>a6Cfp^Zpy}kAC*nHq$&VY_e*Y8vI$?R`<2;-TzpupEF z>$guL0ilaoV5T=z*zoM^>XGmG#GCbZoH)NGc`7T3WQsJ4Ep~FKHgPsTnZIZ_dR&uV zLp)(ha@^#bbShr~xjDddfO0|JmU2RTGA#>dRa}L|Vl-cVypmt@cbQj{kiRGQ7SYWu zLEqW+l{_jfgj|9b%v;XZi5aK!AacPX%_hlf&_@CC7;ANRvaO5!r$~Vc2HUVHkbs@t z-BIk^H0*$#2p=E+6L!4$@_2-qqZoy(+mZ!`DG4|Er@A?1I|-2E6%iP1o^ui^ zwY)e);_fU+0-KA?s#w)^jmBm+@?E(|vr35BePRmd6cM-H5Q%8YS?psPoziX6q2xHo zOWD6eOMLaJ{wuu3rhwIieVyc)Xameb*f$Jx4vJg(pkn& zY)tLzAnm>dwrnaEl*J^LRtRl*9r#^UF?B|GC6fj-`yhGW$B*zB!eIPD0`jM>{7S6T z@WXh}rqTK~0rAj6r>^=n6ALXdcHF42uU273=oX;wXR;yHRUjjp>rGVl9#W#vA`XW- zUNtsLY~1h;Xb$3JcXQBsyy@23=KM{y=?Jqz87V-#IbY|BuglQ<3L6jB61!x7E)DOD zo$+^a_zy>Jg;ybC2d}i;RaFc&9!kk$coN33a3!}fn8 zzv(S?NU@&FhWv)O>=T*KwgXE)K*kImK4F!xWscl!=V~*KN+C7PQ9p9OrLWA{gV8q! zPhkDR>cL}qh-Qq|R)FOo+UgZ zfYMnMHc+X!F;LQ-Y@SEfu^=uN>zae}p(r0W)*h~4)22;0xW=&w9_K#>?}PB;UYRrH zZ&%iYA!r_#tMAx}yi03W47%At)*95^7hT8)gaH6s0YIPAeAe;$D)owxJC?5CLS!jh z0RU(>$V|l@BtH`+#Be#?kJ%Chng#LTC8tuG!m34|si*Qun!>uP9S)#6P7rXhk-AAd zumr*WF78@11{lpsj!{!!e)5|+=ah$j$B}2WoXRg`p_HDPkC1)X0owM#EQ^ZE2@-ys zjS_U}o1m$UL4GEJwc{Tmvi7$@#j{={lLgG`=WQ9JS zAK3^kzDh^u@TbmRC)V9&P>#g6fe^;qTob!om5J}|!S+*aZE-hOBHK9c*WCVaE5+OG zdTiL2;`aw?qFHu6A@n&>wu-`d9PC`L9%-Lh^1&KwK8*pgnA0_fzmzJY>$J1(`jB13 zUdrQcD7-NaokAT9IN&Wyg0-C?+LYap_=WWf@jYk{wg8C4mSHY`UOY)ChS7HONp#J0 z8B`#&dpirn^7($73pxJLWn31e^#uK!(qH+e7D) z!w3lf`|Z@fx_Kj)VXgUDsx><#OE(<^tQ2|84GcXM0?YVXU>~-d1-52FPd^u)N=41} zJOU{ShK-vZIl94OC!5h|YqCIu;Avq%r%W62wO=wUH8sH@Ym&)n%>`uHttL^^S;fq3&sbjt62H9+ZvWCp%MXFV@F)~E z^z=t^a6N{O4?T`@#g?kcTd~!7CkK)S&6PK!y|&Y)n%p5Nmh0;zufC4tUhod2U6^3> zq?2TvE|u{*=Y%0uPl^fn){n>rd6v@iU91}#sSYstpU-Cj{%5S&-2D1S?Ja!&y2wv#UNzT&&eXwllNSTD9+zl5 zIJl_ax3{uFRUahvrFS=Zabrn>5ir)L%-W2u+wQRveiJz`-36`Kb z!eZ#|1htW^v}O%FZHXFaTAjX2t_bE)B;wFXRi4U|bKu_?90o!+I5;&`vk)JT3kqYx zJpyU}_#N74jzS2;seck@7v%$myq^z_A9;a6-pzul~B<>VdcXYQt6T{@Q!wWMa#=uREVU3<{&$TaD4WHFl^1w^R`bk8!m-Pv;c&5%CkXd$kc_klc( zz9gUJiZvyr2!kP>aP5is6JsH3aVM4{#dJ1}Bu2uO_EjimV7SHs8q(G(;~k=SI>vG6 z_(jAne-TmzkRa-+az57$NbXc+X;LN95 z!f`J)YDq6fv}YJtHO4iI zYHS(DlnC9VX6A^l@uN>V*dI5Bk+CRkVKlw5%f!Yw62VPB&94CggGGbIdqyh+({0DV+*tNoR$2UGx8T=e8`_Obf}M7zT;d%P%i7{?q>f@f|Rzq0$fDBqbZ z+&q1sIlcr}p0LayU7O@Zzk-u<7N7giw}r=* zRsFrouzG6KmIKw!$X|`Gdv6g`uCi@@VrSa3*=|bmNAB4I#KKrO3-H@hS1%jCSh>>i zLh_9I01_dprG>ETuzK$JfS*6rQry?J~w34EA8_ zuc2^&iZ<}`cYNAR`Mavo_Ve^>v{~7~{bQ?b2aJ2}p$UizC+J`ol*H-4FB8I6SA_ep z#zxHwa`t*SyMw+y0k?y`{^?#Y?F30zMKt#o5gR&6{iMWDCTxW?K z{i6B1Ft!<3EJCMBfZ$Nr5%ss2+#LsTcTmpPZa_M3UR2+Ad;L<{jD@>E(TJ4yF

zDY0Pi>MF?Sz{mW9$P{qO@sY0mR`q89#mzT0CwcB0x8-`6TvNdp$MXS)-Y0*izO~zf zvonLi+dMZ{;I+1blS*0=gRI+0-+q&9bF;y!Zkf`XtgxJ|7Jqrv!Ll>X;ugKoRV4L? zr&D0sdX7#1bl+0l7bYcz0kn9NA6qI;wsXd>BggS@w$Sv5wJK;|1j`*?14KypVc*wp9@~aoFu;3_Q~`ssp*(pr(E1N?BR&lmNm)NL1sOpLSS1Vj5rd<>Sz);H^z+@?i}N(t z$88~k`jmxHG19sngDSc)Mv87N{m%$y|UnV;5(1uYl z<%{T@rVhW8P;4!0V&t45&NQO12|vo^Q1TP8<1I-jXbg?b0RRHGkWl3J@XoO7{=J0S z)*C%yOn5_QI~K?yqF|*7?VRj%A`ZjvXH4LCR5As!*yi6~`5~H6$f&EZ@=@(Bt4x|b zKV2cC#Z)lxd)+kQ*Ttkcp0IVSa7t>Jp@a4%LphY~SS zUo6!o81B` z&gjTT{R@aX?ytxu48lXSfNSh0G`xc~%^7mht1&GcU^opGI<+ZbMR^8*$j{#EbfBzS z3`K~Cq$?};@8BQ~-zL$0oy(#C)IFsOj%tR-uFY=Sfr9DIc8nQE7&B6 zrqw_i;!t-NmgddW-yV68{4SNKKq^OnP#3eOiH>8iA*J87{&uBYBC%zl>a5-sT2?v^ zmxq$u#T}2XjM$15)D@^5`BnPSNhYlk3|?Pfci*4(+w#*HfdzM+Z08&b_Frqt7UreR z4swHP3Ev_TsZmPB(u-b`*7!|#s}lXXhoq@idEgxL{N2;!|-col``I3%WR#ThyNc-vl%=jv6cr@~2JVJJaOz2Qs zsf*#{nfPsI8h+^OXX`>=i z>>j*8xNhuv3kQ6mkH89EetutbAqO;)U#LJ<*D{X`^N;q`-{gb{tmwd$2*V$7JA+vexkB6@_4jBu4c}y%x z9V5}=J(4SK&nN^XoMvq4alsdnRH@1j+B?{)@I0LMJG<~2T&S89Q5-Qc@BrGXQ)QW{ zJyj{|OswQPb~V?V*Q7X_`R1Q6%(SWZLlYu$&)KH=8|ksZWe71U@hq+bzeu5XRjN9t z$9Ybo0IumW4lMl`G(<^y_IV1kRmG=hxXsCOBdZDcyNQNOK_T*?rbBh8o=%NE##_R% zht0&|HNrls%gpyvM87jt%&ro&;iuE`Xmf1qhD6F@hUo+$tZYkk%26i`hgDx)$!2$j znKA9?jlqo6W2+&aG(8yvIg-fIDL@sD@+n2t?<8aU~ z-32!hiA-czxpJV{<~7JK?C}pV4M`Y1hq=QEH@6I(H(J+4_ zckjl^-}5M~xs&0dzt$+d{;FKL^m8|Xnmei&=$>S5Yy&dSQWE(K6b`lg6_ui_E*QL6 zMOGoE!h{sqU@kU@rr~Js2$^+r(Ak3VQB_yvh2Pj-k>;_9^t;4$DXu36<1zo)_hYQD zju5&x08s8j^8x%-7ItXg@@8>AgGw7JVpBM7xkl3~FTp4@ zv-vb!#Qe3=Xse~?lRR@|ke&jap)8QgK}Q2I+715sOXB=3)j$RlGlsGPj@D^c1;Y%5 z0jo*b+5S08$$$8I$Ab|<&KDb#ErSxB^q`Cq+khosrg-{YK_3k~V9#2P1eIC)jJkV& zu7S}n-~|N{^};I;Z?!_udu;-If0spzo^_HGyUWCi!r8gg#v%-vCrmht-c0@67UcD9 z;)fLe5~IkpQ-2KTE1ZIL(eJqGG`pG8xIUgbeNGC+!vXuuNpzQY-S709D|BCk-m5&uYL^p#O9HV+Z$8*KRGq7h_b9-EX8 zWE4IoZhM>nc8AHI)ogq_6d89tUCh*ZC=Y}3TkBprdDun zy=2O#Wc~Ke>nod;h!0m_Wrsn5Ltt~=d9mj{F+SK2sR{L)Qh6EnDT*Jc>xeQ5=QI!U zcw^SO>0q*FS2s|jFIxa<_EP+;4?6Qsf7K4tz*O2Y1OKd6!ywG@0gxR%#s*AMT$Zt8 zP36XbHK!s%O6uZn{^cb25*Tsua{XdW2JaA6uRc8yfN&!PNK|-VvX{J1`k!S~!?6SY zk+PXEe(?7CX!|9iH+Ri81jDFjvBrDCeyZ*YHOuOuHC8|d!yH?RY(%DGd>zqQz05lv zPr&F2J+fne3)X-Q!cLMo-qali1p%$T$?Fx?qA%-m$+Eq={=G3zhc zqJBvl{$w@zm-OW=5F9d$tsV^JcS?`Yp@$l`|2{1T|y+jST zPe<0bO=r5`(P4h*SzolsySAM^nOK(8hYniL@anMSbr3GwpNiUBqK>uZA34C2fd>X8IX=Gi(U%41bm4(b>W`-$B(=_Z)Z#tx$ zzVAs(b$hqEe`KQt{8nJbUYF)lkm4GTvxWz{r;g!6bBE5EhZ2hlB|}9e!n3u;VQFeg z&tn#w3+DUKySMPVZ~a!e(I?#%&TQcLgHI3Vkugn=f*jJboy|16m3{E2ELiy`Db7XE zqvQ^cM?eiV2AuN=WdN}#wUa*GmPOTd1dX%Avg3=t!5gmUP%TGXh&pE`u*}q#l?6#B z_4X0~ep(zbJno%wtou#f&I6j@ysaW+_ub}uB_dr&umT)3)54c0#Z7 zP_|{AAwPk}3(MCDO5-HRi0ywbdymfaWJze?bOtF92M8O$RQgbixuDEd?}vSb1XV8Ke+Fkzj{$? z`?2)cD)*t#Uy%LffyEE*e+o`AHl*h- z55e(70L?j)CBdmL8+U{kEqKN5vS#_yq;7Y4S_7b}NlUN*dI5 zzD1O@hmPB$>JOU}XUm$)^Wk}w<;u^N!_m>CeSyT*L#*Au#bd+MLi(F<9f5ahKz2aeXHb%1)XL=n_ zqX|Z2ReEs1=_rp%a!#gZLjD-m5JKEt9s}TJCC5iPO}lehPZ4oZOFEFJ>S-m`>s)d$D&WgK(K)u7rA@)R5F%Nr~4- zj==;e(UD|XBAyQ_`bk>W8!A8EqqHWV&>9{f=c|Q9wc7YduA{GtGW~Z>^0*H8d~^|{ z83ZAf@=X!O-BHUA-g74@*%^dLZa^iN*{5CxZSH-@x zb1aF7Os^Nym=u#NHJBIA$)5Y&^cm7BYoKJ@FQzRcDCxBkmruvo1imZ=PY(v!Q+1&FbJ6cD7gMc0*a+sCk6mxPM5KLR` z-VQ&fiq6}+Pt}7wgRLO%HoW#!s9Ru37XcE8$;h%LSqInHul0f)-Hu2%o4G+Y2WjQp zo}8WRT3Q zw3PJQv^jF%h0Vhq0DVLLgVk_Ze##@?LptmNGw0;zzK*I3j)%s!Tl^nxtye$Dh!QONkgh4-P`HGvb2IX$z>(e+6}L>g~-487Z_>c;?KRb z?9AOOrtKM<8pSI_u)k?9ed_nH$jawRYaGN?kEz#H9}2+AGNyw#(w|da%7Y3|)al{BQcr5`cT%;qUi9M7D#2NjR3X!_?pcZJ%b+&T;8M%O&7i;F zCVRB47h9H@IOELA9#&<*0-Vuvd8U%(+-+~$PUKzxH5mVuUcBJ&)H-i+|F7)S8)-RE zNISmvO%zR+XENYTb9P|2SLEeiM<#b54w?y#zu9 zUMx2>&rJ0m4-`T>#rkK`%^9B`-Wp_WOjHu0$fO=+Mn7Ls0jjYi1MXO2gR{c5ib~MN z?jqKd7f>MHaov^u0?vExvi?WNh}AxJ?=A!Q;i-dDJu*BtZi+1&WRr%1%>;S(Fs|X_ zFJ?#;e}x@ryuYRrsjKlfIMZt#@9|QcRSwtW?=>2HAU~wnc=loOQh*k3a6Q3$*zBV! zEFM^4YHS$w0!(vZhM*NCu{0+S=BnKaH5spImN=utbSCEeaM%O&@W-JvehJh+-yrDP zlj3sLmo7A#DqWksZjZqDE~APoAaA56SvK>a*!|Bsq4Y^J-7`rz!Q6I=PRTjO;qtV( z$iOhfwsk-|B9!!Bvyw>o|Gz5WHIofi~+{Cp+BLcW9@CqM0iRz9#4eWJYg zdI*^Qyo4RC&cnCBci{tLP@i~?v5t`bk1~V{ki(%G|1D#Lo;}p=-9}|8W&4tyluK2% zdG{6Y(FQB_E)VCD`Dsd-3-*4VNe0(Ho-d!62+hmUZgh;`jP=|K)1yn;`}Hs`O#~Zg zM@;fJ!I%ET&kVl>D4&y zs`hg(9{5-HOLZ=P8>FWh>@yOo4;LmjpkUc^ncG)WWdM3;m!y+R#XcedYXb2)ztnPG zeJL@WM9)m5N2)lF@UBp&05DkK@miK?$^wr&20x;_std)F8earSjR|zDM;AAqx0NWf zb}5_ukQxQgJC6^J-t${;(eb$r`;az{lb27d#t^`rk{oFK|3w*3q^;r{>rjhT(_XT) zt@Q#;gTq*P>xHE^s*RgojB9sA|>p@go7CZ3Riy1DXr2Pl>Bl2 z?H<%^;!}pej@c;v}COsq!K3Fudk0vpPbJ zEnpW`3t{eLBchsk!tE$B%Q8^4$*O9QQS3`M&p7|Mr$Y`rD09(-zxp)eam6zteWY4jyBGrOg{MS?KSdR#YxkiV6gdPIL|e z%QYIB7(Xp!yM^r(%s%mtW;7Uy!{9_CI<5dpPLsQC72Km+d@7`m-b0XFWB4TL`X<#d zSgg<<(V|~6`r^)I>^UyOaMk(~JOuM`sZ^@#dN*I(Sd>UlXL^XAFGE89KW8HC#uuGpOc-zk9j6$Av{3LGKU2emecm4I9n;*XHPr&NrdDpos9yl0HR7f%)R28Vw2aVZFiUeP6l1|7a!l0z7mICTm3W&^OSKzT(9qZ;w+rx*$jw&B`y*T1m)W z`ZJE9`#dw9IhR{%fj3(=*(nYE^!)yXB@GGr+>j$JmkJXK{UcpnS?}|owTZGLgC}X@ zfha(>gG?lTRoNahNlnFuKC=x{Cy0g@`W5jM70r@gpE^=PoO@jGBZjz*moG&o8+}q> z1Kcgfolus*rIAr-)(}N( zB`tf!pXb_74TiV2cX4R8(d=Zk>0#Q>K)$GD8rcnMkmsiy)`uy{W>K-ElN{W_P&6jX zmEAr_fQ#$(-{I~%%GZ9I6Q*;ITa`DS4TwXB;1UQ*t#vFGCq-HYBiIY!98U& zG;&XZdCoE8;G$aQ9ygLNOS;YRcMR(6?i9k?9!RjhoCQsWhFQ0YD*Sb0ad*#8LI6pn5;*ESm3{#29jy;D@GE7s6 zu`hq;oBZB)&k>q!}Lov@Gwhb$+?|o^U%rnb)swQBq^#|)Y+MuRbT!>`6WtW8z^aG6y#Ng5zTU$leg!+bMPq=KQH9PaSZIf+)z*3pDZkpqZ zWOIpqQj@`ClnTQ$mOJZJ{#0-X&zvS&#*e%n)YAXVF~!NxO`G&M7gPDOkWyngh?mlt zK!mOe|2?cOjWkThTLTwcefgZgfS?K)-O#ve51)T|$)&NI8M@Qp(+7s^tDBg`|p|~-lV_X0?6#;pd|73$iK56g5iw6qGlFy!TB=h8$n-I zGolr!uKSZ&@l1015z;V($n3%}J(+y~3={0&HvN54AA%l6(>5|?0Cx%;4jv*N&Jfy@ zPoHZ=6ELz&y98nE6a&T7<_(Lwk?3L4wD+rnBVR8rL&R2JCe(S?_wa>*BS~q4;fNRY z(j1dy=}zv>G-1=&|Z2f(~UbGq5(P$>$B0f~%iI0E@Mn zReih^F4vk#0*%nv>SIXx261I7UPEJ4BkAo62I2HqiitE~I}W+nE5t{B6nPc-YUDFN zNeZ2&&GEPf%ZD3Exb)Fkz^Cn z*h`-BPIv^tj$Mkv90r`I<8p`bQU<1J7n^p9`n%(JT77+`;N8!Yu~uk$7y}@r!Yt=B za9uh3S+IC!+44FQFWgAPrpid?69W+N(PjO5RT=wuJGi7Fs`Z~2d3aj-FsjN>$qmwXSZvMOPx$^ItBXKWx&)3|#f zm~;|DVQdnlDrulb4y~{J9z(q&+XnkL4bEQEnEs~wHyI-vIvMmkKUcMHoDc>*Rqf(% zeT|G^c|{chbhd*(%056TVSF^sCVophj5&-yi00T$?=)mT=`1v{nlW+tX|Q^y729-a zi)jn!>!ee`tLb2dxp;DdU1S;<)MG*Sabqnd?clJ_sPp;B9;N;^D<88vZuN~Yma}H2 zA5pgQuiv1B|lsu|9*4USvlNZbSEJ=~>B)O0S(Ap==16o4~*=Pse2c2E_JAA08q;iyZ=Qe}<DX>`jzH+8%8nM$2+t@KMf5YGe{>DJCn1lZOF>OaZ6U>t3vRi zt;gO7e|xBb=SPV^7(##OK?N&sb7muKPrD-+)Pbz3nC2Rt*L+ScW8q8ev68`EC?F3f zU_=L%OF}ta2^3W~?^$*}_D4uVdQ?h`5(5lwLQha|q3^%UM>YB;nr(rmKQ=9fqRZLd zHgd40PR#grGovJkvKJ(CeE=zqxP)SJpdXOn5V|pe0f*tr_U@O}ly-W${yPRbLP@xHCw)s^7xpVts3jIjquKPd(U@T)3vWT?YQ{b_q^~FS3{%rGh~F>xWqS0ZIX*bv~Wse_?m3W1XYT(`FS5dH5qq zraS;`vr^Z9u*GZ0HwraaQr6b^fRn#$c)A$dn;@GCTYgEDKNCDPi*6LTEJRb9Jw~dc zdc*GR6%WyKc9OW|Cj_Q>0|CGTReSuC^c2A-cAm;+>Qr7Ebg7~L+?K?_-o#>A!FVe} ztJpuB9ZSyvs)H#sUpCUYWAYKVw)q4caDTv}(As!yg&>2o5zK z+*Fi6w9w6{G^(vu40JsXGk!&C%8I7Ezxq^>?t+xK^r)&mo%N53P*<5g1#k)Fq$DVa z6Rx86We$pOJ*%$F|4$`@jzcdd$DayTn!@_joV2+}m@bY=Z6 zbNUU~-;^d$tU0125coCi)1hBBqlxj)w3`?1&r^#6b~kbDUT08VP+8Cc=8vf{_|3S$ z-ahgxkZwr@{pVg=xMG3EqkhIk{dP~?TFs+bxHV#wfeofz8ij4@Yx&z>R0=&PcuUnD zzqch&oy00PRt*-Lc=LOj!!MwySK=u&xcW73%E>hGkm>r{<$Dd&9MlHVm6X#cl-SJ- z-5|^0QeQ73nEwhUkrcmgwM`8tz}lm_>-jyu*Ti7cuhjVakr6i&#QEbZYU}F^x>dYz zmT~+gBvI?8(&Zy+72grKUOm+VWgA)2GI$;%*|308Rtwp<_Z^S!P7OBRtGeAKL22ro zE|JgP8nC$yH|nXy&{K(QiLpM6fe%I;YB!R*yR~F>*>tn#I<4q42g*D824$&yksJ6+ zpJh=fIr$cNH}Z605V`m23)AIc^~AyFm8y)Gx|(r{HPuM@sZ5}sNI3ci#&GqMG?=Q< zH^tg(A71cY%_CU+nX2@N7^B_LoDU3z+{4V3*FHMX%J(h=>36>mX_sBNq+%$;enm!M z4>G+rlzj%h!^8fa!XNm;=k~@%;Q}({a77Li3Iw*L73at2O8`I zW~Dl^k)nN_=j~HW-zIPOA+j6IN0v(mH4%A*xSn)OQcGpau=>ciy`Q74W;>YF=BJG~ z>C>BMT&Vhpg!@%nLphj+A4dl{Z@$|gM1^J5Ym)eK(VFgCT?|nYVcdrz(_3mqTSp!(m3c8^A2}yTV;I~Dc)d8YgA>} z{bP3xPkaop85zFQa0{_MfuTjj)>NRzr7^aP8#&p<(Rs z>Sy*a_Z|kZRF8;gH9`rcAX@H+MELXR0!39oKZ0+zf${X|xN3iclFh6o9v>vIZ-6k} z@Dz>W zn_`4Cg=lqVv@^00+4;cUqCwE_%i`^WRR`wnJQrfe;zXKd3j`c=qOD^|{%=ZkO9v@_ zS+3rXS*6_sPLCK6xFzme+T&uvO0q243Xvq1c>?U_D&+-ralArXk^+~RUu@NSp3YN! z@?9oUHkQ)mBbbj^@v_4T$a9P~kGZ(7a5ObTpxWX|Z*D)jVNox2noI%UU8bVAEws^7 z@aAdQm@^QG*1cwk*2F65vrF<9iy`oI3s)DcQupC>o>HmC&npiiHG9j2S!dd)lvA>g zd)Xb&Zvw$EF>5-7lR_V7TN^vPqaBQu0OGud`6<|rT-m&=vj$u zo77z`{Gi9~Uj~VNOina?SMRLKk%Z+rqxF~CX<3E{eu_nsDrKh!ROU8vH)fod(oVL; zOexj>_<(=|%>j`oT8k_`zLLb-@xt5Tc~Z`CWo2}SyEf2G&t&`&>u|bEdY(weV*DDj6r^kFyvgo;nIG~R%U`!g~edPl3wwMKi{Io{m z^mHBiuk9Yn28db1=0YW&_YRs=XPo8kN@Ex{lYUg zud9H;_npV-Z<9Iqx7AO`?*I>9haiV56khL91TiI6>eqjrmGzn0B!|Y%ub)1pf?sa? zt&Y;xF-qH{I^^uz#JaTl@>RT+Skx;UF8>BdS&tA^gCh0Op?|}F_3v|2q#ogFMrGQ* zGDhW^A8GH`D7F6)F2KtFGx5)6n{AIpjp6+t_2Ol4^q>FN`TtG-L;m5kX@HiQ7&%aTRb?PhD z$#rg(>)rfk3)@ToD^+uBKkibuTmCO3pyz*fc6_4iHiI^%@O|mYwLIi+-g2m!}IZk-Gm9_Fr3#Maw^~_WqZvT_B=Yi0V`2|GE4R-Rb3e zJ41>@JG;-l0iiqS<#+g5E)6QS!m_811^_*JiIt5%O?i8U!m4K+cHUN-ZCi96fb=!q zHn6|>qvQic{>=fQ)hvW1f)(?abFa&Ay#iv(PlHvy` z+QS8gZ>bX!Tr;iqvXCnKf!K$ttK8%S73<}~wA7|L&6EkgaLfxp9x3elt`IPL>+juN zpmdi>3?)}F-D@QLK&yAIrMe4)M4@nAiB_z!5E{*7R!y$q!WR+e4dHtyJkp1sVye@E z&??)t|3Q~WLvcJ8_Nz%K#D3vXh19~6eH<|M3K%&`^2UW|r9SK5CcmE-Bk(O68hATP zje6FV6`N0lg-{CJv*j;1?_mu^65PWxQxym%;NQglNfYO0057HhyNX&71OfrK?Y*1s ztI89ic{Dx*{C<`CtaNbWNS%TwZ79jZGmdRmDf%7sReR26(;FD-RJgH|0OnwrZ`Nw-xbl_4h zH4Qvk^QbiL_K488f}{L8$=hgQm^W@K&)*m5mhjqI_mYT}s!JTMqr!$zq5ww9DTRev ziVm~#A?4<0K`=W>AD5jO;=3+S4b8qreVb_Hx2E4xyu)?3-y9j1oaARAo?(W-1w9&GB7IYdau^!LI&t<-5ry&u|cONst-_M3fJLZ_&j8*qasb3;$V=OrO^ zg>I-}E^BilXmUV9+C(C zrm__mH3SUP;WlmCP`8jTTr z-VMjl#Vb2XY}0GZqkwVG?Ft{nDpK73NPVW>p@wS4)26oq#FcV&G>8(q-)&&LOzI+v z2Z*|Xi4yDe{X(M9vJZ&TtfdPLSY;ZQd5qP9o2nC$gyJ-W4Cd+9JVWmvw+OSTEzrx$ z%NR(&^Z9099cBty_kxIkPk@^j_z}0;Iy%}{HwGoBHE$-uO~AoQQr#!J&>VH?k8j@_jPC?JhON0Gr59F7*cp1D|dL-0SQ2I9@j zcylJ1fb86p>}}rByx)SYlzD#9-iqY+46@0WYWdhrxsuT+W{2yW%P82vJ0q||*@frK2}YG#MKBee_yVP_Z&4J>WW6)P*St5sj%5)uyOIKk^)U)c|1QnYZ#tNaDkvfxY z$@Rr@6ROh%J2rO!N6b&|2!hz_6MyMBW`4HZ^2Q$Y3t?;sj`73?+z`odF6Ce<%->~O zAS&R(#wHBxWqoc>kilsEggs2YDp?UiekwuGUj9su8>P3E2{8l34fc)F@orZaHOG6Q z7>le^?}QA1}^CbwjAWraMQKgk-hNqKanWddLU5Hdu!*SFvUEVCQKaW9sUQ11JRH1rn_(L?@02bUm%9?h6ET;;QVQ9b@41 zl4hOx<=Xxvjf*=<${{E#We?8Px=T(%a}`lb%axht_&^G}<7o8QHbZYae?t21B2S0+ zVD)UQ^{tXH;}DX4tPm!V?$7kiHJ;YtTso5S_ELP(P1uIigSRN}y|5*_X;>pHdDf>G z=ruIl<%Lc1)7IHO&_p3aRvY2?i%(NBh=> zo_`EZ3>&?c3;9aR=-to5_p4{jqBW@dJbGYvMWdWNH(a1H|mDiv@EjMNYwIwR2Ag(a&dnY7VzG$u*V>ftS>(YuH8+ZOJz=nYGUpc zw-}4ieVNP^lPT=HFZaFZM$okBywxHve(+XtA{tBu)c)YfqKHMX3`RBlyt8PFSSsYy zg;rXZC;$=Q5%G0ZiA&ZecWgg@mZOx?=_>5-^w!j3B2fQ?jQ99z%6QnW$a zwkTS!rv5|RajlQbEyvJhACrEbr?y&VqH+gpd*gh}B<;Ap=j;m+N7t_wzhqx)G2!&T z@VM$o$6fnN>I=QTW_sFS>=vvl4APzER(q7`k{QjR3>@1pOoohly>^Sq#PO1&!ChG< zIYLX>^{sDcS5wWj@oH;#4934~^KOhs&krc3gN$~Bv~NR$Od#`Wtz0|N z1S=q}QSYy)lnLV?I-8au+L1=G$n~1Awi}{dQ-y50A&oG=tBRzCvsV>z^1quB$J9aO zFxmawob*#~xWn;RUd5~!1mP|&Nhc;Y zR%DNua=l6N44pyQAS2m^ByM@b{N|^}2t2t2W1;sLXshBSu*_fZ4QC^^2u^Ut2sDKI z7LW*bM0&Tcg!L_9O$39p)k(^Rt?#vZG9)IZl`T;$8}HVtgzD5qCo8VIk{QzgAh#`KTMr<`5<-Xl75tNr2j~na$gG>hlZ0%8 z64)ikUTqlGsNs-+J*+cOF||}&rP;Il9MGN&UA2BXz%t~ZqLd_)cS5M7i)T9dj#n%x z=IvQ|46sEYfT-#TbS5Bhve*4F|8IUhWIkX;@KYV|)`q+K;)xvU_wrKI#_zlS4RTj<74gu_d==`X8D9zs5+o3bQgR7Z{Za!zfI z1l9PtI(>R^>l1Ie1yC*c+P+^tHxyvJUoIQ`eZj4J7KmZaNdr}UJ=nbg2nbJszoY0u zJqvJTfPpw}yIfxNhCwc`n|2u>5%^kYka`~Zegi!SW_+HerJ;=59lgs$;r9!17u`(9 zZ38`9kL>ue`(Q8&RXd2!(GZkY5(OG7l;K}~Hu8Dhd~f(!U;>KiFEAqjJ(6b+?}Jc{ z_-QZIzwR5|_>dm2-Inv_yfOD&eypCjcOiNmJ#|J;oj!GLvgDY_zYXzb+q^PGUxb5< z&^O)9rP)9*=97+5%!nqf*m+vFWs>y5Y)Q-Z)ThQQWM=&6nQ?npL8oIMUvGSTAd#+h zNgBfHtNMariJ;un6hn*Sc1&CGF4;in!Y4m-flbW0L>k6|8#<0?#W2i<&!#2=I$)+3 zh#oyQgHX4TW>%&hUZye3K;l*rgtX6GYDA2XPjcdiw~!-it`e&F>C}61?B3((wwTEj z*b>U+S$*ZqyQbamG>xu^8lvsiij#5{tsOJ<>(s$v!8QnXSys9inL%Hf+feE1POouN zZfjdOdV8``$-O64G^a-1RT9r48T@$*@>-LVTy#W2=bvF$MEXdpyS}Z7 z8Qe3?6E3UzfqS>bZWZXx+@RVb*?+}!%+>SI4w*6lwXnOSl30B7w;tCYh?UwuhiVNWHx0~ScF z?uBJNsS?BMzju5e2cfe%MX-*PxMzicQeaB_v6HJU1LBz;`&R$8)T0H5ipk6x+L`?K zoeD~PgW5@4Tr-%~@PP(@z2~&LWXX8c0W+;Aw7D^gTdq9Sem*FhRcu#*FI!D=#C-J8!KpSVNjd%zg> zEzZ3k$(}dw$M3vGsD*CwTtJf>?MiQv2fYPcg&kH=eJvH=7dK#^oZiwg0$?B5mprE( z%Vh~Eiw!j-0w)?eS%Yy-imi$wwxtCxgjrS)d#pEU2@TgENtR^D-7p@L+Ky%=CY(?I zb?3A#POcVL0R8iXbGAPDh*sG}kw@UZd*)

}63J{orlQ-b#QHwzMWfA3Ib889swg zkDqz6BJ}*6iEZs!*;Is|EZr)S35L572@C|QJ)SBw7nX7*A!HdUvFvCjy@-K09#Fgb zc7rm_5Z!mmu#(4hwj=hSn4>X2+NrbB75{9m%$h1+Aqy9c2wLJNz6se5dv#I zydwaTMxPWztcp-QA6(r^=;vVML8Vq*cJmje#!ayCe)LMr!9lp-JL%KD8`MEU`~>wl zKnAchE3zRRt-_Q~Ll~yA-gZh~q{dhZNRhmf))Tglh-lp48H!YKVxxguM=~YxJU27Z zkv)nlC^8;>7n?pTdmlaa-QFMAP{o%lhMQtFi>wH)tj1UkQQRa?7KC;)dTiNbwAZ+k zRNg?f*75*1TJsfdUTL3awIzcchtYmi4B~yk_ANa^t82GjpID(|QE8rQ+ZR3Q5v7zqpWA$uDvYCQ{x4JID*)u=++ z1%La=&EH95+tC2A?DRKlEhY{quB2_i2@^?k*h!Ww5V%>lVPskAxk>e(IG+rmmE+~A za3rg&-)Xg_L~GaxR;EWprpSK;Zm>*N6YciVznJ_+p9tT%5G>EFudTo#WU5xn$x!23 zV)mB}u(g^J%YW0d1Y$fdn9v5t#q{s@(4M*(Q0ZE92XBxX(>#h=9U3K%bdriZ8`o=)TAN*MKra6O2Ef76Z7! z7Jcb^yEA?d*u>Cs=?LCV?G-B;%grg9o|EwvJ)Nz@ss}iYNxJE zFH&pTJoluvD(Dl%crEe2dX{bN{%m`nA%+dDxj-+3eS|Cp9m@zT*EK)5=ke=(4kJvNKYuJ^V`t>(ea$lZ62`ULMdLyDQ<7N|Tus z_=tM!SfSsdjWRmyPAh7_8g$DaRdxK-3J7oM@->q=lZXJ=@FhW7Qk*#2?3p#M1b_3ETuUi`A=B{0qWDY0_`y}yCI84`xDwRuzLLd(Ho zwDR@kv<}>4Zv5M3_j;VoJ5ICR`eaoR;e6IlDdY(HK6aq&l06pe$7?a;pt{PFI>|gx zC<&(#d^ETW8{5fXw7I*zonU9xr!raoQD`jl-q7iM){7QpfbBm4Bzgyu@T1wM0Ygc> z?+BF_trn0{@aUbbH2??!K{CYLrT=AGT0Lr#ycn={2%Awg`A(44c}54|Ta9k$Wiv)7 z=b(BWUpMW!KCK#S;lhA4L84@`Qp5k1wAz~ZbyM)JpE4BEnh36`*3T|@1blc_=BOd4 zWOh3%5=+nqOiJJpUHAIr4Md0UJFZqtJz%;fw`p(}Wq1?XO-f+F?@Ud2zO#zZU^J(8 zo2$Uv2DmF4i8_GI*!kDQ=ELLri3NVH$rzJ$-CxA4JTgYEPDPc_u9^6zyb%*bY0ag@Ogn zBu;2wDdQPB6_hzdI!%X4x{WG%ptbMe9HiaY?^X?rMz{6)Ad!Q=a7(WC1Gl7>x)d8f z$#5sPX#x~^qn#-W>&$FOom+dFtvY|?N>zwxx=}j239qjBX1N8#n%>cty|(`sYE2Yr zTw4e<+rJthv97K0rs&9JvE(@HcF@Vy$ zd%A1nYR+q-_=I8XS`Ch*#Dg{gc3n^c+>T6~-tV1?Iqz*(IB)3R+7*~@y!*||4qnB4 z$3J|kY4<;nD%ii{FT(oZln;1$ogE}}{u^oBrT&Jl`&Cl4{}8W#?y@X@kk{4UkDI#$ zgnT?7IQ!qQr^*Jc8p?m_|BKeY-`Ia}>;Fl#g2_g$;_15^Y_yK-eM-oiktaU;OfVhO zQ_))I=%+`7ly*}!Rd*nMcDFE9NYGw4Fh7R7!k;dL5)exK3Q2h$BI4p8HGy6)8qwF$E+Yag9>{R14sfa zr@GtSe1ki|l#D5ucH{|SCJDoqF`IPeMq0A>s@gpbAqslTx2jgXA z9?uJhqoKWGcb7#qd9>95QDh#kGDrU)+1Yz8LPAOQoGYd z(gx8;iF}>`lqoVKYtXJ=@SYsO&YH*4Ejs*C8F(CO8Y#+JZf=~~$JH$i+C(kq2VY5_ zNkzIrY|#{OF(c~B*&5lXt23!e<7))Gl7?v}kBE(mhAQ;Jq{TDqW8N8jekOwuiy}NKs=Kk{DgJQQId=p?@sUc;;A%vc zJcZiH1q|UrDLqkp9&_p=*=Q0SjV*3SD>SmrA+d{-aV& zj2|l1CUCy(7+6)x=BI0t%ivl7#l4R^IqLU1&y40u=o{F5PmtD(h(p!$=BEL*1Bay; z&mrqJBq>Ut@M$xp3$^nukWLMvi%%zOxT1IlZ4A9)Vl+N^e-dvIyDxknt`ZT(GQH

dn|RBzx1O{u;7Pnt4N z`ZrA>9QG5r{Q^41w3~$d424fW!$~$(&@p9Hs@p(6GAT>@(=R#L4=tMz5>?mT-3{7V zW_<#E2-OWJCYy*Cbh5SFJN8yk@KKm5p?6MnLB#9zfUyiX8w}3Y#w-7|0@|xf#(Ko_ z_^a}Ik%4Y2H5S%3`9r2M>1qBYQ=xyiQGUo2AKjBB)%=|Zh6!E!-!j#z_Ai+_`VW~( z{zs-7NwS$y^XO3&qllpQaWsd#+VdB|4R(pk_sMz~DwgLKM5>(w?Z335AU%Zh;>LfMj8Q_?(B3r_Hh z7-uG8%dLq=*Jt&oLh;8k`R?T*@ZYK^o7{k4md)dB_6Di-GPG+VrMU9P0aT_EByFX4 zhd!elT5y38VZ6b6qCj^$yV0oOZOLK_hE~lp|E%;FC(@*ih~-RjuXK4B6){#@4P(c_ z2lF8qCKvF<9;T>nHRRKK+pTP^wly%-k2*@jN(6NAYk193i0O^lgMaEMLjuY^U+jmp zuR$O%F;HYXd}yY{mhpTu zG1OfE#-q%ez-V+=89LHqw;5TZy4;i|6ld;^j ztxT6_ii1-gdsh8LVRuYV%B@bAQaomPY0Fo=@Tv;~9M_J3NNX-Dpnms9Pv38J=TZf@^pbPR!c$IHO;-a#iXky2 z}V9i)+nM-j6jsODG<2o+3hRjlj&nm7B>zvTb4WsV7p>0o7An`d4PJIx8n%M0uJ#PWwZ8o$MILwpZG zf8wXxjX63#Zr|^PvMY2SV=&+|BH;rFT-H+^14+&qES6L`b3l1~(tSS5=^e56)T2dT z2L6P_GvN$XFMS+9fJSD2aw0<_94s}uf=g}u2`*i?DWF#qKr{CNch^6?NJHlTRLcY&Vh0gLJjTG;7NYy{6(dK1_ zfO`lM=}(&X9254Ta4NEh^M3yPu_KrsatDsIgglEnq498RBPmw^{zexmty3$~jB5z{ z3$-s6lQ7wR(FRg# z3}o!%Ntaxw&pmEez2WuZE9_dyP7P3K@_C*}qP93qJ6XR1jbqNeT70p_fMU}eUS^i5 znwzn0VR}4Y;hP(+3xC(NZW!mPeP@J|&KC^5*+V+ntvwpSd0ni83a5kvcO1+b(J80x zUJ8Wl;KoAy9RJIKt6^rHYvZV0#Bcq)6x=#q)d^go(q{ln7Nu5dR0C$|-$GNT6P>^3 zbltn#kcveJe&bW^QA+>Hj?S7B>x1(b6LD|Y)|8d6)(=WN=J{EM)BQZI+nUfT%I4LDm%LoQl<0bGk|M2bLkmnP9<7t|4WxNvow8;-CRtrvQknU zd&z_HH)n4c&T<}~qpuEU^rqHz;P zq3RUG20?v>#dnS!QyX!(wKc%#c~2fB8=v7|OV&Z=F6|!N7C#89H-#^E)p}M@!iJcp z-%#%jmI>le;rNtP`vXB&aqvEePWn23e-;BYSLRoGCOQ0ewU8wv?&9y6_Y!{Td(_zm zEOJ_IJNwmEuH+zSwDh)>_Q@I&JrW0a$EAZN05@QFO$o~}RJCKUHU5#r3Z5L%jihL4 znOr(z)Gcr_@Km`*Wl_dW5o?b0$BAXEr`y01cm(>a-j5$iW)m*;Z+P!5@A~sN3}th) zWsG;~ZaPuyCOml&4^ILeJkFvArR2ZPPz|u8b6>oFuQkYW3V zU{@Z@uA-5O=lHQ3C?w0zV<%+6)|RzQbXK(F%(pyfFba3?N z#&TDjn^_DrM;1lo1uSxW71Bwi*f5n3mIH;#@8m+}mAF7<0o&fuEV&Dt%gOAi3mdzW zJ2SnXxwOH7pD*|QVC?A&u1aT<@qK$*Xd^Cmtd(gSw{JkU&OM>&KLgUBlbusPa5va?J3BU|U}h;&th69Cwy@ ze_$2<_9t|Om9uL8XWftJt8D^VJ9(2`mgvmb#AfA&DQ}zjCBtS{#TqKjF0Q|uu2arx zv4`~>RqohDbk&UKb?4re9|QfZ4|9?fHZN}aQDVrJ#gb2~t16}byV)-13HaERAT#Q~ zke2w05psc4Hgj~t@Y;@rISvt*4Vh3oBq`j<$C@#kA0pjAj6sv-0-H&lz?C@TV3~=4 zJMNGL{E(Fe#)f8D@CsDv?#l zFZ;u|y9WEQ@KDkw0|*Vf9>cvMh$OXGH4ru-A7`qCB8`r77wRHIupiM^_ylPQH8XV5+2YLj$+#0i-~_9V zkXa!S+?F4{0&KSGNZoajD#>GBj6|x3Gij{IgQ#Cjn<&P#ded0#p@B3kbD1a=4f%hH znMg@eYz4XIAovy*Q06t~jRRFIbfzwGlDp__?y8p36D-h3u|^j@B^H#F7=8oEs$UD# zU9fgU-sgCSy&Y1&1)lai=i~rhk8O(HZ_lUH)fw+|0K+ccZzV}igUis4d(Xsy4e&CP z5b>17jV5bqR+NMHyo42ui1fb+8E#G z1IRFYeuKd6&DvEGP`69?wx!Ppk-j|Z<SDb`(WM1f7-!Evt})c3 zxSXpDPs5+k;=WkRKNaNb->TgBg87BP9SSrN@?d5Xat5i)Kd7s1e6HkI%M)aIy@lM1 zrd=i8n$Nxp9C{x3VQ&p~%qRW>-_6o$ryPo@&!VpqLn<^fsR1=pr*nncwC|Vvj)se< z#w^mx_7U5A+-2BedfJ}3eh)y$1HMmmmf5({&(l|sDKRE`IlPocw`xFRNk1ciDNcMY z;w+MTFUDvYVpZM4#idf`1uSpLT^P(>$&|7sLJIH`ih2yuCc)STU8dDiTbEcj0id|hlU&6@ z!G-fj{D8)t>@bD^!J^L{F$q8yr3m1T{h{s{VPL;&F=-mP$6-&5ODBY>GV80Nt-1EY zHa`@VP<@MzLlNWqyE4+JsINm1Z-CAp@B*dq^8=Pm9n60U4QKI+&62_w+-q7X=?>b* zp~H%IX)ulF?2V|Yg#^)Bhg5o*3rH0BN z(kfw}**xBoXt#tiLMmO55sHq%bf_CH9BLQqMZgtcYe9KV<3T8yQ&K(ILJdacmx_1agkt;`YHQDK1(c(4$V(?-p~rsibhr zZR=Zk`q literal 0 HcmV?d00001 diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/Chart.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/Chart.yaml new file mode 100755 index 0000000..39d0f5b --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +appVersion: v3.20.3 +description: Install Canal Network Plugin. +home: https://www.projectcalico.org/ +keywords: +- canal +maintainers: +- email: charts@rancher.com + name: Rancher Labs +name: rke2-canal +sources: +- https://github.com/rancher/rke2-charts +version: v3.20.3-build2022011406 diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/NOTES.txt b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/NOTES.txt new file mode 100755 index 0000000..12a30ff --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/NOTES.txt @@ -0,0 +1,3 @@ +Canal network plugin has been installed. + +NOTE: It may take few minutes until Canal image install CNI files and node become in ready state. diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/_helpers.tpl b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/_helpers.tpl new file mode 100755 index 0000000..b647c75 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/_helpers.tpl @@ -0,0 +1,7 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/config.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/config.yaml new file mode 100755 index 0000000..02e0ac7 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/config.yaml @@ -0,0 +1,84 @@ +--- +# Source: calico/templates/calico-config.yaml +# This ConfigMap is used to configure a self-hosted Canal installation. +kind: ConfigMap +apiVersion: v1 +metadata: + name: {{ .Release.Name }}-config + namespace: kube-system +data: + # Typha is disabled. + typha_service_name: {{ .Values.calico.typhaServiceName | quote }} + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + canal_iface: {{ .Values.flannel.iface | quote }} + + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: {{ .Values.calico.masquerade | quote }} + + # Configure the MTU to use + veth_mtu: {{ .Values.calico.vethuMTU | quote }} + + # The CNI network configuration to install on each node. The special + # values in this config will be automatically populated. + cni_network_config: |- + { + "name": "k8s-pod-network", + "cniVersion": "0.3.1", + "plugins": [ + { + "type": "calico", + "log_level": "info", + "datastore_type": "kubernetes", + "nodename": "__KUBERNETES_NODE_NAME__", + "mtu": __CNI_MTU__, + "ipam": { + "type": "host-local", + "ranges": [ + [ + { + "subnet": "usePodCidr" + } +{{- if coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 }} + ], + [ + { + "subnet": "usePodCidrIPv6" + } +{{- end }} + ] + ] + }, + "policy": { + "type": "k8s" + }, + "kubernetes": { + "kubeconfig": "__KUBECONFIG_FILEPATH__" + } + }, + { + "type": "portmap", + "snat": true, + "capabilities": {"portMappings": true} + }, + { + "type": "bandwidth", + "capabilities": {"bandwidth": true} + } + ] + } + + # Flannel network configuration. Mounted into the flannel container. + net-conf.json: | + { + "Network": {{ coalesce .Values.global.clusterCIDRv4 .Values.podCidr | quote }}, +{{- if coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 }} + "IPv6Network": {{ coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 | quote }}, + "EnableIPv6": true, +{{- end }} + "Backend": { + "Type": {{ .Values.flannel.backend | quote }} + } + } diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/bgpconfigurations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/bgpconfigurations.crd.yaml new file mode 100755 index 0000000..589c3a2 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/bgpconfigurations.crd.yaml @@ -0,0 +1,144 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_bgpconfigurations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgpconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPConfiguration + listKind: BGPConfigurationList + plural: bgpconfigurations + singular: bgpconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: BGPConfiguration contains the configuration for any BGP routing. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPConfigurationSpec contains the values of the BGP configuration. + properties: + asNumber: + description: 'ASNumber is the default AS number used by a node. [Default: + 64512]' + format: int32 + type: integer + communities: + description: Communities is a list of BGP community values and their + arbitrary names for tagging routes. + items: + description: Community contains standard or large community value + and its name. + properties: + name: + description: Name given to community value. + type: string + value: + description: Value must be of format `aa:nn` or `aa:nn:mm`. + For standard community use `aa:nn` format, where `aa` and + `nn` are 16 bit number. For large community use `aa:nn:mm` + format, where `aa`, `nn` and `mm` are 32 bit number. Where, + `aa` is an AS Number, `nn` and `mm` are per-AS identifier. + pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$ + type: string + type: object + type: array + listenPort: + description: ListenPort is the port where BGP protocol should listen. + Defaults to 179 + maximum: 65535 + minimum: 1 + type: integer + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: INFO]' + type: string + nodeToNodeMeshEnabled: + description: 'NodeToNodeMeshEnabled sets whether full node to node + BGP mesh is enabled. [Default: true]' + type: boolean + prefixAdvertisements: + description: PrefixAdvertisements contains per-prefix advertisement + configuration. + items: + description: PrefixAdvertisement configures advertisement properties + for the specified CIDR. + properties: + cidr: + description: CIDR for which properties should be advertised. + type: string + communities: + description: Communities can be list of either community names + already defined in `Specs.Communities` or community value + of format `aa:nn` or `aa:nn:mm`. For standard community use + `aa:nn` format, where `aa` and `nn` are 16 bit number. For + large community use `aa:nn:mm` format, where `aa`, `nn` and + `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and + `mm` are per-AS identifier. + items: + type: string + type: array + type: object + type: array + serviceClusterIPs: + description: ServiceClusterIPs are the CIDR blocks from which service + cluster IPs are allocated. If specified, Calico will advertise these + blocks, as well as any cluster IPs within them. + items: + description: ServiceClusterIPBlock represents a single allowed ClusterIP + CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceExternalIPs: + description: ServiceExternalIPs are the CIDR blocks for Kubernetes + Service External IPs. Kubernetes Service ExternalIPs will only be + advertised if they are within one of these blocks. + items: + description: ServiceExternalIPBlock represents a single allowed + External IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceLoadBalancerIPs: + description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes + Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress + IPs will only be advertised if they are within one of these blocks. + items: + description: ServiceLoadBalancerIPBlock represents a single allowed + LoadBalancer IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/bgppeers.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/bgppeers.crd.yaml new file mode 100755 index 0000000..bdbd2ee --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/bgppeers.crd.yaml @@ -0,0 +1,115 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_bgppeers.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgppeers.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPPeer + listKind: BGPPeerList + plural: bgppeers + singular: bgppeer + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPPeerSpec contains the specification for a BGPPeer resource. + properties: + asNumber: + description: The AS Number of the peer. + format: int32 + type: integer + keepOriginalNextHop: + description: Option to keep the original nexthop field when routes + are sent to a BGP Peer. Setting "true" configures the selected BGP + Peers node to use the "next hop keep;" instead of "next hop self;"(default) + in the specific branch of the Node on "bird.cfg". + type: boolean + maxRestartTime: + description: Time to allow for software restart. When specified, this + is configured as the graceful restart timeout. When not specified, + the BIRD default of 120s is used. + type: string + node: + description: The node name identifying the Calico node instance that + is targeted by this peer. If this is not set, and no nodeSelector + is specified, then this BGP peer selects all nodes in the cluster. + type: string + nodeSelector: + description: Selector for the nodes that should have this peering. When + this is set, the Node field must be empty. + type: string + password: + description: Optional BGP password for the peerings generated by this + BGPPeer resource. + properties: + secretKeyRef: + description: Selects a key of a secret in the node pod's namespace. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + type: object + peerIP: + description: The IP address of the peer followed by an optional port + number to peer with. If port number is given, format should be `[]:port` + or `:` for IPv4. If optional port number is not set, + and this peer IP and ASNumber belongs to a calico/node with ListenPort + set in BGPConfiguration, then we use that port to peer. + type: string + peerSelector: + description: Selector for the remote nodes to peer with. When this + is set, the PeerIP and ASNumber fields must be empty. For each + peering between the local node and selected remote nodes, we configure + an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, + and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The + remote AS number comes from the remote node's NodeBGPSpec.ASNumber, + or the global default if that is not set. + type: string + sourceAddress: + description: Specifies whether and how to configure a source address + for the peerings generated by this BGPPeer resource. Default value + "UseNodeIP" means to configure the node IP as the source address. "None" + means not to configure a source address. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/blockaffinities.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/blockaffinities.crd.yaml new file mode 100755 index 0000000..dbaaebc --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/blockaffinities.crd.yaml @@ -0,0 +1,62 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_blockaffinities.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BlockAffinity + listKind: BlockAffinityList + plural: blockaffinities + singular: blockaffinity + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BlockAffinitySpec contains the specification for a BlockAffinity + resource. + properties: + cidr: + type: string + deleted: + description: Deleted indicates that this block affinity is being deleted. + This field is a string for compatibility with older releases that + mistakenly treat this field as a string. + type: string + node: + type: string + state: + type: string + required: + - cidr + - deleted + - node + - state + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/clusterinformations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/clusterinformations.crd.yaml new file mode 100755 index 0000000..2f25897 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/clusterinformations.crd.yaml @@ -0,0 +1,65 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_clusterinformations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: ClusterInformation + listKind: ClusterInformationList + plural: clusterinformations + singular: clusterinformation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ClusterInformation contains the cluster specific information. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterInformationSpec contains the values of describing + the cluster. + properties: + calicoVersion: + description: CalicoVersion is the version of Calico that the cluster + is running + type: string + clusterGUID: + description: ClusterGUID is the GUID of the cluster + type: string + clusterType: + description: ClusterType describes the type of the cluster + type: string + datastoreReady: + description: DatastoreReady is used during significant datastore migrations + to signal to components such as Felix that it should wait before + accessing the datastore. + type: boolean + variant: + description: Variant declares which variant of Calico should be active. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/felixconfigurations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/felixconfigurations.crd.yaml new file mode 100755 index 0000000..a1c3d6d --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/felixconfigurations.crd.yaml @@ -0,0 +1,565 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_felixconfigurations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: FelixConfiguration + listKind: FelixConfigurationList + plural: felixconfigurations + singular: felixconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Felix Configuration contains the configuration for Felix. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FelixConfigurationSpec contains the values of the Felix configuration. + properties: + allowIPIPPacketsFromWorkloads: + description: 'AllowIPIPPacketsFromWorkloads controls whether Felix + will add a rule to drop IPIP encapsulated traffic from workloads + [Default: false]' + type: boolean + allowVXLANPacketsFromWorkloads: + description: 'AllowVXLANPacketsFromWorkloads controls whether Felix + will add a rule to drop VXLAN encapsulated traffic from workloads + [Default: false]' + type: boolean + awsSrcDstCheck: + description: 'Set source-destination-check on AWS EC2 instances. Accepted + value must be one of "DoNothing", "Enabled" or "Disabled". [Default: + DoNothing]' + enum: + - DoNothing + - Enable + - Disable + type: string + bpfConnectTimeLoadBalancingEnabled: + description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, + controls whether Felix installs the connection-time load balancer. The + connect-time load balancer is required for the host to be able to + reach Kubernetes services and it improves the performance of pod-to-service + connections. The only reason to disable it is for debugging purposes. [Default: + true]' + type: boolean + bpfDataIfacePattern: + description: BPFDataIfacePattern is a regular expression that controls + which interfaces Felix should attach BPF programs to in order to + catch traffic to/from the network. This needs to match the interfaces + that Calico workload traffic flows over as well as any interfaces + that handle incoming traffic to nodeports and services from outside + the cluster. It should not match the workload interfaces (usually + named cali...). + type: string + bpfDisableUnprivileged: + description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled + sysctl to disable unprivileged use of BPF. This ensures that unprivileged + users cannot access Calico''s BPF maps and cannot insert their own + BPF programs to interfere with Calico''s. [Default: true]' + type: boolean + bpfEnabled: + description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. + [Default: false]' + type: boolean + bpfExternalServiceMode: + description: 'BPFExternalServiceMode in BPF mode, controls how connections + from outside the cluster to services (node ports and cluster IPs) + are forwarded to remote workloads. If set to "Tunnel" then both + request and response traffic is tunneled to the remote node. If + set to "DSR", the request traffic is tunneled but the response traffic + is sent directly from the remote node. In "DSR" mode, the remote + node appears to use the IP of the ingress node; this requires a + permissive L2 network. [Default: Tunnel]' + type: string + bpfExtToServiceConnmark: + description: 'BPFExtToServiceConnmark in BPF mode, controls a + 32bit mark that is set on connections from an external client to + a local service. This mark allows us to control how packets of + that connection are routed within the host and how is routing + intepreted by RPF check. [Default: 0]' + type: integer + + bpfKubeProxyEndpointSlicesEnabled: + description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls + whether Felix's embedded kube-proxy accepts EndpointSlices or not. + type: boolean + bpfKubeProxyIptablesCleanupEnabled: + description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF + mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s + iptables chains. Should only be enabled if kube-proxy is not running. [Default: + true]' + type: boolean + bpfKubeProxyMinSyncPeriod: + description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the + minimum time between updates to the dataplane for Felix''s embedded + kube-proxy. Lower values give reduced set-up latency. Higher values + reduce Felix CPU usage by batching up more work. [Default: 1s]' + type: string + bpfLogLevel: + description: 'BPFLogLevel controls the log level of the BPF programs + when in BPF dataplane mode. One of "Off", "Info", or "Debug". The + logs are emitted to the BPF trace pipe, accessible with the command + `tc exec bpf debug`. [Default: Off].' + type: string + chainInsertMode: + description: 'ChainInsertMode controls whether Felix hooks the kernel''s + top-level iptables chains by inserting a rule at the top of the + chain or by appending a rule at the bottom. insert is the safe default + since it prevents Calico''s rules from being bypassed. If you switch + to append mode, be sure that the other rules in the chains signal + acceptance by falling through to the Calico rules, otherwise the + Calico policy will be bypassed. [Default: insert]' + type: string + dataplaneDriver: + type: string + debugDisableLogDropping: + type: boolean + debugMemoryProfilePath: + type: string + debugSimulateCalcGraphHangAfter: + type: string + debugSimulateDataplaneHangAfter: + type: string + defaultEndpointToHostAction: + description: 'DefaultEndpointToHostAction controls what happens to + traffic that goes from a workload endpoint to the host itself (after + the traffic hits the endpoint egress policy). By default Calico + blocks traffic from workload endpoints to the host itself with an + iptables "DROP" action. If you want to allow some or all traffic + from endpoint to host, set this parameter to RETURN or ACCEPT. Use + RETURN if you have your own rules in the iptables "INPUT" chain; + Calico will insert its rules at the top of that chain, then "RETURN" + packets to the "INPUT" chain once it has completed processing workload + endpoint egress policy. Use ACCEPT to unconditionally accept packets + from workloads after processing workload endpoint egress policy. + [Default: Drop]' + type: string + deviceRouteProtocol: + description: This defines the route protocol added to programmed device + routes, by default this will be RTPROT_BOOT when left blank. + type: integer + deviceRouteSourceAddress: + description: This is the source address to use on programmed device + routes. By default the source address is left blank, leaving the + kernel to choose the source address used. + type: string + disableConntrackInvalidCheck: + type: boolean + endpointReportingDelay: + type: string + endpointReportingEnabled: + type: boolean + externalNodesList: + description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes + which may source tunnel traffic and have the tunneled traffic be + accepted at calico nodes. + items: + type: string + type: array + failsafeInboundHostPorts: + description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow incoming traffic to host endpoints + on irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all inbound host ports, use the value + none. The default value allows ssh access and DHCP. [Default: tcp:22, + udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + failsafeOutboundHostPorts: + description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow outgoing traffic from host endpoints + to irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all outbound host ports, use the value + none. The default value opens etcd''s standard ports to ensure that + Felix does not get cut off from etcd as well as allowing DHCP and + DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, + tcp:6667, udp:53, udp:67]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + featureDetectOverride: + description: FeatureDetectOverride is used to override the feature + detection. Values are specified in a comma separated list with no + spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". + "true" or "false" will force the feature, empty or omitted values + are auto-detected. + type: string + genericXDPEnabled: + description: 'GenericXDPEnabled enables Generic XDP so network cards + that don''t support XDP offload or driver modes can use XDP. This + is not recommended since it doesn''t provide better performance + than iptables. [Default: false]' + type: boolean + healthEnabled: + type: boolean + healthHost: + type: string + healthPort: + type: integer + interfaceExclude: + description: 'InterfaceExclude is a comma-separated list of interfaces + that Felix should exclude when monitoring for host endpoints. The + default value ensures that Felix ignores Kubernetes'' IPVS dummy + interface, which is used internally by kube-proxy. If you want to + exclude multiple interface names using a single value, the list + supports regular expressions. For regular expressions you must wrap + the value with ''/''. For example having values ''/^kube/,veth1'' + will exclude all interfaces that begin with ''kube'' and also the + interface ''veth1''. [Default: kube-ipvs0]' + type: string + interfacePrefix: + description: 'InterfacePrefix is the interface name prefix that identifies + workload endpoints and so distinguishes them from host endpoint + interfaces. Note: in environments other than bare metal, the orchestrators + configure this appropriately. For example our Kubernetes and Docker + integrations set the ''cali'' value, and our OpenStack integration + sets the ''tap'' value. [Default: cali]' + type: string + interfaceRefreshInterval: + description: InterfaceRefreshInterval is the period at which Felix + rescans local interfaces to verify their state. The rescan can be + disabled by setting the interval to 0. + type: string + ipipEnabled: + type: boolean + ipipMTU: + description: 'IPIPMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + ipsetsRefreshInterval: + description: 'IpsetsRefreshInterval is the period at which Felix re-checks + all iptables state to ensure that no other process has accidentally + broken Calico''s rules. Set to 0 to disable iptables refresh. [Default: + 90s]' + type: string + iptablesBackend: + description: IptablesBackend specifies which backend of iptables will + be used. The default is legacy. + type: string + iptablesFilterAllowAction: + type: string + iptablesLockFilePath: + description: 'IptablesLockFilePath is the location of the iptables + lock file. You may need to change this if the lock file is not in + its standard location (for example if you have mapped it into Felix''s + container at a different path). [Default: /run/xtables.lock]' + type: string + iptablesLockProbeInterval: + description: 'IptablesLockProbeInterval is the time that Felix will + wait between attempts to acquire the iptables lock if it is not + available. Lower values make Felix more responsive when the lock + is contended, but use more CPU. [Default: 50ms]' + type: string + iptablesLockTimeout: + description: 'IptablesLockTimeout is the time that Felix will wait + for the iptables lock, or 0, to disable. To use this feature, Felix + must share the iptables lock file with all other processes that + also take the lock. When running Felix inside a container, this + requires the /run directory of the host to be mounted into the calico/node + or calico/felix container. [Default: 0s disabled]' + type: string + iptablesMangleAllowAction: + type: string + iptablesMarkMask: + description: 'IptablesMarkMask is the mask that Felix selects its + IPTables Mark bits from. Should be a 32 bit hexadecimal number with + at least 8 bits set, none of which clash with any other mark bits + in use on the system. [Default: 0xff000000]' + format: int32 + type: integer + iptablesNATOutgoingInterfaceFilter: + type: string + iptablesPostWriteCheckInterval: + description: 'IptablesPostWriteCheckInterval is the period after Felix + has done a write to the dataplane that it schedules an extra read + back in order to check the write was not clobbered by another process. + This should only occur if another application on the system doesn''t + respect the iptables lock. [Default: 1s]' + type: string + iptablesRefreshInterval: + description: 'IptablesRefreshInterval is the period at which Felix + re-checks the IP sets in the dataplane to ensure that no other process + has accidentally broken Calico''s rules. Set to 0 to disable IP + sets refresh. Note: the default for this value is lower than the + other refresh intervals as a workaround for a Linux kernel bug that + was fixed in kernel version 4.11. If you are using v4.11 or greater + you may want to set this to, a higher value to reduce Felix CPU + usage. [Default: 10s]' + type: string + ipv6Support: + type: boolean + kubeNodePortRanges: + description: 'KubeNodePortRanges holds list of port ranges used for + service node ports. Only used if felix detects kube-proxy running + in ipvs mode. Felix uses these ranges to separate host and workload + traffic. [Default: 30000:32767].' + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + logFilePath: + description: 'LogFilePath is the full path to the Felix log. Set to + none to disable file logging. [Default: /var/log/calico/felix.log]' + type: string + logPrefix: + description: 'LogPrefix is the log prefix that Felix uses when rendering + LOG rules. [Default: calico-packet]' + type: string + logSeverityFile: + description: 'LogSeverityFile is the log severity above which logs + are sent to the log file. [Default: Info]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + logSeveritySys: + description: 'LogSeveritySys is the log severity above which logs + are sent to the syslog. Set to None for no logging to syslog. [Default: + Info]' + type: string + maxIpsetSize: + type: integer + metadataAddr: + description: 'MetadataAddr is the IP address or domain name of the + server that can answer VM queries for cloud-init metadata. In OpenStack, + this corresponds to the machine running nova-api (or in Ubuntu, + nova-api-metadata). A value of none (case insensitive) means that + Felix should not set up any NAT rule for the metadata path. [Default: + 127.0.0.1]' + type: string + metadataPort: + description: 'MetadataPort is the port of the metadata server. This, + combined with global.MetadataAddr (if not ''None''), is used to + set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. + In most cases this should not need to be changed [Default: 8775].' + type: integer + mtuIfacePattern: + description: MTUIfacePattern is a regular expression that controls + which interfaces Felix should scan in order to calculate the host's + MTU. This should not match workload interfaces (usually named cali...). + type: string + natOutgoingAddress: + description: NATOutgoingAddress specifies an address to use when performing + source NAT for traffic in a natOutgoing pool that is leaving the + network. By default the address used is an address on the interface + the traffic is leaving on (ie it uses the iptables MASQUERADE target) + type: string + natPortRange: + anyOf: + - type: integer + - type: string + description: NATPortRange specifies the range of ports that is used + for port mapping when doing outgoing NAT. When unset the default + behavior of the network stack is used. + pattern: ^.* + x-kubernetes-int-or-string: true + netlinkTimeout: + type: string + openstackRegion: + description: 'OpenstackRegion is the name of the region that a particular + Felix belongs to. In a multi-region Calico/OpenStack deployment, + this must be configured somehow for each Felix (here in the datamodel, + or in felix.cfg or the environment on each compute node), and must + match the [calico] openstack_region value configured in neutron.conf + on each node. [Default: Empty]' + type: string + policySyncPathPrefix: + description: 'PolicySyncPathPrefix is used to by Felix to communicate + policy changes to external services, like Application layer policy. + [Default: Empty]' + type: string + prometheusGoMetricsEnabled: + description: 'PrometheusGoMetricsEnabled disables Go runtime metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + prometheusMetricsEnabled: + description: 'PrometheusMetricsEnabled enables the Prometheus metrics + server in Felix if set to true. [Default: false]' + type: boolean + prometheusMetricsHost: + description: 'PrometheusMetricsHost is the host that the Prometheus + metrics server should bind to. [Default: empty]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. [Default: 9091]' + type: integer + prometheusProcessMetricsEnabled: + description: 'PrometheusProcessMetricsEnabled disables process metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + removeExternalRoutes: + description: Whether or not to remove device routes that have not + been programmed by Felix. Disabling this will allow external applications + to also add device routes. This is enabled by default which means + we will remove externally added routes. + type: boolean + reportingInterval: + description: 'ReportingInterval is the interval at which Felix reports + its status into the datastore or 0 to disable. Must be non-zero + in OpenStack deployments. [Default: 30s]' + type: string + reportingTTL: + description: 'ReportingTTL is the time-to-live setting for process-wide + status reports. [Default: 90s]' + type: string + routeRefreshInterval: + description: 'RouteRefreshInterval is the period at which Felix re-checks + the routes in the dataplane to ensure that no other process has + accidentally broken Calico''s rules. Set to 0 to disable route refresh. + [Default: 90s]' + type: string + routeSource: + description: 'RouteSource configures where Felix gets its routing + information. - WorkloadIPs: use workload endpoints to construct + routes. - CalicoIPAM: the default - use IPAM data to construct routes.' + type: string + routeTableRange: + description: Calico programs additional Linux route tables for various + purposes. RouteTableRange specifies the indices of the route tables + that Calico should use. + properties: + max: + type: integer + min: + type: integer + required: + - max + - min + type: object + serviceLoopPrevention: + description: 'When service IP advertisement is enabled, prevent routing + loops to service IPs that are not in use, by dropping or rejecting + packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled", + in which case such routing loops continue to be allowed. [Default: + Drop]' + type: string + sidecarAccelerationEnabled: + description: 'SidecarAccelerationEnabled enables experimental sidecar + acceleration [Default: false]' + type: boolean + usageReportingEnabled: + description: 'UsageReportingEnabled reports anonymous Calico version + number and cluster size to projectcalico.org. Logs warnings returned + by the usage server. For example, if a significant security vulnerability + has been discovered in the version of Calico being used. [Default: + true]' + type: boolean + usageReportingInitialDelay: + description: 'UsageReportingInitialDelay controls the minimum delay + before Felix makes a report. [Default: 300s]' + type: string + usageReportingInterval: + description: 'UsageReportingInterval controls the interval at which + Felix makes reports. [Default: 86400s]' + type: string + useInternalDataplaneDriver: + type: boolean + vxlanEnabled: + type: boolean + vxlanMTU: + description: 'VXLANMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + vxlanPort: + type: integer + vxlanVNI: + type: integer + wireguardEnabled: + description: 'WireguardEnabled controls whether Wireguard is enabled. + [Default: false]' + type: boolean + wireguardInterfaceName: + description: 'WireguardInterfaceName specifies the name to use for + the Wireguard interface. [Default: wg.calico]' + type: string + wireguardListeningPort: + description: 'WireguardListeningPort controls the listening port used + by Wireguard. [Default: 51820]' + type: integer + wireguardMTU: + description: 'WireguardMTU controls the MTU on the Wireguard interface. + See Configuring MTU [Default: 1420]' + type: integer + wireguardRoutingRulePriority: + description: 'WireguardRoutingRulePriority controls the priority value + to use for the Wireguard routing rule. [Default: 99]' + type: integer + xdpEnabled: + description: 'XDPEnabled enables XDP acceleration for suitable untracked + incoming deny rules. [Default: true]' + type: boolean + xdpRefreshInterval: + description: 'XDPRefreshInterval is the period at which Felix re-checks + all XDP state to ensure that no other process has accidentally broken + Calico''s BPF maps or attached programs. Set to 0 to disable XDP + refresh. [Default: 90s]' + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/globalnetworkpolicies.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/globalnetworkpolicies.crd.yaml new file mode 100755 index 0000000..1cf624f --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/globalnetworkpolicies.crd.yaml @@ -0,0 +1,856 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkPolicy + listKind: GlobalNetworkPolicyList + plural: globalnetworkpolicies + singular: globalnetworkpolicy + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + applyOnForward: + description: ApplyOnForward indicates to apply the rules in this policy + on forward traffic. + type: boolean + doNotTrack: + description: DoNotTrack indicates whether packets matched by the rules + in this policy should go through the data plane's connection tracking, + such as Linux conntrack. If True, the rules in this policy are + applied before any data plane connection tracking, and packets allowed + by this policy are marked as not to be tracked. + type: boolean + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + namespaceSelector: + description: NamespaceSelector is an optional field for an expression + used to select a pod based on namespaces. + type: string + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + preDNAT: + description: PreDNAT indicates to apply the rules in this policy before + any DNAT. + type: boolean + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress rules are present in the policy. The + default is: \n - [ PolicyTypeIngress ], if there are no Egress rules + (including the case where there are also no Ingress rules) \n + - [ PolicyTypeEgress ], if there are Egress rules but no Ingress + rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are + both Ingress and Egress rules. \n When the policy is read back again, + Types will always be one of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/globalnetworksets.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/globalnetworksets.crd.yaml new file mode 100755 index 0000000..6024037 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/globalnetworksets.crd.yaml @@ -0,0 +1,55 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_globalnetworksets.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkSet + listKind: GlobalNetworkSetList + plural: globalnetworksets + singular: globalnetworkset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs + that share labels to allow rules to refer to them via selectors. The labels + of GlobalNetworkSet are not namespaced. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GlobalNetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/hostendpoints.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/hostendpoints.crd.yaml new file mode 100755 index 0000000..797801d --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/hostendpoints.crd.yaml @@ -0,0 +1,109 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_hostendpoints.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: HostEndpoint + listKind: HostEndpointList + plural: hostendpoints + singular: hostendpoint + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HostEndpointSpec contains the specification for a HostEndpoint + resource. + properties: + expectedIPs: + description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. + If \"InterfaceName\" is not present, Calico will look for an interface + matching any of the IPs in the list and apply policy to that. Note: + \tWhen using the selector match criteria in an ingress or egress + security Policy \tor Profile, Calico converts the selector into + a set of IP addresses. For host \tendpoints, the ExpectedIPs field + is used for that purpose. (If only the interface \tname is specified, + Calico does not learn the IPs of the interface for use in match + \tcriteria.)" + items: + type: string + type: array + interfaceName: + description: "Either \"*\", or the name of a specific Linux interface + to apply policy to; or empty. \"*\" indicates that this HostEndpoint + governs all traffic to, from or through the default network namespace + of the host named by the \"Node\" field; entering and leaving that + namespace via any interface, including those from/to non-host-networked + local workloads. \n If InterfaceName is not \"*\", this HostEndpoint + only governs traffic that enters or leaves the host through the + specific interface named by InterfaceName, or - when InterfaceName + is empty - through the specific interface that has one of the IPs + in ExpectedIPs. Therefore, when InterfaceName is empty, at least + one expected IP must be specified. Only external interfaces (such + as \"eth0\") are supported here; it isn't possible for a HostEndpoint + to protect traffic through a specific local workload interface. + \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; + initially just pre-DNAT policy. Please check Calico documentation + for the latest position." + type: string + node: + description: The node name identifying the Calico node instance. + type: string + ports: + description: Ports contains the endpoint's named ports, which may + be referenced in security policy rules. + items: + properties: + name: + type: string + port: + type: integer + protocol: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + required: + - name + - port + - protocol + type: object + type: array + profiles: + description: A list of identifiers of security Profile objects that + apply to this endpoint. Each profile is applied in the order that + they appear in this list. Profile rules are applied after the selector-based + security policy. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamblocks.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamblocks.crd.yaml new file mode 100755 index 0000000..efc9f1f --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamblocks.crd.yaml @@ -0,0 +1,82 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamblocks.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMBlock + listKind: IPAMBlockList + plural: ipamblocks + singular: ipamblock + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMBlockSpec contains the specification for an IPAMBlock + resource. + properties: + affinity: + type: string + allocations: + items: + type: integer + # TODO: This nullable is manually added in. We should update controller-gen + # to handle []*int properly itself. + nullable: true + type: array + attributes: + items: + properties: + handle_id: + type: string + secondary: + additionalProperties: + type: string + type: object + type: object + type: array + cidr: + type: string + deleted: + type: boolean + strictAffinity: + type: boolean + unallocated: + items: + type: integer + type: array + required: + - allocations + - attributes + - cidr + - strictAffinity + - unallocated + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamconfigs.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamconfigs.crd.yaml new file mode 100755 index 0000000..b03a308 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamconfigs.crd.yaml @@ -0,0 +1,57 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamconfigs.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMConfig + listKind: IPAMConfigList + plural: ipamconfigs + singular: ipamconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMConfigSpec contains the specification for an IPAMConfig + resource. + properties: + autoAllocateBlocks: + type: boolean + maxBlocksPerHost: + description: MaxBlocksPerHost, if non-zero, is the max number of blocks + that can be affine to each host. + type: integer + strictAffinity: + type: boolean + required: + - autoAllocateBlocks + - strictAffinity + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamhandles.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamhandles.crd.yaml new file mode 100755 index 0000000..06a6306 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ipamhandles.crd.yaml @@ -0,0 +1,57 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamhandles.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMHandle + listKind: IPAMHandleList + plural: ipamhandles + singular: ipamhandle + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMHandleSpec contains the specification for an IPAMHandle + resource. + properties: + block: + additionalProperties: + type: integer + type: object + deleted: + type: boolean + handleID: + type: string + required: + - block + - handleID + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ippools.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ippools.crd.yaml new file mode 100755 index 0000000..6b8c9d1 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/ippools.crd.yaml @@ -0,0 +1,100 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ippools.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPPool + listKind: IPPoolList + plural: ippools + singular: ippool + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec contains the specification for an IPPool resource. + properties: + blockSize: + description: The block size to use for IP address assignments from + this pool. Defaults to 26 for IPv4 and 112 for IPv6. + type: integer + cidr: + description: The pool CIDR. + type: string + disabled: + description: When disabled is true, Calico IPAM will not assign addresses + from this pool. + type: boolean + ipip: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + properties: + enabled: + description: When enabled is true, ipip tunneling will be used + to deliver packets to destinations within this pool. + type: boolean + mode: + description: The IPIP mode. This can be one of "always" or "cross-subnet". A + mode of "always" will also use IPIP tunneling for routing to + destination IP addresses within this pool. A mode of "cross-subnet" + will only use IPIP tunneling when the destination node is on + a different subnet to the originating node. The default value + (if not specified) is "always". + type: string + type: object + ipipMode: + description: Contains configuration for IPIP tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling + is disabled). + type: string + nat-outgoing: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + type: boolean + natOutgoing: + description: When nat-outgoing is true, packets sent from Calico networked + containers in this pool to destinations outside of this pool will + be masqueraded. + type: boolean + nodeSelector: + description: Allows IPPool to allocate for a specific node by label + selector. + type: string + vxlanMode: + description: Contains configuration for VXLAN tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. VXLAN + tunneling is disabled). + type: string + required: + - cidr + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/networkpolicies.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/networkpolicies.crd.yaml new file mode 100755 index 0000000..f729b6e --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/networkpolicies.crd.yaml @@ -0,0 +1,838 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_networkpolicies.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkPolicy + listKind: NetworkPolicyList + plural: networkpolicies + singular: networkpolicy + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress are present in the policy. The default + is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including + the case where there are also no Ingress rules) \n - [ PolicyTypeEgress + ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, + PolicyTypeEgress ], if there are both Ingress and Egress rules. + \n When the policy is read back again, Types will always be one + of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/networksets.crd.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/networksets.crd.yaml new file mode 100755 index 0000000..2e545a1 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/crds/networksets.crd.yaml @@ -0,0 +1,52 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_networksets.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkSet + listKind: NetworkSetList + plural: networksets + singular: networkset + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: NetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/daemonset.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/daemonset.yaml new file mode 100755 index 0000000..cefe527 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/daemonset.yaml @@ -0,0 +1,260 @@ +--- +# Source: calico/templates/calico-node.yaml +# This manifest installs the canal container, as well +# as the CNI plugins and network config on +# each master and worker node in a Kubernetes cluster. +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: {{ .Release.Name | quote }} + namespace: kube-system + labels: + k8s-app: canal +spec: + selector: + matchLabels: + k8s-app: canal + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + labels: + k8s-app: canal + spec: + nodeSelector: + kubernetes.io/os: linux + hostNetwork: true + tolerations: + # Make sure canal gets scheduled on all nodes. + - effect: NoSchedule + operator: Exists + # Mark the pod as a critical add-on for rescheduling. + - key: CriticalAddonsOnly + operator: Exists + - effect: NoExecute + operator: Exists + serviceAccountName: canal + # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force + # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. + terminationGracePeriodSeconds: 0 + priorityClassName: system-node-critical + initContainers: + # This container installs the CNI binaries + # and CNI network config file on each node. + - name: install-cni + image: {{ template "system_default_registry" . }}{{ .Values.calico.cniImage.repository }}:{{ .Values.calico.cniImage.tag }} + command: ["/opt/cni/bin/install"] + env: + # Name of the CNI config file to create. + - name: CNI_CONF_NAME + value: "10-canal.conflist" + # The CNI network config to install on each node. + - name: CNI_NETWORK_CONFIG + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: cni_network_config + # Set the hostname based on the k8s node name. + - name: KUBERNETES_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # CNI MTU Config variable + - name: CNI_MTU + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: veth_mtu + # Prevents the container from sleeping forever. + - name: SLEEP + value: "false" + volumeMounts: + - mountPath: /host/opt/cni/bin + name: cni-bin-dir + - mountPath: /host/etc/cni/net.d + name: cni-net-dir + securityContext: + privileged: true + # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes + # to communicate with Felix over the Policy Sync API. + - name: flexvol-driver + image: {{ template "system_default_registry" . }}{{ .Values.calico.flexvolImage.repository }}:{{ .Values.calico.flexvolImage.tag }} + command: ['/usr/local/bin/flexvol.sh', '-s', '/usr/local/bin/flexvol', '-i', 'flexvoldriver'] + volumeMounts: + - name: flexvol-driver-host + mountPath: /host/driver + securityContext: + privileged: true + containers: + # Runs canal container on each Kubernetes node. This + # container programs network policy and routes on each + # host. + - name: calico-node + command: + - "start_runit" + image: {{ template "system_default_registry" . }}{{ .Values.calico.nodeImage.repository }}:{{ .Values.calico.nodeImage.tag }} + env: + # Use Kubernetes API as the backing datastore. + - name: DATASTORE_TYPE + value: {{ .Values.calico.datastoreType | quote }} + # Configure route aggregation based on pod CIDR. + - name: USE_POD_CIDR + value: {{ .Values.calico.usePodCIDR | quote }} + # Wait for the datastore. + - name: WAIT_FOR_DATASTORE + value: {{ .Values.calico.waitForDatastore | quote }} + # Set based on the k8s node name. + - name: NODENAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # Don't enable BGP. + - name: CALICO_NETWORKING_BACKEND + value: {{ .Values.calico.networkingBackend | quote }} + # Cluster type to identify the deployment type + - name: CLUSTER_TYPE + value: {{ .Values.calico.clusterType | quote}} + # Period, in seconds, at which felix re-applies all iptables state + - name: FELIX_IPTABLESREFRESHINTERVAL + value: {{ .Values.calico.felixIptablesRefreshInterval | quote}} + - name: FELIX_IPTABLESBACKEND + value: {{ .Values.calico.felixIptablesBackend | quote}} + # No IP address needed. + - name: IP + value: "" + # The default IPv4 pool to create on startup if none exists. Pod IPs will be + # chosen from this range. Changing this value after installation will have + # no effect. This should fall within `--cluster-cidr`. + # - name: CALICO_IPV4POOL_CIDR + # value: "192.168.0.0/16" + # Disable file logging so `kubectl logs` works. + - name: CALICO_DISABLE_FILE_LOGGING + value: "true" + # Set Felix endpoint to host default action to ACCEPT. + - name: FELIX_DEFAULTENDPOINTTOHOSTACTION + value: {{ .Values.calico.felixDefaultEndpointToHostAction | quote }} + # Disable IPv6 on Kubernetes. + - name: FELIX_IPV6SUPPORT + value: {{ .Values.calico.felixIpv6Support | quote }} + # Set Felix logging to "info" + - name: FELIX_LOGSEVERITYSCREEN + value: {{ .Values.calico.felixLogSeverityScreen | quote }} + - name: FELIX_HEALTHENABLED + value: {{ .Values.calico.felixHealthEnabled | quote }} + # enable promentheus metrics + - name: FELIX_PROMETHEUSMETRICSENABLED + value: {{ .Values.calico.felixPrometheusMetricsEnabled | quote }} + - name: FELIX_XDPENABLED + value: {{ .Values.calico.felixXDPEnabled | quote }} + - name: FELIX_FAILSAFEINBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeInboundHostPorts | quote }} + - name: FELIX_FAILSAFEOUTBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeOutboundHostPorts | quote }} + securityContext: + privileged: true + resources: + requests: + cpu: 250m + livenessProbe: + exec: + command: + - /bin/calico-node + - -felix-live + periodSeconds: 10 + initialDelaySeconds: 10 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: 9099 + host: localhost + periodSeconds: 10 + volumeMounts: + - mountPath: /lib/modules + name: lib-modules + readOnly: true + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - mountPath: /var/run/calico + name: var-run-calico + readOnly: false + - mountPath: /var/lib/calico + name: var-lib-calico + readOnly: false + - name: policysync + mountPath: /var/run/nodeagent + # This container runs flannel using the kube-subnet-mgr backend + # for allocating subnets. + - name: kube-flannel + image: {{ template "system_default_registry" . }}{{ .Values.flannel.image.repository }}:{{ .Values.flannel.image.tag }} + command: + - "/opt/bin/flanneld" + {{- range .Values.flannel.args }} + - {{ . | quote }} + {{- end }} + securityContext: + privileged: true + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: FLANNELD_IFACE + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: canal_iface + - name: FLANNELD_IP_MASQ + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: masquerade + volumeMounts: + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - name: flannel-cfg + mountPath: /etc/kube-flannel/ + volumes: + # Used by canal. + - name: lib-modules + hostPath: + path: /lib/modules + - name: var-run-calico + hostPath: + path: /var/run/calico + - name: var-lib-calico + hostPath: + path: /var/lib/calico + - name: xtables-lock + hostPath: + path: /run/xtables.lock + type: FileOrCreate + # Used by flannel. + - name: flannel-cfg + configMap: + name: {{ .Release.Name }}-config + # Used to install CNI. + - name: cni-bin-dir + hostPath: + path: /opt/cni/bin + - name: cni-net-dir + hostPath: + path: /etc/cni/net.d + # Used to create per-pod Unix Domain Sockets + - name: policysync + hostPath: + type: DirectoryOrCreate + path: /var/run/nodeagent + # Used to install Flex Volume Driver + - name: flexvol-driver-host + hostPath: + type: DirectoryOrCreate + path: {{ .Values.calico.flexVolumePluginDir }}/nodeagent~uds diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/rbac.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/rbac.yaml new file mode 100755 index 0000000..2936532 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/rbac.yaml @@ -0,0 +1,170 @@ +--- +# Source: calico/templates/calico-node-rbac.yaml +# Include a clusterrole for the calico-node DaemonSet, +# and bind it to the calico-node serviceaccount. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: calico-node +rules: + # The CNI plugin needs to get pods, nodes, and namespaces. + - apiGroups: [""] + resources: + - pods + - nodes + - namespaces + verbs: + - get + # EndpointSlices are used for Service-based network policy rule + # enforcement. + - apiGroups: ["discovery.k8s.io"] + resources: + - endpointslices + verbs: + - watch + - list + - apiGroups: [""] + resources: + - endpoints + - services + verbs: + # Used to discover service IPs for advertisement. + - watch + - list + # Used to discover Typhas. + - get + # Pod CIDR auto-detection on kubeadm needs access to config maps. + - apiGroups: [""] + resources: + - configmaps + verbs: + - get + - apiGroups: [""] + resources: + - nodes/status + verbs: + # Needed for clearing NodeNetworkUnavailable flag. + - patch + # Calico stores some configuration information in node annotations. + - update + # Watch for changes to Kubernetes NetworkPolicies. + - apiGroups: ["networking.k8s.io"] + resources: + - networkpolicies + verbs: + - watch + - list + # Used by Calico for policy information. + - apiGroups: [""] + resources: + - pods + - namespaces + - serviceaccounts + verbs: + - list + - watch + # The CNI plugin patches pods/status. + - apiGroups: [""] + resources: + - pods/status + verbs: + - patch + # Calico monitors various CRDs for config. + - apiGroups: ["crd.projectcalico.org"] + resources: + - globalfelixconfigs + - felixconfigurations + - bgppeers + - globalbgpconfigs + - bgpconfigurations + - ippools + - ipamblocks + - globalnetworkpolicies + - globalnetworksets + - networkpolicies + - networksets + - clusterinformations + - hostendpoints + - blockaffinities + verbs: + - get + - list + - watch + # Calico must create and update some CRDs on startup. + - apiGroups: ["crd.projectcalico.org"] + resources: + - ippools + - felixconfigurations + - clusterinformations + verbs: + - create + - update + # Calico stores some configuration information on the node. + - apiGroups: [""] + resources: + - nodes + verbs: + - get + - list + - watch + # These permissions are only required for upgrade from v2.6, and can + # be removed after upgrade or on fresh installations. + - apiGroups: ["crd.projectcalico.org"] + resources: + - bgpconfigurations + - bgppeers + verbs: + - create + - update + +--- +# Flannel ClusterRole +# Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: flannel +rules: + - apiGroups: [""] + resources: + - pods + verbs: + - get + - apiGroups: [""] + resources: + - nodes + verbs: + - list + - watch + - apiGroups: [""] + resources: + - nodes/status + verbs: + - patch +--- +# Bind the flannel ClusterRole to the canal ServiceAccount. +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: canal-flannel +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flannel +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: canal-calico +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-node +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/serviceaccount.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/serviceaccount.yaml new file mode 100755 index 0000000..582d55b --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/templates/serviceaccount.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/values.yaml b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/values.yaml new file mode 100755 index 0000000..2156709 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.20.3-build2022011406/values.yaml @@ -0,0 +1,82 @@ +--- + +# The IPv4 cidr pool to create on startup if none exists. Pod IPs will be +# chosen from this range. +podCidr: "10.42.0.0/16" + +flannel: + # kube-flannel image + image: + repository: rancher/hardened-flannel + tag: v0.15.1-build20211119 + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + iface: "" + # kube-flannel command arguments + args: + - "--ip-masq" + - "--kube-subnet-mgr" + # Backend for kube-flannel. Backend should not be changed + # at runtime. + backend: "vxlan" + +calico: + # CNI installation image. + cniImage: + repository: rancher/hardened-calico + tag: v3.20.3-build20220114 + # Canal node image. + nodeImage: + repository: rancher/hardened-calico + tag: v3.20.3-build20220114 + # Flexvol Image. + flexvolImage: + repository: rancher/hardened-calico + tag: v3.20.3-build20220114 + # Datastore type for canal. It can be either kuberentes or etcd. + datastoreType: kubernetes + # Wait for datastore to initialize. + waitForDatastore: true + # Configure route aggregation based on pod CIDR. + usePodCIDR: true + # Disable BGP routing. + networkingBackend: none + # Cluster type to identify the deployment type. + clusterType: "k8s,canal" + # Disable file logging so `kubectl logs` works. + disableFileLogging: true + # Disable IPv6 on Kubernetes. + felixIpv6Support: false + # Period, in seconds, at which felix re-applies all iptables state + felixIptablesRefreshInterval: 60 + # iptables backend to use for felix, defaults to auto but can also be set to nft or legacy + felixIptablesBackend: auto + # Set Felix logging to "info". + felixLogSeverityScreen: info + # Enable felix healthcheck. + felixHealthEnabled: true + # Enable prometheus metrics + felixPrometheusMetricsEnabled: true + # Disable XDP Acceleration as we do not support it with our ubi7 base image + felixXDPEnabled: false + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: true + # Set Felix endpoint to host default action to ACCEPT. + felixDefaultEndpointToHostAction: ACCEPT + # Configure the MTU to use. + vethuMTU: 1450 + # Typha is disabled. + typhaServiceName: none + # Kubelet flex-volume-plugin-dir + flexVolumePluginDir: /var/lib/kubelet/volumeplugins + # calico inbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeInboundHostPorts: "" + # calico outbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeOutboundHostPorts: "" + +global: + systemDefaultRegistry: "" + clusterCIDRv4: "" + clusterCIDRv6: "" diff --git a/index.yaml b/index.yaml index 558f330..327929e 100755 --- a/index.yaml +++ b/index.yaml @@ -434,6 +434,23 @@ entries: - assets/rke2-calico/rke2-calico-crd-v1.0.001.tgz version: v1.0.001 rke2-canal: + - apiVersion: v1 + appVersion: v3.20.3 + created: "2022-01-14T18:03:06.403443347Z" + description: Install Canal Network Plugin. + digest: e50c5ac5d77ef3b5f7a83862c4cf4da99cd4c3157e353614803eb2c35a0522ee + home: https://www.projectcalico.org/ + keywords: + - canal + maintainers: + - email: charts@rancher.com + name: Rancher Labs + name: rke2-canal + sources: + - https://github.com/rancher/rke2-charts + urls: + - assets/rke2-canal/rke2-canal-v3.20.3-build2022011406.tgz + version: v3.20.3-build2022011406 - apiVersion: v1 appVersion: v3.20.2 created: "2022-01-14T17:40:44.488113341Z"