From d59428a6f325afd485ce03ae5b8f74d78324391c Mon Sep 17 00:00:00 2001 From: actions Date: Wed, 7 Jul 2021 08:18:57 +0000 Subject: [PATCH] Merge pull request #112 from manuelbuil/calico_systemDefaultRegistry Bug: Propagate global.systemDefaultRegistry to calico images --- .../rke2-calico/rke2-calico-crd-v1.0.007.tgz | Bin 0 -> 14333 bytes assets/rke2-calico/rke2-calico-v3.1907.tgz | Bin 0 -> 26957 bytes .../rke2-calico-crd/v1.0.007/Chart.yaml | 5 + .../operator.tigera.io_imagesets_crd.yaml | 75 + .../operator.tigera.io_installations_crd.yaml | 1242 +++++++++++++++++ ...operator.tigera.io_tigerastatuses_crd.yaml | 104 ++ .../rke2-calico/v3.1907/Chart.yaml | 7 + .../v3.1907/templates/_helpers.tpl | 10 + .../v3.1907/templates/certs/certs-node.yaml | 13 + .../v3.1907/templates/certs/certs-typha.yaml | 23 + ...d.projectcalico.org_bgpconfigurations.yaml | 141 ++ .../crd.projectcalico.org_bgppeers.yaml | 106 ++ ...crd.projectcalico.org_blockaffinities.yaml | 59 + ...projectcalico.org_clusterinformations.yaml | 62 + ...projectcalico.org_felixconfigurations.yaml | 561 ++++++++ ...ojectcalico.org_globalnetworkpolicies.yaml | 769 ++++++++++ ...d.projectcalico.org_globalnetworksets.yaml | 51 + .../crd.projectcalico.org_hostendpoints.yaml | 106 ++ .../crd.projectcalico.org_ipamblocks.yaml | 79 ++ .../crd.projectcalico.org_ipamconfigs.yaml | 54 + .../crd.projectcalico.org_ipamhandles.yaml | 54 + .../crd.projectcalico.org_ippools.yaml | 97 ++ ...ico.org_kubecontrollersconfigurations.yaml | 230 +++ ...crd.projectcalico.org_networkpolicies.yaml | 750 ++++++++++ .../crd.projectcalico.org_networksets.yaml | 49 + .../templates/crs/custom-resources.yaml | 24 + .../00-namespace-tigera-operator.yaml | 13 + .../tigera-operator/01-imagepullsecret.yaml | 15 + .../02-configmap-calico-resources.yaml | 27 + .../02-podsecuritypolicy-tigera-operator.yaml | 47 + .../02-role-tigera-operator.yaml | 253 ++++ .../02-rolebinding-tigera-operator.yaml | 12 + .../02-serviceaccount-tigera-operator.yaml | 5 + .../tigera-operator/02-tigera-operator.yaml | 85 ++ .../templates/validate-install-crd.yaml | 16 + .../rke2-calico/v3.1907/values.yaml | 44 + index.yaml | 20 + 37 files changed, 5208 insertions(+) create mode 100755 assets/rke2-calico/rke2-calico-crd-v1.0.007.tgz create mode 100755 assets/rke2-calico/rke2-calico-v3.1907.tgz create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.007/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_imagesets_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_installations_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_tigerastatuses_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/_helpers.tpl create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/certs/certs-node.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/certs/certs-typha.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_bgpconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_bgppeers.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_blockaffinities.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_clusterinformations.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_felixconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_globalnetworkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_globalnetworksets.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_hostendpoints.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamblocks.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamconfigs.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamhandles.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ippools.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_kubecontrollersconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_networkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_networksets.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/crs/custom-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/00-namespace-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/01-imagepullsecret.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-configmap-calico-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-role-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-rolebinding-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/templates/validate-install-crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.1907/values.yaml diff --git a/assets/rke2-calico/rke2-calico-crd-v1.0.007.tgz b/assets/rke2-calico/rke2-calico-crd-v1.0.007.tgz new file mode 100755 index 0000000000000000000000000000000000000000..e9636affa7a7bfe7bf6c048ca30733da29b5e91c GIT binary patch literal 14333 zcmVDc zVQyr3R8em|NM&qo0PMYOcigtIIG)%36gcUxM^>v{t>lL$zG-q*NltYV%Q{}g?YT*A zjU}{%~~s{OH;9*(bB3r?V%=pP<>t zLm}R3sj&ED_QBuk4({Ki;flT`LQ>9NpxdKIIgy#5m4g3YFsX1+NTk*ToxVAfXvqZ% zDCQBvC3%55H1tSqD)Iv1sw!xPHK<3o%_pX_>1_6gNB`<^KQz<2`(Kf=DzGB*kXJ-t z#l=+76%lw!`QK=XS40ve|CWh-Jd+sM|Id$~clQ7Blc%$zhyDN0XyN|H6(x6yF#SI{ zz4=T|DL=eDdUQis{sNuWQt|Q)k-QceIU`HTC~WSMD4b)3UpztxGsYF{d8z-4P{x@O zyeNp6tO%Rl)C;nxX^|5Fz&&4>O`l9>j}S5(#S_|en+hMviewu2O7OaRfqHrvFct%Y z{e^}&CklQls8rvye*Tt9^QbCnfr|hG_*GK2stYWd-yb0)Gp_mEX;Di>#3O|4XyCgO zJCfTY10Y+I5*vh&Mwy*lUA%oVZ~cr=oBdkc5S6HwBu9!PJ$Aa>7&K5$S41kqmNkzy z$RV}H%7aAk#7z>)NmcNToTBSB0TdBmLXYrkv0wm!O`42w-Om`dnJ ziaNqJE!e=puN_j_)6`}W%=OMCGMoUCTLLvRK_wET5=0Va_Hqj_(w#6veDQaZsVSNh zp}`=z=5>+l4S!37LV{#`#pq8SwsZr8<3)8~QoXJW7w8rjH90_-<*39PB#8bBs#yRJ zy2vSd#f2u$C4Yg|N>%d3;o*uZ$G9?HmNlbla|k?$E^5VvJj}^0DGnuFO|Zz;RFO>8 zf*j(CP5^ZV%xhZazY&(z$-Ne?M!JzoP__yl0GmmyfaW)vNU?p@jG~!nM<8#`=hw)6 z8Wy8F`!Mg#i?Ue)JzT{hJji9hh|Y*S^n7O)s!xs8sq>j=yuwRUP-AqLZSqkG6oK9%lBQ z7KPSAKu5P&IaHF{$|rX;G3q z0u%X@5a!PuMN3MG+;JyO&y;0FofCvnL2$13-MjyM7ljCn$j(wF$dcZX9KEM%jo!&M zK7RK6#k=h}vs2$srcHx^j+&qgGbK_pUNb%0>uQg7jd64|lu1Q!u8FDkXOcP4^eK;5 zJ*1*(t$kXzn_aw?5E87OSp~!G>?$ls(=!SdgcCi{yw==qMWqrOq(6dJ`X57HQ}nX+ z-FG?9Zj5kgq=7@mbMoT$$@J(C)1&w@QxzcRc`L~g_HqS4ia{7yYt2_R+vr>Di5*Js zqu3lpxLWuS3xPMotZ?f`sZW#q1yZ6mUzUmsO{l>y^}?TyZb+IT*761VpZ|Si|J3?G zmXS)4{IV;LfBI=l+=l;VoaNN$4(R(IADIu6{H+tK^^gB*ed+&N+fDxur1TwZ07?D- z_~`iQv!@;X|LK#X*@OQ7&uG6={XZnMk7ol2pmyy5!J}p5evdce2GqBQ|pt`{?(|?p}=yYP|3A;$%p~LG7_kPRu7>P$-1hzFj|1}B9R_Z zjy}!F64!_pL$_<4b^KIqR6`g42sAN1#cg8n==3T5Wm(YEgF6oxLN>P&6J zwpuK1th#Mvn@hu42DI+eu&>vNWyq#lyan;9ITPA#>4&qe9i|oM#j1+v(;=#V`uZy5 z|L@mCt%=Z+s7X$7L>OKaZgThfP}B{;;0iBjK{Z1Csw`o3*^ko%ox^wfHO>h-qcZ+@ zKxfiak0~SK;_4+A@3GLj`iQC7JMDY1Z?%#brXnEA|MVLfKj+Q!l8fQ33v3p>tim_P483iw{PzBEv zN0}g+v(jZ`Vwjfl$Q_kx+7kRM3=NLpY>jZ93nC?2;*u5{I2RW&OHE@sL>EiMOR5yf z5A-=r*{UE0u-iqRRB}X@h!K+anH*8d?1)B~9(7w3JiD3GpP~k~tx4YdlY1rL{XlFN zXK%pxNA6HT*h;MvAd$1r0>$E@;QA0`D^w9NVLXS~2IK+>qr|i;CAOPeA&p8v)W^@! zC9H zPcDahjQ!pvXK{P+$OUCsy{^@YM`a1q+RJ%)a_wFU7LzW~<;itdLP)MC*sWzFNpJ^M z3A|j=Z0vbu+VEL2q~*W7+!E>X#Arr-t( z5q3)jXC-0EIA$yg(s;TwUyR+Jxv_v$qGeGpryL+!DFd$56lN!5P-4HZZ|yEYx;G<_ z|8({8KGI{U>Jdx->iWCRwkq)*E$dRV941RD!Kzg=s;uA=89q0fPQ|^Qu5W4siC+sm z`V`hEL}21t@kve;$>5w^U`>?vLz%Im`j7R37#3%S1evlf6urm&@qO!5+X2;i?iGXE8BeGpkzh5-XbFqSzn< z2wCa<_NkLxf&X>)K+2E+ej8@iyTmVv(t<1KaX15ps8Q9Qi|rn#rEy`@HjQ8ZJ{eY+ zGR)p+An}vCV=6PH-63mzKMs7KDmkYu9U zk_xF_^15r!k51c5{{jNR!EKO+CxXi+=+Ic;k|-i#22EtPua#=xTFe4DaOaVRvmjDU z$a2YrLQ7gGk{mM%R*n?KY?`h zK8ITSJ#)s{JFj4^Vm7{qQ>nK-oJu>+#>1)fa4Kz$?BP@z<0RVqFw;yKF7L@J%D$j(D~_^>33R-TXOs?2Cd!i$!Gm`j&8qa z$4B=e8%@-(!9N!9I8(F-jCkzYJxv-75zPO5a{TPM9_gF;$wwrC7TkEBC!akX?DOpC zINirDmig$2ULzLXeE7c0PQ)cHN11j10$29H;i*Ja%GyZzk+UbV+$UET2c9&{$AMww zc>~QZe(S`-S;otf=QzR`&E<==i%Y|GyaCyKOHR=%>zQl#tO;Rxf!=*lZtNBLmxuaq z(_hPoU%s36(^_(B#}iq(Q|XY*ci{wxFaDNJZNc! z$FPoztCLq9oGPA!xM(%XvJsOKcbhHzowr%swR>P_!^87yF-|D{blw^wjM`i;>=3nw zb{-h|9mIW|US1@CUKuy42q5-Wg2PePv(%c2&*Wa8+!Tp&_^)1hEu@l6TpK3wg zUY=h^;rbpHZUUyJeFwM1KXLZ<>NF15^+>tO{J@Mif3UjEF47!^<)LdAIP7i3`1hgN z0Fy*Dt8oCF4i|+HoUO;Y6<5cBgbio@gg|;@B+CO&P2)|TlZvpMuq3FEN6f z07)vW#m8bZ)sr=FlMJZBK>JT@H0awgNjpI54xSJbef;95`Z&V7zaEGGMb39A7jaG{N3lc!(`jF9+?=f8^7# zHEQ$Aow#BIWWXzv95JQ#Bsk$j@1Dq$H18YYd-s-&dwE?-_;o>WZ@K~3O>4`-TQ9hr zH15tKgGf&L6S10z>DDt$I}S}{ftP{DXbM+T2k3fJt+5F?)4b%=hkW+!ODsqeN(eyP z!Jb>ML@x+hqt@cd*2wkx)R}5bHJX6k!#Ba;dY2gVE8GlMYY(hXbr}|^J&d>_8e2uL zJu=t?=8~pKuVA*chaUl*5+)|FiqVI#xY4J>>y5?<2-|BiYMS~M6MXL9OHbxL1g)SY zjUGTIu++!znJ}NSs#UW?B$9Qu)?7HNY7=2eN-m?F?g?PLbHUE#Hk@FAXk$2hJ!YEPbojlc_t4t&N5Od_@jw8 zJ2cjWiT(7%gP-_dwZmbL=Y&Txvgd)`9S`LC??JBavZhP0lzkAvI`IbFMEp0XbirRn z^lYLeV-l)qRJCMkyT!nI;Kj>=W>giMVSg0Un%g$TO~$0EfU^O%%EUzQ+c@}e+a-bi z8n@&?mvq*lmQd2$qwiRbso}fkBJ!z0t_sY^WiobTEKf;p{Em3l|Lva02#Y3yXo8-P z8YdX%J_9~MwKF;fDJ-VumYGVlD)<5%upmQnuUS-+ZBYbU&T6~HfE|QYkh`p?A-vh^ z**zk3QoU#<;+hvkgvnb*O<(YqPfx0X-^{e&UKeW4tBTyFyx-`azU9v&V14> zto~{gs5KvfyGv0RwC+2}4#80~{o0MD$=8Cg{{EhpL#)wYO)Gn^njU~pC}4pa-$gS& zFt+o5)VK*2gt;+4Md8|)^|JhpTd6$}=pCEM#-?NN#8ZYwi<;m|^BwPeTcC z`GJGDH>CIJDxrN2dxv>4os*2Se4NI8-F+)u8Mt&If^x_(sc5fUVZYwqD38rC;b@jG z9pCYrI&h*&0QJUceb%lR7bM>gIJw`kQ}m~elRFO(jq5yA8c%4V4(w6pwvAn)h6yaW zAh$%I$Htv6ezkK;GqpcO|3w71d9PMj(OcrSnX~*Vd+uS0X6P}z7RR$JNlwAoy6+B3 zV@!_`NDw>sJQiX!tabs)qbTPsn8sUd(^$(pq+pNIB+s-QF-XvDcj7@{g>Mpi4zWzH zFZ^B8A4Y;edN;d!?zzM6DHbmaa`%=ObxE$U>T!H;J1Mt1+k8YIOa-9<))J=G-L+oz z9$XtZeLTZUgsj&7LZ(T~%lmVswDY9+{}~y$6+mFgw{zU)i)3(gQ!+Rf&z z%~tjIiT;C6y+eBFO(L|uYmo)Nby!cg@4yD>7)CLUlA-GsEt_9^sJRE(R>JTIH5(81 zv6PG*0-TK{VaDA%k@QkKQEZGpqZ_%GVjFz?aJMP6k5B%(Xx4xasW!rVK9p+fqL`CR zkUo?0cK-9AyS)*E^Hb9+sDp%MCOf{jul3r*Y$oxlE(#wY7 zbMsK*(uN6DIP2A#hfEA??0x3mWl(FzBBge|^5C~b+*0!X(57RYyr*hCF$0r_Fp|UH zz&}x0@A~!G>lf%G&#hxbEy=PjjM5;dK|0t2NJ)BtYMOr)Gt>Su65zIAGq5{)Ja|I! zFHjmQ_dL3#gG78)ffXe1F!@+aypw}4v0uny>2{lDh4rp{<4qax^mVJ|09Hyr+X`Ck z-ARgwk}^ZmSuHeWc{Hbquj`W~su^tKBvpu6JLu~GEo$pY))=dM(am^SY5rp4ZkiBT zrws94bPZQqQc?Efy0O-|t*8B0|GmKi6LkK~yyw?GADRg|>FxWvB5b~<%RcY#GbqiF zNMMrKPK@W|6;Xm_@{0GxIc@xK`%)`?@n7eW*alOH9z2uP2t$T)qDm<5XE}% z*8mJHw-Yj|wa^DmpLV!~)%Lg3nRrrm1ib*?L4xGD5?GN{j}3Nfb=xnbJ)CUX;huq+ zyv&;70L+1R@X)Wl!gt>>e2ZxTnRMZV*fm%{@S>n>Ww0F+f%3+@;4rhUfDm9Tr|8NU z+8PJznBy!$e?*_Y2|xbn6ip@*d;FQ73;`;RmR!q&h}Qx&DWv08Bg7eby*z+4M_}-J zuje?^QiVw(wIEY8*XKQ!=*&ARqIYhdr>$v;*3X#}66VET*NbV!%RoQ~|Ab&2dHCen zlc&%6kLzJ~oU*mz@$29LkA<<`3L`xg+5~bPc$~1hT)6csSf}x6@kZs;AM#EVuJ*)S#GwXy}QjIpL=>v zXa4q}ku#2_===_sRY6`j$7XXAY;9vtX1`7OGhmyj_sQ(HZs6TnG2?`pM|8(>Mo6xO3B`>jk^tMrN1yDqRtu%uvwA)iDhQSe{lQEG7j#8g zBKQNvxkn3USgfLeWs;UnB!C7CB<|aCF9)ZO6AN;^selhzve!G%@w-#Q={m<|WDs1S zPhYb$QV=*=&l;-BzONwWRKIGycc$jlw~M&<&jw8lyI$EE3!Et;s8lqI)z|>Yz_xZ3%^@dO6#cCsTn60( zf66w_(wvieDMTGh_-dY*p@=94Z@P7Z5H4fjG!ZGZG&~Ev zCv>$|XlCU$s`ezz#DrJ-DIrBON>=;DO(2FC_uqz(B%xA?a3T399L9u3AW!IorIIw6 z)}H%r?rPL-|C8|oW=V{53c5J-E-Vko?+ z+ZG#uuqRQ07ow zbsM@N8vtdir;UQQ3niGA@Ic&dTihE~uI-HI=4dofZx57YolW>nl|JIxZOIT zUrC3+9mcCP&(fLzU;5g3J&uAqK)hfF=#ne_k8?{p<3wI^b#999e60?Wb(*)^w}Wga z7|`yEVa9#Wr8o(0V#Dfupf2pP5FMAU3#RofJCWY6YaBZ>&7kFrRdP0gGkME_YzL6u z)lB0Su4;&4G8JWCb13$sr$73&N{chy_H7SB<}+ZVarK#YfJjUbjq`(S;?v zA&MJYj1-M7NIH&6CV^cs+0D#!$}T--&4x(ezG>Rw3Sqoc+;yjW(kl*N{~~U2ThQ+B zIRO-+IS9 zFe7=(CXo+~znhCy><7n=HYV*-fm~{FKO;;P8^jl|`a{+F;|1yNRjuFT%IMj>TiLO6 zH@Boq%5c&8Afn7=M&P$Z6qxo2n%=i^_iX!m?3boA;h3cRVgF#`+2V#_efm^cU~}^; zgL;7Xy+K^8s*$&XfBO0=QQ=*2yRjYlrzBGVg)6+E1=YyK&xfJxr$cpZM^v>PQ)S1+ zkz8E8#kgBhsf(_E{Vg9{H|$-sNU1?z8jj zSdlfCN}pY0Yai|X*}agU;h<(|Vy>*?NEjgDfqPw<6&vH?=QDjIAf_sE4px8ub*u-i zt~f8ouExa`^lq$F*c&QGb?0kj;*$2p zW4Ko0&30U)_oa85q5=MX%XxkPSwiwy4Ky@H-x_N}TNFIInbV(kyDi`QlY6b3ME~OK zjS-daP(j#ArK*FOW&-KV9>4_zqCtf$A||%boIz4L2eD!08_N2-b=4>Z+vNB;dVFzp z`*i;R9UULT-_Q3`Nwv@~q;{B+Y&%Um%&y-G;2~p))u>Qb;u@SETjN|G09k>hEHnr( zNZ5i8Nbnj~Ayt;AJLD0{JYgBGWNiel-6-xne6>S$EwIA`x2Z@^9&cZgXR8AIi21y@ z8X}>g%KOOF{l2=mIu%^XdA(psZ{()`V5hf#{r2Q?T(4ce9WCbEw9$mYuzFpq6;Db_ zrgefuPp;jI0a4H;x;(k=%0Gka$c0ZWVWL(XWF_!&NwZx}Thqp^`q0Vi`VF4Hrj4KV zWDdP{>r8u?0k6FoTX$5$n=#ynk|?h=ZtX&}w}*@3@&4Z4(4>zX|2VskX41d3IR~MF zvij}}D-1aU$BL@ow%+Q=L}a4qdJkFbC$uFoew z&j^x-N*fz|O9f|ebqO{Zh!h?^zk{pDx}A<^Ye zS1&(AhAve-l0;rzf7jWbE)q-$%w$QyhY-~a!tm0wdS$e=rJaoQO6?ID-ONzHH|!o{!#-ueRQ7>yVDs`5#l-g)7t5lxM97#7Iri zYppcig8sN1VO9%UD|LR5T{5LvLL#PnZ-=CqFhP3G>O|_U;oT4|mHl+&x<$)nKi#QZ zHX2bf`{{j3W+PYBOK(CKSJK%uk|+fMX;2jo7_LTHe=-5p>$)!GjK(v*$Hpm@!xgyE zeXDQ}9Q;0|?hci>hh&LXW`%LpxY2kSWS}bd_C$@W%sntFn_>4p)wu^C57h2PWABPb z%dq2aOUKmmM)$AhJusN2+V_q%y@$*auHyHH)%8XrYkQ+{^}V;|@ne+0M*U^5cdUPn z##7eFdf!`v{a7`>BLlu)-S5%k9-+=ekK5-TdfYz$=*R8z`yRLLcg^XmUtV-l@I0KA zL3=nWAI{2$v$AOqXXU_P|Bs)Q1090$;IDjP=P{lkeeZ>a1{-gUWW6YuRn13= zMZt2oa|G9F%>`99FhLL2UbDuQE@kMX3|*bS8obhThP1^daiczBgWQnKNwL!CuM_s6 zwgGJ(B+A9^WnYNh(e;WjNTi=KY(O|ig{kmGp?YGu(O;*}W}k-pKy=W%oC1f8FrnZBpBxFyHWQc&A{ zpL`a#Jazj%JC1RbQKY6f2C$NkNpS8W$^%c(hTX4QH`C%4f zMfnGGg^#k}SRQ63<}B&DiHw(Jr?!2QU(+pMUq$>O zJ#-5!Y|#5u&-a*q{3`mvw2rE#@7l0GQ?j~#)5#O;K)-a&{h(j6_P%SQ^!j1Hph!*r z_E(0>u#RK*9lqBhtZfdSWcWL?yq-D%i4UY0)Yspf-wWo+H}esU={}IpQ;7 zON8G`0>n}7>C%0H%6x4dMRB2z-`RP@WVVYjrWYlYzmj0 z2PS~l3Y00p5%&pFUR`-sBl=C#`g$LoJJtuQ6~^}eu159zZ?*NOxcOk8=5tg4d`HK>x5 ziR!j!ho~rn-_X75*dp^?Op~P`TpL>wqT7FDN{tFDMFe|+{`>I{zyEo%|JCEi-_ItW z|M>gIKTP3|-|c_3|Fiqg@Avl~KmPukS6^RWo&QMpfBv4;<&F8@&yT++=Rb}FvcLb; z{~JW@Ub)_z)^(8wN^8y2NluoOjX>AddH*-r#v{57*)Jw-;VRmz zPgF>mGlpFuVxC8tk#DXF%*f?nOxiB|X^?qz#K(R-dLpYV$}tHS;<1d2n0K^O9EsW) zhnqEU-VjuxRlygLB7n$e81w~3n=NbY1Fnd>&woblTt*Xbw}_|^gDO`uF-BuWOe73-{NTF`0ObJZvx+ts|U6cSKoku0~N) zyWc?4lN6~u8Mbq%gisR9r1ju}nnD2}IYn?k+b%Ang|Z}IpV^O~OYX{49iS`7@74SQ z8pS0y6)}=^3`Pkk0~t!&#aW53!(+zVN=@4A7?*N1ZSv;R ziOi*7G}#^h!)%X?mkY`alIF8+(bGy?QTXLyIs6yU`_RcBlQXro0=|r^NT*9p-_WDR zZrYm~)n&xgV?F;zjhkTSp(Sp8Ag(XD7mc(1{^NK z%(JnEQY2J)4YgxSDV&M+D{hkou=+NxB>F zu`R4>X`e40Z}SXeVD~hlYh!=cGJq+@v)`N|4HrnW%P@}~RjyXCBtGw`+lF>oJ=i4F zB^OYx^RacMCATzF`&0B^L~tNmMpjtSTc0m=AR`hKJXH34#uClYV*rV0S(2QBseIoZ z+~(pWHS8ef_jxMJah%EtLl{k6Z(Xg%hE3bL%WYB_Q?W<$=$_oQE(vmT`{GMAj$+ZC z$o{VB6eB@a5IJvl+z0N=4;1;A1-X06i@JmgXCnm3m#r6UUONy3!@}jp3W+KlO+2JI zVgsu$fW3J-GJ(j#?>$rO&iD}QLD+OJIG1EZOa3waD{txpwgTd}OTFKtVjx1kxZH@T z|MbFjcE(=k8>#2nU(JCEj#ngpC~jrT>Z#(_En{xyECLal~nH!|>BPtidA zJhg+u3Vv;1ohp946$B$dcdIMd!T~-V6XNxVTW$c|;r}yA4Wb>&4K|^ z_+u#Bjb+5p|2=5ieBz%>-E~pSNhV0l#NYNJ?Yv@dOMOKGpYGZuSaf#GsLjz9h^^|P zK+=LVsr}%Tlf)DWZX0b(A=u>BF~wm&)OZ7~X0Jh5dE*AwWYQyy*Q+&HfAt!qlE^8J z3Sz>MAXTCB7O*gLD-j{eB+bo3iAx(+SS5-}vgq~ev)3=sNuFD0om!G*UAUS#2v_ti5t4FtfNm(u z4^U0>uTm!SUtU7p7PLm}s%;OnmUtSZud31>YIfa%)Uj28m8MUdKg+~QIw%wSm26xl zU#o0%Wi4;|fv4UG0$dp@rJu!xyX`=HQBr2MKvoM)eIDKE76uWZ9xu>7W4K8bV%QEI zjR|9m+WJm5*9pZ2tn${>+z#}2${kO5j&!Hf@XaL^khOG^vUCyRlNt2Obu*H#&eP^KY;p@MU1ULz~bIErYylnEka;gySO=6 zb2Q5o6tV-b4SGomdUx6?TAt}{A}r`XHrDKodC6gEy-^_@f}El&W4JW=!fDE43F&SBh(3K2BJt@IO(qk2 z44a<}u_}(1T+6Zvh`ffh@wbEl`9fw?MqV!uAf+7`2;b|u&$Pq?i3HJtOwl}kxr~es zbLO3S(L1*))7Ip@o1!@(UQ$_6wXPS_jF*AX68;Gxdh+nevnNlV#l?qlZeV4LBGRrc zBfMXB@qF3A>!nRZ*MWBvtIGuuT9P<}+uu1+HiUYOhkQfaE(>-<-e@_7M5opUYWogW zu)+(;i&_zf*kf|{0zKPD;4V@TkrAe}BBwcz+n-@(^9jxTtxqHE98J;r9WJYaynw)g z0jSFQ4_M3Nli6<%^ejM%`zN#Cx=Gk=R>PY7-s~)D#vBzGp8~is8ZPzjipfkZi@pRb z++}ON4^#vt*3_C%VOCNqUR8rGJm7D{+!A92$F4D`C|Vlzv*G<%D2WzB!C~-aNG#Ev zMlQ(~!7*dW8Gs4tDToW14awl3m201%dI3Id1xS#xX90ukSwg9pvP z*q!BPj8*lGvl7{BGiL)dszqZ&az^Y3(oLL!ebJbarX69tF)(?%qA@1LEQ_YR1Qb#< zi1b)fy~WnyZu`dFF#aW0)ds81_kW0Ssb7^5)qmMrP~*4sAIE|U)$2}{OUkGkL(A7; z|L#Cs41~#|hi$JIHLtP2nIeKpr4>1SoB?!Tj`vkTAWLI%I9o%y3| zne}U*&0P=VLlXs<(u;!RXFwx!kHUp2(;A zz<5hu!iq|lRmRO6xvK<$bn9}^?B$xvFag@=0obgl0#!d-b1jKrvpn$CTgr>1&A9NHanJYxAo9Rzp*P#nKs~?yWO_V5Lo}V zo9^feIPGR#dXb9M>5R2|)zcp58N1y&L7_<(*&WBPI8Y{RQCAJW<2t+Rj0%D-*numE z@0{ww8uYtOH9}u26Vv_ej&I&`k<2`Nz!IGV_xk4RJMS#hdYlw5n3g8&5@YPZo*$K6-Pj~oQPm*64tYm)V>&&q?W_aN&% z$a)X5UUYB|vR?n#9%Q`-S?@vCi?;ti%6dC}z*rb}HhTWW*oeDT0DRQ^*e%^QcZL;| zufdFJ6TX^)>_?NM*=!7j?owbL?NnrbJVi|coAO{+vkF7EB4gKe47q%0xfQsI+Rgd& zy7NlX`&1=Tx&1=!ryuT>3AL9;Rh`*;Yr49-`%3Vlwv%*PA1aUJm`;vSh@a|*E;E@|u;0Y@0h*`tyuoMVMy&oRbT zm`*J7$!;er!lpO%f-GuUZ*tXg}0^BjcK%8{@D#%`~IuP|2ftC z_K$zuJ8|y0d;335WiuUa`u+1q5vD#0PbyvQK8laKS6$C^xHSdeWVR+Hc84;r2s^pDc>84D`nju>1skuM(kUVt+0nOMiW>95$y6=KA+G482{n_`GXISi-S&E< z!!5B9*mhzCH19Sg9zx@IGttfm`OW$Kx~a~g7o$7-CeFX1zh(*agi!`wq~N@1{K^R; zEU&o9`$$k$(CzH*XI?BC z3ih;)^m8@|%`zs6Mq_aYZ#POJrB!K1rVc+~0kx?x(lEoZb7Z?sIxq zS9jN5y@=vqFhKsN0BJzzOr%wr&7>7L<$ZWKOxZM<&DA(;bk%q`l{7Uu6}0SaO&raA z)K#1Wq%G_nK(4+3UU(gg%!#K~Kuqe#{OQ1cQjcba%8NgNNu+$$iViuA<>Ud1D_o#n zB4~}7gII&AmT8~2MPazcPNRm@Gmfb@-^tqgS0FeDP;Mjf-4+vv(UknD(5G@Wv*u!2 zQ&z|y_=JRnh5UX{Kp}qqIw0`wZEVp>Y5~azpP&d|K#1q_>hA3Pern3<=*}bxHIUVz z>f`Dz3{azVqxGOnQdS%(SFA*Yil!ol-jyxBoE@&v$&cbb<}OR-DT`plEHS}q5&NT> za4|h-CjCS;KlS;ZEVp8;NQp`+C>uW^iD*n-Dz*|TupedPH~HcyJ#H72^Jo~ETlFN5 z@&VcAIStL?NvQ|q!+x9;&~fxjvhd;C=nuKs$3Cv`#J7;Ir>p8NaG^+$;00Le{T9o( z#x9pihec!gMDu=sDwV{2qqYY>h*iccOZg`p&XWPX$3$QPCrz)Nhk}g6j8l`ZSjpQZ$Zagaq3LfP(lvN3byt3A~=Wo2L5%$ z56c2-kX6JAHclx<1=mkp8q~e!D0gBu6c<#kHSaJrhp*aE3G~1|r7$&19~|N>qEd|p zJ)vvgrglfupp88^M$MR@Fc@SP8==;ROlVv)OjjIZE=Q?w!kTD@NJh1x_@qo@l;b;r} zoO5J^riu?Ll~#(KW|ah^Vn5WTlBb3?bCy{Ro0W7oGD$A*Q;M>=r6TTg)c46cWfC_c z=~)u5-FNDQU2e9gw|4Q2%l$3=eZZuay*Tnb>^6&DCT9sfO>j`k4d=?#wj+QR68&TVIq>^^F-a&2RAyQ{sE9V>Fn_x=~M74)~4eNqx~8f?$e zz=+j?EdV&yGIBcd4a7jc3KFDJw~wZ8hob))WfVxMd7*=W4YwmLBMGG%y@!N9Nz5ys zMexCwK~)hWELB7e29)g+2nRhtfB-+;G$#0c-Df2HWtBApT1_LzmxBjGe~?W^gG_ua z|Ln?Dm{y$HO#fyxOX7zCY?G^=q<_AVsazG|YSB}cYE&RHmz!QOFRK`<-YGqx=M?ap zk&+HdIj&oRq1jU{>$Ssz^;zWokWU{S=RUt#JaN_Yo_)WRWfJ;^sXH0sp1b=*D{}ls z#(M}u3TFHUK9xBF{ajq%O!t6A2k+&NLFR8&`u)W=U;Jx=V0!=;@lE95{8K;7%+IH) zgroz?yZTG}){o3j@y_TR=A-omA)y~h6G@)@V_O)47c3`{_}mk*T(3Nncb9`QnFF1- zDktMB-kB@A$Wb~)l_9`d?^N1%ptkwlws_6hYm3B>jC%e6g|X{T;Mw|PCC7Kr=hfSp z^Z)z{jT>dI>&p&vv5AAz0LY{5e8W7O!_fu7A67L~zo`>_XE{hvsCETvkx<_8vCnYg@VV4E+I5H4khgmSr9Nsd!6nYJ2|pzcTli?1!llYGJf>fmTFz1}D8Q}ld^ojPh@G=%8I}kqI1{h_ zL2PN4iErJHqlU@QWs)+5!S|DfXyi9!>ND-Peivf#E3MgBsSe)QSjiLES%(EAJ*eJd zY`2mN7G%k_5*FXBp@9MVE(g6N0U-GGK+J$XL;?rft-=}gRJH+x65WNii&@$Q)~X~i zuwYJe%bL41htsp3@(5pl(tKPxb9}kUTa*!kr;;u+Uu{nC158`~vRT4@fP%WE*4J!Q z_dMcM8SzqMw@r&Cu7+=Qsa`)Ds()6Kt>R+9>3WaO-pXdu6Q@)n zJ>LK|go$;|lywsYZafwCy@xH=QH=8FX#KJDFzCvmFGsGe#Z)P#vf3kb_8?>?cyf?Suy;YfNi7DbyLX1L{DtAtIf)G70uxj5lDwiBbSZypjl^_o0nB zP5$kit;!2!K4h54{@b-d$!oCEFKm`t=rS>%!spc}LfUovLP}b-M7iT)lUk~n*^HJc zHko3ggMcH)DU8pLurXJ%QKBm@brx55QOm8)ZPt*&i%V^HGpThLS3d|q10HG`ktW^M z?YT?&z^(n^*NMr7&)PNdRpxjfVQ4NZhhPusR!y=0e2(p~g=~U=s?roNz#kn5EX*Gc z0$x@=7~OOLP^G|)7zWB@7Zt7xwy)&n%i-?I;Y9l8@q9D0HiF3J8EU07*jZC!viMP4 zVF(gYLm^zB4v_U2G@k^FENazUA3opzoNhLD4X#S@xr~Z4Hmv2+IC5&Gn9931zpXwa ze~zMe5pVR7xKpmiZ!!3^wlZBDfP(fAo+iQL~twy)M-nO~piN zKLUL`L_e+tOgvH2QxSd4y4PhxQ@)c}NE=sGNj6}xdQB>pxXPoAu$n>2YP0x{Ygs!% zK?3n+((>QZ7N6{TDOP<%zc-e)u)^w4x;Y_j3v8WcVg zbg&_xg0?mtfulq!ndU}^B9Vhpk}LF@DS{Rw z>!#Rrzn(+OsfdWCZYKEp!+p6;JDJAz8eZ%;h)NHu^%AEa`a58L$aB0xiR34l&nted zy-$?+OVB3MDY2g%NnHr>t3xD&$p*h=&eQ6lI`?Em%cMEYu}E_cnuzh)9}wf`QerS> zX)bcROah5lFvKp&^Y%(IPrmIa@>f&Gjh4b=t)Uy#0B0jGRS0z{(XGXlf6`nxry{he zE5v?Ymc2~D*2ew>plTs94X}d22ev+!QVgpmbCGOFLy`>L!8ddha3+vu{=hQ&8-Q4< zGUgFXvadRdPqsI;3%rLZ{`IDJi`FFc-9x}9P(<(*L}O-qibqQDJ#aX3IFbvzeS0(S z1m4ROCLIICM17n)cGG#lWydzHf)IJ$jZrrH`!GWMA+mP%{PFUg!XE1_U1V70- zK_kV3#GUJmrCRi7*)Xi)oN;!kY(Ra@BsX?-&KO@$;4F;dR)b~_-pmBkhDFQ??V^mV zfn+=Df*c2Jm0;Y`*$ZXiV4KW@6zva%gvs6SWW+O!HwXxZU_|dxalUU|AqL5O!SQ&> zp!DbHhWs?<d+{|lsi~A82$Z(#Esl8{)LUPnYQQL?bKV<^VoW{hT+WRW{OT(6v zPl2jjcUNZRcx`Z73SGPgKv|T9*E8>AbR38G;?UZ}v{YSW6V35Ox7lm<*p!K-4dI8j z!x{}=ffPyw_H$Ex+^;)Y2@y}c=V^RN;m^FuI>Rwk_$Oqfc^R1|w*pmo?@)w8xC~62 z6kn1+xE_{v5b%k4t-WivBi|qsuM?J<(<&Agoxh^CBi{_y#!p(0L4#%yXRHa|WEXg9+AaA0D5Q7|T^tNkJ&D{t*CJH(o#gOn<$R9DZ8811LEP;Z|%xZR$$g*#WLVAJ! zjOEJ+nkm)il#(46J5&xiJ;}G{#+qhn<3XMfH6SoH@ab!dJ37iK;O6%e#pVY!lt|GN zbigl2U(u_1_(3l>deLiA*nLaGF}i(YC9RM9IFui4dY-+f`4f*JDLJ`IgzGUND$&kr zmnFhn_oO%@q^>l#%%QUkr5Py7M4q42%o&bTR(kVOBd$Nbc1oStTPAz66DMO;ifa$2 z%Q5Bd6q%|K+(jqPR6n-JSD^QG5IW{Pptq1MFZbUm1o+m0=(yWUJU;@xq%l@pfRF3@ zi*dPM!1Jj^XW(NRKheau5m`F4C%E>R6-YTAmmD70>UcpVc8R|88$OvK!ge$;_4C>F&Si`oTv5*cL*)I>Ic{_TH>a=kY!vh z#0Arvm}D$O!}0qV(7M82pSiG^dL(sQpAN%=_^_@140Z$h+ZlYH9rQjjTt62=fx#r& zrrIaagW{TFjURgC!aI@N;Eq4vMT0MB#{9jTT3@0Tc24xo7mc zy5(1NnRl=AmFWP_Tj~xzU&ax~Zfa9qKh5+cvku`J4vqZS2ECnKQ#!O3>S8#36@J~1 zB)L(&ZtNep{f_vvdpRx(j1R!ArAYzS;IHe(BnLXDJr9fE~S=kgXUM zWz^^}VPT1#Kjn9o0rOV^O_oT_g7+D1S2^8?|`lChbTRr!l zD$!x!-Dx^5!I5BAfru@feK;8?S4M2LYmlOKI`M7+DL`VSIEonWZ!q^5@meIsbX?9Z z$B0!L!0PG~C@D_M`Y@I*c@2B+3IeLmoKoLDfQ!8gv9pgOO0@6oxp-@N{;3Z)MCvxD zRSv(QPw#so^5OcS0S(bxF#`GS`hlr4#hpz>j zF#z)oLLN-ettIJEPZlx6O%pF~C=+H-{om^Gkl>%iCEQcy9p0!)v8sq9lLLkq7ad%p zikp;x-%&<5bz1GB>1}4jQgd&p9uJR5V4@h3J;y4Klx<0yv7zcqr?NxVyi8x9hX^!P zB;)kJUE7E`oH^HeW>S_`MhMp!-q|!Ggy8ypAb=UJjY+*gEUn{g`0nM3%Q4;%UEZWV z6;VQmGTBM2I)*|)ILyYe$ZBOTNq9sWF*t04erk&qKL+9yVMMQELrikC(e>8LoT!0? zz@Flj`){9kCTHGe&cbkQb3>iNj8=bN8%oQQwP=kq@qB_&OU+s2&kn4!?;|@R-$(j6(Y$vf?e3LF*PZZi~UG^G};Pno=ZmlQWav+KpDf=TKTJ!A6GjZ&P~PI#u6% zJsL*1nbPZVOOw&G1%A;N1QBJyA88QvEvCp!0~$X$#MfrJC`6Pv<*mKylXGP^LGI-B zP`N~NFcQ=gLtkFlT@`Z=Ho7JCt!rb1!Bj|ZMZJXEJHiYEPh9;m?u3{Rx9AIAh3F06 zA!)EC>Jeecz9q{Ex-&eB!OWNvrbU(ypRHHF93LYW}g7#Xb_fK+gijU6k z5VGdbMrPR`s@l@>Qw1pZ2}rY4a{bn>`D|P8`qL;HzdCJYQNm}h-+xzb zsxLU0pcl)v?WMPUu`&S1SQu%O@t2%Aj@7Q7n`hs#=x`uuyIgD`TP~(w6g!xq;Z${7 z1ye6a?*o9{HR#awgl|1A&DuR5Zaf9!^gde#yY1~F%ks1=?it33L$~O~lr*_SMRT_e~$)ZKiIz{P?JeDYHeCoIu3sw9F=H|JK zrc^fT*4{|I&vAyu0zfkK?D>m)ntWLX0+9(zilNdk(Ya@`-=h!13zqK_58w>KF4BQWCtz zXZD8!|2^#LX0w&kc7x0pAx&Ol^+dc;v1lf6OW8`58uD)QRKys1;ZzgRQ2G@~mTuZh z5J=CLm(Z;Btx4(DGJJ6W9Y(vqV1vK^BWuOB1I=mAC$(unVlS7zzJoZsMeIyLli|Db zKuCG+&%hH^6!hNo5^$||GLtIB%ihEW?a|7h)k*|Rbwb0MN?1L6Z$+POdzhJEH=Cv8p0x~*e&=n1(BBYQ990sQy%V4|tH!#itw188 z6rQ?ndS3n8<^sf<$gj(dM<1Nn;8LBEe`Ak@#jM;03nE&2+hO6<@233VQW>h~ulA=- zyL0TFU6*&Yd9G`-bttMJ638T8d#Wv)hU+|f-C_SDcf%VT{lqDIOur_(!FNRL*!tF% zl_KF^xukr+aA?Fm=}g;a-0}&+5ul;|``7!QhjwW6gmM#tcJAYsADgZuUy8*M5#`R7 zQ=)SRk}c+ngnxXvTVb_B!26Eohf~B%skcdo1ap#^xZV@&%Z@?Bvl`f~pB6|ie-no| zL9?kI`8zy4Y;T^!gc_7hz7G?4{Ake7jme~|I*?8)lQ0T)$xyMB`jzwnTc-0fwjuk^ z)J|Xb_sMoSq_1b-x2>-L$u5K%dygl66y)nA7b`fPT*f;FdUt1jpqqfGqZ%yIPKDG!@a0J(|#bqSQ{fq=BC@n2opbM}uP zgY?>l#R-IWXZ%^B+Qm;VqQb-FP)g>TBp2te1ldPj+P&tmh~Y}@2$t~TrHos=C|0-K z=`4R5yKZ82{52ed0`DIRzAAL5r@yC2q=y_LNO)&p8f@CIb938$5Cn#fIK z*)>^Zx;plI&*szYaIMwND>fW=qV~e)7p_5+X<)Qs&(lNtO4IAqOO^~;^F2np+#TYMxK}mQa9$qc_BzAX zu*7Lz`n17m8aa3wU9Vt!-fJk{fJU2QSyTZ-3yk;b>Y7*Aa!a}X{PcT#W8$ z?LpA_oUa!j6Z3 z>(m@=psmN_GE-oNWbUiPZdr1@4}z3Xl*ZUJU~YU>XV`eM!t7b?U;J{IrA=D*dlr=a z<=FUFqF!KHzX^JxO@R7Tz!ZzlC3kiR!tbvvoTGVRcO|X2!VmqJ6}CP!(^Jt%Y|)J( zxP{Lh!mjK$ijs1kc?nnlbG!sAfnw|K=?AU1%DQ!p?0^@a5bgrBTY z>68%6`z*Y^AbmGVj1GP0<{U2?Qnzt3izb0Adp|a*XjkFtIq&ne{(gC3UUVq22peh? z-rXs@?COm$aq#Z`JC|ZUq>vFdR?^b<3dQ;QckyDQ8?Kjea3O04;m26J04+){yl9gK z7;8h8wT&TUdKxGDIc!%tR5qB2>0Abe_Ft{;x+C@E904cI+27{78teZ!KRk&9_2T`^ z$3MCi$-3+EF1Fggs+Zztr!8)NQ<9W!-u3yszG z9A}CmIOCEYw>R0?pPi>M%=UNFGhJolaD!H4s&Hx;xSwnRhC9ne7c@Zv#q5Z4{C6K8v=Uwp@dV|n96H~8kVsYVwL9+_Ac zD+21T0sq5Q<|TVXi=Rb)h@ijXER0aO&h|mW%v-WxqkVve_D-rx(&)t&+8H$G$0@%F z`on-`!%w`DyB2qyC8=a?-MM4>Ir6+{!uJ-nUO+d>4R}3W*!_Dcs8i@E?Lta^NH>9Ge!> z@q_VHI6N{5&2UtjDba(Y%7~i57W-~qKJt^vI3la*RPFC&Klr*zIs{)(Mez-!xs3Q? zc9{IMi(2Twa<>FW!}SnRe&#C;&@fFrj;sjegh?E67_sDdyz|g?dKI;r5IEy!XAE#? z4>5*|6W(NXlHqVJI!<|*;9B!uh#0TR{m|!KQ^B!FBiAV0$=}AHu{dE!P+lO-Jo2djKLY=6l4j+g=K{G+%Zt6xK7E4@A&E$DV%J426=g%?LCH zFKeWTNAnA`J58qcRkFmr#ZvZnN0sNH_~4{6*C4)wiHI&@?mG$}rr=VjGX=P>jxTOc zBa>3E0&r08675?}YNsFiiWXR|<&B?jjGTTm%^a^k>z(dSQ8@E^-?mMwRnK|F;z2DE z_qe{@t$Mg14;SZphhnap_K>D;=}2!D-}?~OSx=e9(}&TS$D)meni#UFmp$*rL9IA^D{{#(9@$QsLPp+o>=QTQ`j+1!vU?YISBD@+qN%c+*{ zFPz>7-P!^|^l9%^KM(u-t%zpbz&O~{+I~Ik58kK#8QTN%h+Vvt#r#XZTk0~D26oIF z%k}z7MpF`M9n>Dtq&6|`OftLcZ#B#QOM!ZadI$g+y&ikqwDheI0AM*L+VVE|Lvl{sr!c84Ssefe3I+Q zODXHb<{@!nh!c*x#DCP{nNWUL)i8UJStk}RSPsI77-3``=EB~E}f~Cn?7=C54&!iTj6`XqpD@ahJ5Z$1wk7Q5MguRPUvSh ztDA*uOhaquc$Stjr^NNconDqypGN=Vi-cbvsIVK4yv%mm7R4Xo zgjIVLj$!Jtjm?cSiY9fX=Ve)yZQq8^lb?CNP|F>a)NcI(5;{PRl`)R$@AxtPq3*>TP<3pmo$TdXhyTi$(QZPByuY zig4BPO->4^Q*`)GLi7CNlcgD7)geaQGmVi{tc7A8@$l(>FmxGrX)+$=CfZC-nN?rW zyw1_1Q^JcpF-!!aC{Z5GLJQ8NBnc)~MGkMvTRXnx3f#9rZ;BSm;+oV=rj`E${ySJ4 zN{Bjv-hY9`IaTJB9%84BOzj_8OC7ifgd6Ocpxvd&5vOhj@%<4O)YUhS7lk=3*PZKh zu4d8~nURSYBz)u{wsKlk&#H7LHT0FH3CSlG3FUPHivmH>e7b7? zJk*KWu0{~k(XEL${8lIqUkCM7yN>6vbI?DqFzWTb?|pB#A1P#CN1FP%qaXALizX5> zP+PLJL>@X5)+Ix0%@FAJHCI;Bj)j}N@rx)xx`9k2p+otpCs~cvW*NRWw85yS0NgbS zJ_Z(^@P;;$LVRsp&?kzxm7h0NHs|Qwc7y5UXr0+MD_}ay)%ZMapZ8g4!ZF!MQ#JFA zL|TNqlaMd z675I<+uNLtKCcmW+&UCIhoqirCt|!g>PYtq=u7`thwNKd+#Fi3I(3Lvo8 zJozst7qd<|j}7&~EM(1Lnsxu3M1kBQxhFW-nRLU_Z276r!4jU;5OoD<_13P+$h%ZC z@h%_4&t=uzSj-h|%XAEMfSq-nBXKrS7587mdexS7h1tQofJsZyxnD)R+=%{aiID{k z{`Fv0W=+!&=|k`~kJ*|a$kqsQuQG%Fiq!$BcY2cZvRKREj@cI;axa1~Dz0O*sTLo0 z?~%A;rG>aLFBJ(!z7d9LjpZ4hL#OS-lp-|rGR%r=QD-`Ew1WT$8BizM=-0o>tMML{ zATIlTVLk^edud8$8V83Y5aheEaRJF+ z2jgo}ChNJ{I&Sw_`Gmf%LEN8WEl60Irm<5Bi_gwR2MB?NO^`(8?04Z0rE9VcIRj;g zTpvB@k+=Gcq_eXpYH$rXamj93j{&~x9Cpz#IV_r8SGP*7F*CdgKSCA^gS7@8(rS;c z>^e1}{^jixYfEWwe!nkUm+QmcNb;15WP2e<9Z+6IrP}K!Lah!Zu6b$Q13qAOSA?n{ z5H<%oL_c$HSi6~N(#}aEOR7r9HO7LtNSyNdsmpMHan;ELp;`9o6sT%iUj%%-Wv&WI)o{3v=ypVFZe7s@1ko{dj%vOck z=3Y|FI!iwh-})1cXPpiT`s-7VzfcljWqkLs^RRqDy*1Nc$ry0PXWztIMPiw36;oO6 zpV1gAJ}?j|hajXwFt{pm2ags=qVJMy2<_sQRVQZ^zK)AeH$$ z4#0GmfKntpbxw30fT9b(M$L6_O?c858-edPGH`Jgw7=?3yT{tR_~Ov@i!DM4T!sU3ZTPw*-T;;Z7jl<4)V?B4Fe78+gE0lds%!^H&(nFn4ff z8&wB-`FnOY<1Sb0`cYxEc>?-PjGW2L8}^2!YE-9lbxd*|rQv8-3o96Es;gy3>!%(AzFlMTjG~qenO|?6@(xTLE$51o3?2bdY zEv8k+z7cgEu~|xvtZ{grHqum^`55hM4!~5$Jz*6p)OyM+9+?=fA6ven=3cJ+t0Y;g zG$Uh^LE|uWoIt6cuOz(ld2qBYKp9>P45efO90TpE@537&9nOapGo9C{-F!2?X(()g zYehfuM4Elu*DkRO)IGF!>B;8{8CMphDP3}`M(T|3POQBc+|}wH*aP7hoDg@~)+@5L zkCA2;u_t<#Tm-WS0e3yBn-`te$c}W8%7ob?m}d2O58voMQ4gy<^d@R!Baw zZ&OOn&6KcL6s(cX3J5ZdRRC>p$6uhJudl!VXR9U<@V-Aar3?h9@e`GQ zdu1yVwu8N`{+^(C2@wImYo`V!v~Jb_=jT>ELi54AyXMSGQiJlZ+7wv6CcNV34)S)5%&PKWwnhgEka!fMjRw#OXb3rnYE;^ z_ug){%=8#pj_NnIzL`o=h7d6Fjz9dezf{L>raf8mBi^kQwQ1n$T=iXuTGf4KjMUs4 zN{wx0z8LNO>R!A0R`ra(t8bo?-dik1jlmq%rg~$cjTjz*8 zkrP#HLT0nkYQi1{+DzNCI+{Udc04;L5iB42`@LnHhgeCuUY)(##VC{`p>dj?s$prD z5sb=gxjOd&FxGmWcpleX5*dFBuu?WtjU`tHcLM|}_QYgM(T4-7BRQMQoB09tL)?{M zTr2y+ZV$BM-6mQk7>1uk%wyt5Qx5vFc{FTc*mhqD3R<-?wA2LWGsKZmbO*gyQn1I) z@VAnCCFN*N8OzNmo-&&f81|rKZqVQTJtC)0dRy^~gW)psRBuNK`zdi&H=q$m zHOeAeo3tEDIk@U?UuQllZ(c&>3y1>dbnQ$tfoh&$-IZ^^Uv7+eo6jf%(ZcG-aPkKpnIZ(Nb4yD#CDyVX8JCl|@78f` zkIrxKlC-czULV%TMT-nIDn`pd_XQsIH1&vL`NYmP2?StgL8{;fUv#$|B#ilZpGMS9 zbxXAd=h-o(#c^0`{APJCE%8n2Vc5uE)F13?KyOMnI?kh68C-%Fy~3x;l#sqm+?&B^ zoP2)@b7i^@;WXXKJpNHnc4A8p@t&svl5mh>Lwl^t|NRu2;r0<>Z|cMYZ%36y>qp1< zRHBY36T`e`J+vyXeY`l|m(YqQ(XZMV;JlT|UhEytp2f!i)xO|_uMt5Zv_9ip-F6W2 z43ID>E{2l6UtUaJ{k9$&X(e%P_eMcIg8LN>ZX%i@QlxBT_SQnj3R)e@nNThfTbbFo zqmEvBEP<>HmKwcVb^&ij~- zu`rJ-7h6dMdP5Ish_&mUY|?nRt3v8+=+-%DwFt}22FsS*fKh{QtW{6!hFX~*=v%MR z{pSWB)5C{%J|0OY_?d@o@b$EjL5T4jW;4t0QcV4!O+99xA}fedh1@w zfa567asqi}W7S?mR?{1D6ddt=fY&6%)%h=)2a*n^4ZZ!!8@QoNgo3&<`))We<7}^M zKHTqZRZ2%6#p{DDjHs)k$+_7-jB&~(o^x@9Qxk==EOZFk1r*g1=sX-pcg%QtfWwCm1U90Sc5(g-QNDw(a zdqJy|p8N~-H;A|Lo=+_r@NEHWlCia2pztcC;gw5dY?nHnW(OksYBnRG_Pawo2BxK; zc84by*?ft#r73jrdCkXmWon`AY&)j;;7@58+CzR0Oleb|Lyv6h(<<(5PP9w28HzGA z?Zr=Z3UBJ}$Kq(pR}oLDQA&76ko|x=c{qJNtXhL`#s$PsO>2kUv%WI6rCnxW-&nq~ z%1N>9{ zYe%xar!f#=u5^bj%CJK8?}7wMBer0ANti|lxK zUu6mp1+*JY@g$A80Vy0r1D-meR8ksZVSZ=;E3&TyAmE~UU=#=u|{ z=LhhYyRcValpP}0LM|nLMVDrb&qF=ftis-h=l#>qUl-GQv!Z{GWG#gTI~EG!#cqtN zv7rubEN96E&ucYv1)tZxiQpd=Dg`qnk)PpW;3UDA(Wvb&vf%d;?i&H2V~v~68%FZv zjwQ%6<7J4jLpO-OCaNWUU2+tK`E{T90F3jy@_=s8kP-I8o>`x&%5#{=*bZL{1b=AX zS@Z_3mGH4jeJxW>7TfvSc6oeOrkkWq!`uwP>ZY-eG8M!dF>g=VFD2V#x-x1qXlGOr zQa)D}CJoJ7^OseudYmEn5Q$`sN>yV%r7E!)lSS3L=tx>wOysjIYyN{;^$XH@Gv!vn^NyC?o6Vp&8?1dFgjY@2Exgh0agN z@q?i&kmXuynkhbh?>fCoNQ2qRp}P)a6^uJ|t;>V*)^;fB;(_L4x$$Gu(cFv~}Gg4%%SlPCr$40EZM1SY*-qK0kH%S3cXh=)$>+MpY%tv{Hdx21*h@P))k{Z{1{&+fx-hC0^@A8efz zHwTTw0!jRU6HB#M^QePHw@6GdK_wZJ|6v^!Ky+ygGQv$vrv4qaPg`jAk=vFXrPN z$#+#vzn($-1KR*ees!5WqPJOLfsM5|J6;KbAa{TR8w&eZc)N*tsFP4h8GP!ROs>D_ zU>oLVLa?F142V8&M`$c)Ka3I8Lm~}6?D%pzR7H%wi6NhDdDbiqk*>C(b+!9It z1Jij(E_?BDh!P%I^n2eJJTjRoPW03Tns9hNMM5?cZ*g?4PF@^F7=~;ua#OygUpGoMUILG+w>5yfy+DC$phWboZXTgoTUIZxPS`~N>kifKNIWv-5!_@U_b;c=uGH9+WmzBHM-DQ! zc%NP$CJu#}rxtIJ&gMnK3`Cf9Jl3F~pa`#Y- z4o=YlYu983J39fdS(vX>5a7PSDg#ROAf~AbG8;h%xKU!Lx)c?Z(q-B3;C~&HWF;V! z3a46ZJ};S6`w`4oOU^+H&x)Oq z1ZsN_q*A2hk)9@FKU!n4fZkjJFr71DUt z;_^3Vl1^jhB}tA&FzuE#qPC!Rh6Ca|W1q0#^F^E8YSkP?6#c8DOM`*V8NaBj!Vk!Q zlrrjiY*QMrRs}nL!Q=}uz8AEn#4=_BB=Brm2cdPXb^LX*7ahBzm8M`)vMF;)VgPKZ zU;-o`>7QRjNhtp$S=+>)_bvPH?n(cnb%j~G2r;R}P+cGrr!6d#)ioXTLa)Z!HH$AC z^yZq2FSI|SJ-<1;`&W+E+1`Nr`zBvNC8a{bAkU|(yRpUlsl~^%kp-lrA_5_S_jvq3 zI0*9%<>&Q%=vR%Rt;VBbn%C7g7zG|br|jT*?yfIUrA~frB7xy+|3Vuwty`RK4MWx@ z8Eu_Pe}j2At4i}c$tlJR(L;_GDU2uWX{W&$lAb3n*ZSn7vmHqVndwCx?sTi3Eif}5m*0+Wv- z1#YPo$G?x%@lOmTZ{s8oQ>M*k5p9~H5A)rK-~O`WyBFh89tA&=t^vBozY9HO@qh9* zWGG*=XCB6r2MpHnvp->BkX(V460U925L|iS&dd)wme_~?Kk_#G$~2A7E>}ObTgZ6; z0|{um>I~dk-_ea@$*)*2-$ZMss(wEY4+a0#V!Vdv{}Z+~Mh07z+CPZOaPM#OR?b_} zIl9xFM&~EHb%NU+_tGa+o7{)%!?-GH(eqU120TH6NZ8w>ZaTpZV<+I@Llo+8)@cP; z>8AYhwHr4orfncoTfzao#crkb;OtQ!N!i!4@b!=09834UiP*9oN3(&I<+US+=f=d7 zxD!F>e{G5T>`3p10Xe4u1pK7|5)c&N6Z}0Is8mu)gnGaImk5&hu0@+3nGQV8j6D}rU3bn-Y-@wTP2{GxkAPHl z{vip-FT>rtaZxu9#K&qrtjgK|SJYna!rGnVv7EteB|r1@LlYMBca7#Z>sCaN;~xPc z*~rm9Qvcl(_LLLs&+bvrmeZt%?P3u;YTyuwdrgpzj4NcW5%1S^+=r`b2grwIHJs;; zC*0RE!*XvCYW|=a`%QoC=}@4R9e8K?w98c*aQhpQU86;!_a7g+E4$+ZBBR(91VO7; zZplWnCdRV^A;#S4c!>L=^Y3mjSiqD|S<#jk$&u%vtR*~x>;oZ1B^u^%>6ICvVHp0(+nq6<@r?A8u`5l-ukN`UX&lR%7eZbNCz}5PZZ<8|q(t2m z&aj`*IhpYwlD>+}@QY{P1Fx2lTHgMIck!rsK6ES0)|JiF(#M<4_uwX0xD_lehTxtE zmMh$@*$Qq|`_x3L%f{ zm64D^y7&J&yX&C3^>$z2Kq*p+6?cc??(VL|-QAty?zV7U=)wxc-HU6n;_mJ)>$3Oz z?m6#0bLQTeGm}4lNhXs_GRaKxd7f{YY&Qo;(*5N@?qI9|T0>~L=c`C=$3YxP2O<+Qji5Y^nwJ>;$}RC@X%qx5^1`5K zo%ZP^hZVn_6fUc#w_tx=^lMs)E4!?zYg_bX(=r(Rad{;*mE1LqWj!kDbG;(&An}v@kjL1$ zKRE`#z*1xTBSKjgP{+Nxh*Sal@mcU~S%u1&VzIgX3rWWka-lH5Ar)9A{OPmw@B2T4 zjt}eCd22#XU(GVLq~prFzqdJ^C+l>CL(MsTxXnG1?%VD@4Nu+dqcfr`a%|8~4n~-^ zAkZOyv7=mJfOq>o$v+(uU(LhKa6a>tmCa|vNM~##s8*xot(Cc#_v7(|R;kc<|djb#6Qe>?Pvm`SAju7?w@Q2UQhv)e?%wa3>#8W+M+8 zNoM1x4!jsrbugyp7Dazu9d0^~*B&&t677d+tE~FAg7eEd>TmBpxA9Pxl2FDGj+ZJD zb=j2;corx=iR$#o;5a#B%;>h>4#JO975V~CTP#vQDp5$mHJ;V(WkmA)M(SUP(iyt+ zc6CcEe(&j?0#=Il(|kN%+)RB1_g@RYJ(EvLCV~0#`PyIZu>$ZDz!&05Z!U%KL;kYJ zb_rmZM~4Kk-|7{Sa{$3k*B8e33%4tXQq@?T)A?sZz_FmsyYsUkN(Sr$s6W*eZ z9&3aPR#3{gE6#%Rkuim3k@=zU`E7mka#&gKjrTjpj{n2^9s%G4B|`1HEE%j~jnwCp zc*qQ7iE4`TVmPCOTNo{egj>Jy+T7LKj$OXx2S1fn46p_e#miEb4UDBZ$r7u96QyGk zVm*#!YzALIt=B2rN0kKcb$GpuBORxRPv=2$ad5BzcC5{EV>r26&x|I3;_mW%v@el* zOSj>X73sAs{?L50zZ_JiV%ERQN1M34D<-=bQMa|F2Vr54?A3Ql4tJegLQuHsZPmma zM$#;g@JPt54##kInIq5mM=~M)EUui3O=T#~<{^e^#gF8RaDnC#fvro+j1Rc*GSo6foBgOnM29k+S{C>uR8%`?{Un{X-f}R?R zPv09GiY8v+L#lSICDRo(s#B@mX+E!%B@ z)7o}TeWf^~V|3(L(O_u5#Q}9_c8BMDDAvtXC5>vi$y?%G+p;PYt2W8wK73lqRL&>N zqK^Im`Z#m}m6@t~%PH4(vUaDJ@c`d;V+QtZrp< zJUKorYzO@SQ>-h!F2&M^YQ2}!b$y_oU#8t>z0iO)(G70>bC-D|+B z=B(-=QO6?^R&}2mm%(w0`uLrti{STK+g#+kF2ze9^k)O!e7+xQ7e5zca&DC8`%XqS1}+-quiwHUT{XTm;7g0~8Cj2@r^R}V9c6Fmo$?ZOWNaBoEcuTYYwz-3 zfRdTs0;k^}2z2i6w=h46zem{aw=199c)Rg=!5pj^o~q)|>k(V|x9M_kI|SQxFw`G+ zt&xiv7rjyGz!&tqKJ6WOeMcw}?Q&9O>(PSF8_H|%iQ09!NCa~MjhL{RJN7Y;b2@Oj z=G52_20I_kr>CK+)_k>)fC9UQ?by06m^a6lQzHFE4)nhXQ-r{Ejhv7&p#Tf|B9)v& zwKs9$bFWBhY0?b)B}GhdcNJqfX0nRh;nnBWDsY7E=j-X44HJe{Qv@m(9FQMm`-xz5 z0qMx{&%~-Gr6;Hy|?IrTvf&>e#Vfv6kFgY!fx-y6~F2R;KO_4 zabFb?VL~Zo<{VFVboMpvwt44TF>4T&nS&4)r4gLhW1>4ewK+Mz0tldZx- zc$GFVXxzWxX2kqiO@~8CJBZuE!SOv(!E&z!FssYuXw^86r-b}wt_4N?>a2*zEM&E> z!@)~Cl_>+D&a`?QJrz_qSPhleFUN+#?CEM%Y0NPkTj_uJhCG-BU4pE+XPj%AeuE)b zo`IrEm%xzuQqmJFoYHl&P?n-^os{{W0rZfmW*KOMEXc&YR^QID=0VM=AxGan_h9>7 z89Vk=8qe6OAh5Pkd7449UYn%p;wm6jYT79FgplX3QN~{0kaN^D8u}&xV9=ET$RY2p zjJ!{S;+5l5!>LIlUx2JpQy@pS{Ak^11Bf?WCMU8-Bkm|G1m?Kdl=Cj|@M6}gI=_EK z%z3p?aIf~ZAMXO5)}c`j;Un9D$$iU!H_MQwhNJ|RCnnsh1EaxOio>GXO5TcXu)FnI z-%69;F(MuJZ0S2`z1!&>R%6jcof(IlZ0Yy>6=U92CthmYsg7erfrA-$ZnuuBXU* zb@!QQI#o_!Hg^T0u4hD!Cke!s24~&KmBc}Kk=21wBm2_T286EVTql9mwRr(g&HO6d zAH029XG8)bUj7wI^Ys$!CgQaa0hSGklOcW44|&j7v+KW^9|+Z9i{E1GT17W{ZW-nz zB)tzGdL?lNV-dEjZ>@#&PVuuC3hD95UTVJJbh+G;z+=wU`S193B>0c}$E5ili&y6B zb3_)Y$d%lAVj*lndmF@ih6j1hO%GY@A40 zBE04csj9SI9S>$|JtQUSU(Ss04lIfqfAq#I)c0m>P2MwSBe9U)0x+aO!UndgBBD!w z{aG)IIKOc<$U9|^Btbd^&mA0WO{V*(2HewJbwb_kmHBtEed1P6?#E>uy3@4oX$~RkYFf z64}8!(GS$m`B~?)oMYCmT43}EDq+*8d|U=95z&mvtzl)6=+=jm4*py=CaAA*y3`G) zGoG%Vu7>!i3eAJIES2q-$_Le4B>9~!qxsEV@e&^aHctT2fATU=l(f99T z*W>caXx1QCO}U1$oikjEibNA)_5gHdlv76}WzF&M%OyRTf%=|~DeI@D0i(VYYHCo8 zU(zdtI`KFjXyiSW&vFx4oG5(y_3ohXLHwO`0@}iR4b2EX7hkNSk9E;K%*;qn_1E6X zS(DsZB56?3Zy~oGXxOIbR5G0OGoP0;g7#16a#1c2h=8S4VJa8`6fqn&t znn_-ah;9194fTv|{t+Psf-%=x_akd-MweD3-Vx+M7%8}aTai(-rNGZQy7e;-m2-_U>E<8MmTqL*&;dq9ehLH zom1RBx|M~*a^m*FD?_gF!_}D>*s#?#VNPkJULejt*A@K+y=y56y@AF8z9JpEm;t<$%1f{Rq4_NE-+b#lonFSk%{!xi&ym_#H;@io?RP&9Tr^#u$DnkNn5u7R2QniZsKoI{^4@nxeQsP zUY5@V9TwrnLrfy|nP=b5zzrEw0H&-IFWd^29vf?FLRKQt*0^O*-GS^!cL1Wx zN^baRD@lXfW&H#bP<;7w>u1RMM*=+bknB%Dh%Q%d&z|Sp$vl_eB2hI62F{)2&P}FK z+@k%uro4uNtd(}DlK#V-P5k3O@xya(pCY}D{SsW3 z`f=_X1ej@kTG^NoER)~pAzL=}V6lHD#z|Y>=y0PyjkCCWCo1R^euM5cbQgD& z{N1mRR#(~P(=k@<9bYkH%fSeun2h?XosDlkce84nt%?76h?o1LGh^~|^V5l`zBS^v zGuv7=N~Kf?;891#@v+rrz15A8R(Z8NUU-fqz%St0x_?Y%;B_*MbKy;R5+j@57M62Y z1wZ6tBzKpV1}4p9fM$%)izZRsu(3#|pIe6_XkGUl&Aeb3?TS+Nvm);gGbDbYQit_Z zEl4BCG;cp{^~vN+Gw|(l*3ur4(POK6)l8LvJ~#FbxdCZ*p+QJ)g%Dg8ox*T>^*tL) z$&Mid1x_1Rz&B^6!YJL&4nMaj5*Rt`29k<6w4Kx4W3U^(jVLzkA`n277fl2Q4e=7d z|FZE4o+r50p9vXco2MZO!Tq+DB^39(btr7sz;u3mTqbTi;S>l1v5wg#E+zyk+rfl# zz-B@SsbJ7BeN#4g2i8pR7jRodeJa(EQf2xQV5Ai^@*n8zKz`HZ9);#B#XK;6yD46acPvI2~`;%5O@&Cf-hnBzb8T$2qz~^8sJj%NPc7{;nU3d>-A&ttY0`kE0 zt)o7H08ybnCi7MYd5mRN0;S6vK9}-clc=8NA)ES(wc1#+y=3RK(~<_43Xd;$YhSg6 zDRYL$T#3+;3s>Q-PV|q(k$u90M{GR z2Hj|v21gwTAO)+m$UsXTc1^+e`cI7 z3JLCfe+0jVug>&${h@j|uei2(wjmRPxX8o{t3gwJ_zR#T@JS@MxA!OUeAS7fbEnAW zkA*sVtF!%Tz~gFMzQA`krrr1llWitZ?#_Yl4vn*ea;NyWGI!m*4E*n;bq8b9n{X;*ofA1(LU@ox!!2i|uacC>w`=)d{+A6I^~{b%&IF#mVNU{sNuhjI#}_gsjK&WbqVF)xJ}6Sk8!_ya(D;w-_HELsGGHj|LL}bANTLw zk4*jxrnBJ#_XQ8+u>W584%UBftMAD0AN2h95FA+besX~CM*lwB#rwZf`N#UQ3*sI< zNz(SFMtOue%&D${k}(9?Ds1jR_+cTwCZ-;20!1a`$y4~hc=`7`FB|&)iBAO)cQ z;pM#l;AOcO-hcBlI3I@lzj&GGotK^4|Np!^)Q$ylgs-OX2-#&Qq$^^L^8Q|39K*rd zSPtW%r~WB{MW$RBlmp%OFE1{#AJj&BmEm&BucL6qj#Ljf?`gmep>)Y0zd{Py&aT}e z_uS$2uPvZI+doIMPcImjms)Bi*%s7s)+|aD*W~4a~?GxTd;8 zLXUC2ksW{M<&Q^r?EU{3)64NR0G((xt#7 zp}7weiH6W!U!pJCSc+;)k@~{#%%3C<_L*L zCL5KsxOGmcTP(*^_UEEZf`5Cl^XLD!7gu!fMAhR0U$-rsO+E$ec=&&swi^2baqdwh zQL*e(ApTTJ<2i00jCoq6$C6``t=OaeA?XsI=x}^ECY?zAlb{$QGRz5>{`v!g^1c_e zIXQzdVc^F1rjTXbp_f%J6=(0ZlNypcqo#P*LzDYe1NEb9lo(n_iC2M!{Z?rXiu`M4 z@=nB$pHk8@i4%<(aMjxQX)sXvylT%yWlT6qw2aw$q_v95xaiz)rO)VS+Z??jPf_$+ z{Flaev2}7kVs3r?{jm2P{@r-)M$%ta;lH@!cZU0)@N(FFWMO)IKw=g?H(@9sx4}IF zBt~eHAa*k5q43>=j9Eba&b5u-R{OTJ{?tuVSo@mBm2-+dA7P}wvkvI#0j{Jz6(ubudR8K!$XCF&43_Yg%XpULa z0Ax1Q+K1Ze?GCIBU~%H;c(^-M+uc81 z;OCSgDp0xMFb9u4WKyadI)zK|XV-Gk^h!KTYYSNOjr9k!kB)=OgHR^~$wA^hu%7OO}1U1LV9P^cX zzNn~+cbbQ5b1`^UNJS$%wx;iWMx^IsO_h?BnZ|+C>MoxB3Pxf%@b8-;2OkE*O*}hI zJh^{)q)`li@wj>EugiS#c(_@dd6x_H$#_9+alb42+(KPT(In`?k;uoP$I84M4S!COi3XwtIp^ac zfsUiy>_Cu~ZJ_d*U0gIb78|ucnsg=;L5q1Gh;z7dBSt)jApC0teQa&sSXy{pd2T`%d{7y+fQi(T4J&GNwUUA$0 zCzFGA;x7ODHSmu_Fd4%DAt!8j`1VWhO!Hmsv+ltLID9f*fA#@fm-K7@0~n01=taBZ z3bZMPEcjXZR;V47OyrNh{2}y}bxb@;>ZA-{Lns;}IufFP)dHC-l+A(IwXpitbZnr- zWNqYoBXUz{#I-}dBR1jYFJx&m<7~~<-Q*Y~+U-XV#{CJ!$ya~2un)}R0Ol^vL<%ai8>tazol^vX#2$3oh8@;7{L>2{P7_Ll*|*M~y1jrS~P;0snJ6J1E- z&!80;JZQ~Wer1P6m?lHNH(Lis@Em#S6#chEbeGNt|0Q>0;f>#Zq;*Laa$=ac)HzK;rAGIG z6CvhI=pXLfG@C9EPRvwz8K^zg8OF3N<{_!_{j&+YyH=QFWV<WnsG}_{={b3h~+41O4V`A_Jcbom`IFR54{BTfe59al{v%LWO z0bo!4gI3dC{o_1p2*{iSNc*9~;@TEknyAqfV zu_0~B#Sw6QQ}U8rnbz4RFmeCt%mFUo`*6zh%%whNTbFW-&Y$qKJ%5-^n9BWnwc-0o1c^=KZsWOYy70V$}&be%B;{ zC=)aA$WTsQHya?TnTO%)FQbqv=>N3B-j<$=^)=+2K|j?oGm`Z+_KuTZ)m$;4gENEU z{3J`3dQBRh>-Pye*5b1aucZqm$Ay6GOh{!q6WgQqFx{L{!a-4=57b)Q9k|BBwIgwY3|wI|A3sH-6}ryRgsdP>BFpcjlp@;K(PFgcVuj zz(yj&Zuk2cSUkyBv^xD~zY9IfUE@{6S`e(LFrnbB_WUz?E$!E1SNslPnNQfhp6(9q zz#*eHL@90{HKCySFh{FV^_$ulp2h5LTCJ4e*0Q&f);Ac9I&qa3SJqT@yZpvlMuc*w z52Rv*ky#Bih#n|P>T0m;sn1GpQV(O0>Uxp3?pEUhq@JhsIA&ZXbe!p47Ap1B@{*)Cm%}mWy2fOu?3KE*cmVoHrOg=7RX6Q1F2enVnwr9d{&WH0 zRSHeS5j4zFeK*|%(v^-G&MfXFTf^TsRVHt|NU<4fS8ET9v$1J)3WgSgobs8uir+L! zdlT_=48{CI%ynC`4#Fwc1pA3?ZM*0|OT?+=Bn82Zu zbKU3pAqipXyL2ERoS=tI|Im{$_pt?)moBbsF1mPuRl~6;@2!{`m#Vqe3 z?ZtPY468Y((pyyX`NEKKqD;d~R!5#?n7oh;{)Bm6K4T*4cv`fPAfE3Tz~5*!Po`un zrOVB>RI9f`l0*Ra>v`a#_nmAte1s6=2YY1>ULNgx+N%uc45S_!MOpeJ$;j!m? zj2pLl3MY-qPDLnJcrKZ9gD!QgCiaT=P6iz;Z_x`x5T#@S)9F-0pYA=DvoG4~lP5mq zGUx9ou!q^DvvdwfUy;JAg(A9>ngrXpEMRU=@)H=E+yNj5)4r;2`&%e(AV|%8!sbTh zV93k>e&Vjn#Wr->!x~%IBwB0$Q8;KZC${0imN2s%aaT5cC^WADDy|coOGlui3uj1o zg_hz$d#d6xx`9?NQphUM5%#=-EM@GvMQ#xQn~1HIQji5#EC>-ut(0UED>i6ujY$%Q z$lW$cZ?+jkbww)2!}DL_Z)HKW$lNO+4tuvgkgvAnUR-k#j{fA1(Y(81P%aAM8D%Oc zISd6JK+A7*Q8+<&k0AG=$l+3Do?YCSmqVqdskk8(zTY5*;!=%hd>a*A7gHDW&CAb> zj$yt)FNQ$GuVG=QBPav8^;alm^XeLEvK=x5*dF%{n!;QU6CxZtqI3inCeFDJ6Ul`l zh~XO?YhF%-(BZ~xA-lrm7q&x`PeK_noUF(eJMvM162!Q};I74h^H?jY*PrUZlX93f zOR&dx{V8xRFq_~6dX9ksiB=~u0t10E*uBn zms@oV(joL_cd^o%1EZlWdgUgT(YgI@ie)f>S4UCmq%{-+e|nmgZ@UGVUtQe&UI z87~vGr~f>I-4weLI8MNI(bqHO?*%CR!$#n9vd2q77G;53KYFs>jzq`@1s-JoFQ^l> z0qJ?CAgzjM-; z!ev;I6uEk;mKxCi5#)s86e!^j;oB6q(mGj+!ATMLZhR;S2R#muWcAGcWHxSL*6xrT z{SvoVac=Fi`kN-7Ppr{jJEZ&DM_uvH!+8oR%feZ4&hce8?eu`Y0FQ=%^}bL;e1$e{ zou5wZlv0mx2k5i}n{LGF9f*R#Udg{R_7?S%rd4Pkeo@+RAJI=}_`1GCJUWS33^piB zJz?kG+cR~%`1!Lo6Drulru`aO*f25KW>I}!i|Z7bR4Q@Et~|b^B4*1>JqvcTCNS6V z*yZaflWh8RX~=`iIkEoJ_v8W>q#=kr80^ivHa9+Z^LF(8;`-w4{MY4%75u zaBQZzsgw-t$|YP>QM{W^dQ+@T_DAM|4Hv)d0b9_}S1KDlxd_>K1^fyX|HD{v3)N)- zIjw}gwSI(|P?`-%V?e(KdpW{`jX_=djq>@A`DZ0blkHM-ZA7<4Qk6|j_nf!UG{(R~ z&KQMnnFfta+{OLT#4K0}LCrNQ6Fx8%LmF~tP3uqjt@w-;$+&xH2Cy?draZXF=Oy4~ zy9KA+!L>1RdN>8{y-{3`8}xJ#Q&iuFankp`0YAM{3vn`ZdYX@e^nHyPW=*aV7@fK{ zPlW{1y;oo|1NA^|Jh&z)b?xRraC6YTh3_U_ldhPz6=PhgY7b;$QWCxJnlO8^Ll H4-o$c`BV-Q literal 0 HcmV?d00001 diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.007/Chart.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.007/Chart.yaml new file mode 100755 index 0000000..9784e31 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.007/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +description: Installs the CRDs for rke2-calico +name: rke2-calico-crd +type: application +version: v1.0.007 diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_imagesets_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_imagesets_crd.yaml new file mode 100755 index 0000000..d09ae1c --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_imagesets_crd.yaml @@ -0,0 +1,75 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: imagesets.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: ImageSet + listKind: ImageSetList + plural: imagesets + singular: imageset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ImageSet is used to specify image digests for the images that + the operator deploys. The name of the ImageSet is expected to be in the + format `-`. The `variant` used is `enterprise` if the + InstallationSpec Variant is `TigeraSecureEnterprise` otherwise it is `calico`. + The `release` must match the version of the variant that the operator is + built to deploy, this version can be obtained by passing the `--version` + flag to the operator binary. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageSetSpec defines the desired state of ImageSet. + properties: + images: + description: Images is the list of images to use digests. All images + that the operator will deploy must be specified. + items: + properties: + digest: + description: Digest is the image identifier that will be used + for the Image. The field should not include a leading `@` + and must be prefixed with `sha256:`. + type: string + image: + description: Image is an image that the operator deploys and + instead of using the built in tag the operator will use the + Digest for the image identifier. The value should be the image + name without registry or tag or digest. For the image `docker.io/calico/node:v3.17.1` + it should be represented as `calico/node` + type: string + required: + - digest + - image + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_installations_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_installations_crd.yaml new file mode 100755 index 0000000..a327924 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_installations_crd.yaml @@ -0,0 +1,1242 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: installations.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: Installation + listKind: InstallationList + plural: installations + singular: installation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Installation configures an installation of Calico or Calico Enterprise. + At most one instance of this resource is supported. It must be named "default". + The Installation API installs core networking and network policy components, + and provides general install-time configuration. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Specification of the desired state for the Calico or Calico + Enterprise installation. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration options + for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip forwarding + will be enabled for containers in the CNI configuration. Default: + Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the Calico + CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create if + none exist. At most one IP pool of each address family may be + specified. If omitted, a single pool will be configured if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the main + IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the IP + Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector that + will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + linuxDataplane: + description: 'LinuxDataplane is used to select the dataplane used + for Linux nodes. In particular, it causes the operator to add + required mounts and environment variables for the particular + dataplane. If not specified, iptables mode is used. Default: + Iptables' + enum: + - Iptables + - BPF + type: string + mtu: + description: MTU specifies the maximum transmission unit to use + on the pod network. If not specified, Calico will perform MTU + auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a CertificateSigningRequest + to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. + This feature requires that you bring your own CSR signing and approval + process, otherwise pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate a + key pair that is associated with the X.509 certificate request. + Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature of + the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to accommodate + for clusters with multiple signers. Must be formatted as: `/`.' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management that + will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For CNI + Plugin Calico, this field defaults to Calico. * For CNI + Plugin GKE, this field defaults to HostLocal. * For CNI + Plugin AzureVNET, this field defaults to AzureVNET. * For + CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only if the + CNI plugin is set to Calico, for all other values of the + CNI plugin the plugin binaries and CNI config is a dependency + that is expected to be installed separately. \n Default: + Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in the + Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider AKS, + this field defaults to AzureVNET. * For KubernetesProvider EKS, + this field defaults to AmazonVPC. * If aws-node daemonset exists + in kube-system when the Installation resource is created, this + field defaults to AmazonVPC. * For all other cases this field + defaults to Calico. \n For the value Calico, the CNI plugin + binaries and CNI config will be installed as part of deployment, + for all other values the CNI plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. Node, Typha, and KubeControllers + are supported for installations. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of limits + and requests for compute resources such as cpu and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control plane + nodes on which to run Calico components. This is globally applied + to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which are + then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates any + taint that matches the triple using the matching + operator . + properties: + effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match all + values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod + can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, it + is not set, which means tolerate the taint forever (do not + evict). Zero and negative values will be treated as 0 (evict + immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path for + FlexVolume. If not specified, FlexVolume will be enabled by default. + If set to 'None', FlexVolume will be disabled. The default is based + on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to be + specified. If specified then the specified value will be used as + the image path for each image. If not specified or empty, the default + for each image will be used. A special case value, UseDefault, is + supported to explicitly specify the default image path will be used + for each image. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + imagePrefix: + description: "ImagePrefix allows for the prefix part of an image to + be specified. If specified then the given value will be used as + a prefix on each image. If not specified or empty, no prefix will + be used. A special case value, UseDefault, is supported to explicitly + specify the default image prefix will be used for each image. \n + Image format: `//:` + \n This option allows configuring the `` portion of + the above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images to + be pulled. + items: + description: LocalObjectReference contains enough information to + let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider of + the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to automatically + determine the current provider. If the specified value is not empty, + the Operator will still attempt auto-detection, but will additionally + compare the auto-detected value to the specified value to confirm + they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node serves + prometheus metrics on. By default, metrics are not enabled. If specified, + this overrides any FelixConfiguration resources which may exist. + If omitted, then prometheus metrics may still be configured through + FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if type + = "RollingUpdate". --- TODO: Update this to follow our convention + for oneOf, whatever we decide it to be. Same as Deployment `strategy.rollingUpdate`. + See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that can + be unavailable during the update. Value can be an absolute + number (ex: 5) or a percentage of total number of DaemonSet + pods at the start of the update (ex: 10%). Absolute number + is calculated from percentage by rounding up. This cannot + be 0. Default value is 1. Example: when this is set to 30%, + at most 30% of the total number of nodes that should be + running the daemon pod (i.e. status.desiredNumberScheduled) + can have their pods stopped for an update at any given time. + The update starts by stopping at most 30% of those DaemonSet + pods and then brings up new DaemonSet pods in their place. + Once the new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times during + the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for component + Docker images. If specified, all images will be pulled from this + registry. If not specified then the default registries will be used. + A special case value, UseDefault, is supported to explicitly specify + the default registries will be used. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity characteristics + for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling rules + for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects (i.e. + is also a no-op). + properties: + preference: + description: A node selector term, associated with the + corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha serves + prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico or + TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + status: + description: Most recently observed state for the Calico or Calico Enterprise + installation. + properties: + computed: + description: Computed is the final installation including overlaid + resources. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration + options for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip + forwarding will be enabled for containers in the CNI configuration. + Default: Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the + Calico CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create + if none exist. At most one IP pool of each address family + may be specified. If omitted, a single pool will be configured + if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the + main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the + IP Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: + IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector + that will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + linuxDataplane: + description: 'LinuxDataplane is used to select the dataplane + used for Linux nodes. In particular, it causes the operator + to add required mounts and environment variables for the + particular dataplane. If not specified, iptables mode is + used. Default: Iptables' + enum: + - Iptables + - BPF + type: string + mtu: + description: MTU specifies the maximum transmission unit to + use on the pod network. If not specified, Calico will perform + MTU auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a + CertificateSigningRequest to the certificates.k8s.io/v1beta1 + API in order to obtain TLS certificates. This feature requires + that you bring your own CSR signing and approval process, otherwise + pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate + a key pair that is associated with the X.509 certificate + request. Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature + of the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to + accommodate for clusters with multiple signers. Must be + formatted as: `/`.' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management + that will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For + CNI Plugin Calico, this field defaults to Calico. * + For CNI Plugin GKE, this field defaults to HostLocal. + * For CNI Plugin AzureVNET, this field defaults to AzureVNET. + * For CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only + if the CNI plugin is set to Calico, for all other values + of the CNI plugin the plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in + the Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider + AKS, this field defaults to AzureVNET. * For KubernetesProvider + EKS, this field defaults to AmazonVPC. * If aws-node daemonset + exists in kube-system when the Installation resource is + created, this field defaults to AmazonVPC. * For all other + cases this field defaults to Calico. \n For the value Calico, + the CNI plugin binaries and CNI config will be installed + as part of deployment, for all other values the CNI plugin + binaries and CNI config is a dependency that is expected + to be installed separately. \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. Node, Typha, and KubeControllers + are supported for installations. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the + component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of + limits and requests for compute resources such as cpu + and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of + compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control + plane nodes on which to run Calico components. This is globally + applied to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which + are then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates + any taint that matches the triple using + the matching operator . + properties: + effect: + description: Effect indicates the taint effect to match. + Empty means match all taint effects. When specified, allowed + values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match + all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to + the value. Valid operators are Exists and Equal. Defaults + to Equal. Exists is equivalent to wildcard for value, + so that a pod can tolerate all taints of a particular + category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of + time the toleration (which must be of effect NoExecute, + otherwise this field is ignored) tolerates the taint. + By default, it is not set, which means tolerate the taint + forever (do not evict). Zero and negative values will + be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path + for FlexVolume. If not specified, FlexVolume will be enabled + by default. If set to 'None', FlexVolume will be disabled. The + default is based on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to + be specified. If specified then the specified value will be + used as the image path for each image. If not specified or empty, + the default for each image will be used. A special case value, + UseDefault, is supported to explicitly specify the default image + path will be used for each image. \n Image format: `//:` + \n This option allows configuring the `` portion + of the above format." + type: string + imagePrefix: + description: "ImagePrefix allows for the prefix part of an image + to be specified. If specified then the given value will be used + as a prefix on each image. If not specified or empty, no prefix + will be used. A special case value, UseDefault, is supported + to explicitly specify the default image prefix will be used + for each image. \n Image format: `//:` + \n This option allows configuring the `` portion + of the above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images + to be pulled. + items: + description: LocalObjectReference contains enough information + to let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider + of the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to + automatically determine the current provider. If the specified + value is not empty, the Operator will still attempt auto-detection, + but will additionally compare the auto-detected value to the + specified value to confirm they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node + serves prometheus metrics on. By default, metrics are not enabled. + If specified, this overrides any FelixConfiguration resources + which may exist. If omitted, then prometheus metrics may still + be configured through FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if + type = "RollingUpdate". --- TODO: Update this to follow + our convention for oneOf, whatever we decide it to be. Same + as Deployment `strategy.rollingUpdate`. See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that + can be unavailable during the update. Value can be an + absolute number (ex: 5) or a percentage of total number + of DaemonSet pods at the start of the update (ex: 10%). + Absolute number is calculated from percentage by rounding + up. This cannot be 0. Default value is 1. Example: when + this is set to 30%, at most 30% of the total number + of nodes that should be running the daemon pod (i.e. + status.desiredNumberScheduled) can have their pods stopped + for an update at any given time. The update starts by + stopping at most 30% of those DaemonSet pods and then + brings up new DaemonSet pods in their place. Once the + new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times + during the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for + component Docker images. If specified, all images will be pulled + from this registry. If not specified then the default registries + will be used. A special case value, UseDefault, is supported + to explicitly specify the default registries will be used. \n + Image format: `//:` + \n This option allows configuring the `` portion of + the above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity + characteristics for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling + rules for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects + (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha + serves prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico + or TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + imageSet: + description: ImageSet is the name of the ImageSet being used, if there + is an ImageSet that is being used. If an ImageSet is not being used + then this will not be set. + type: string + mtu: + description: MTU is the most recently observed value for pod network + MTU. This may be an explicitly configured value, or based on Calico's + native auto-detetion. + format: int32 + type: integer + variant: + description: Variant is the most recently observed installed variant + - one of Calico or TigeraSecureEnterprise + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_tigerastatuses_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_tigerastatuses_crd.yaml new file mode 100755 index 0000000..abfe29c --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.007/templates/operator.tigera.io_tigerastatuses_crd.yaml @@ -0,0 +1,104 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: tigerastatuses.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: TigeraStatus + listKind: TigeraStatusList + plural: tigerastatuses + singular: tigerastatus + scope: Cluster + versions: + - additionalPrinterColumns: + - description: Whether the component running and stable. + jsonPath: .status.conditions[?(@.type=='Available')].status + name: Available + type: string + - description: Whether the component is processing changes. + jsonPath: .status.conditions[?(@.type=='Progressing')].status + name: Progressing + type: string + - description: Whether the component is degraded. + jsonPath: .status.conditions[?(@.type=='Degraded')].status + name: Degraded + type: string + - description: The time the component's Available status last changed. + jsonPath: .status.conditions[?(@.type=='Available')].lastTransitionTime + name: Since + type: date + name: v1 + schema: + openAPIV3Schema: + description: TigeraStatus represents the most recently observed status for + Calico or a Calico Enterprise functional area. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: TigeraStatusSpec defines the desired state of TigeraStatus + type: object + status: + description: TigeraStatusStatus defines the observed state of TigeraStatus + properties: + conditions: + description: Conditions represents the latest observed set of conditions + for this component. A component may be one or more of Available, + Progressing, or Degraded. + items: + description: TigeraStatusCondition represents a condition attached + to a particular component. + properties: + lastTransitionTime: + description: The timestamp representing the start time for the + current status. + format: date-time + type: string + message: + description: Optionally, a detailed message providing additional + context. + type: string + reason: + description: A brief reason explaining the condition. + type: string + status: + description: The status of the condition. May be True, False, + or Unknown. + type: string + type: + description: The type of condition. May be Available, Progressing, + or Degraded. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + required: + - conditions + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/Chart.yaml b/charts/rke2-calico/rke2-calico/v3.1907/Chart.yaml new file mode 100755 index 0000000..51c8a8f --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/Chart.yaml @@ -0,0 +1,7 @@ +annotations: + catalog.cattle.io/namespace: tigera-operator +apiVersion: v2 +appVersion: v3.19.1-2 +description: Installs the Tigera operator for Calico +name: rke2-calico +version: v3.1907 diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/_helpers.tpl b/charts/rke2-calico/rke2-calico/v3.1907/templates/_helpers.tpl new file mode 100755 index 0000000..3ac4a1c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/_helpers.tpl @@ -0,0 +1,10 @@ +{{/* generate the image name for a component*/}} +{{- define "tigera-operator.image" -}} +{{- if .Values.global.systemDefaultRegistry -}} +{{- $_ := set .Values.tigeraOperator "registry" .Values.global.systemDefaultRegistry -}} +{{- end -}} +{{- if .Values.tigeraOperator.registry -}} + {{- .Values.tigeraOperator.registry | trimSuffix "/" -}}/ +{{- end -}} +{{- .Values.tigeraOperator.image -}}:{{- .Values.tigeraOperator.version -}} +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/certs/certs-node.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/certs/certs-node.yaml new file mode 100755 index 0000000..5830c2a --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/certs/certs-node.yaml @@ -0,0 +1,13 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +apiVersion: v1 +kind: Secret +metadata: + name: node-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.node.cert" .Values.certs.node.cert | b64enc }} + key.key: {{ required "must set certs.node.key" .Values.certs.node.key | b64enc }} + common-name: {{ required "must set certs.node.commonName" .Values.certs.node.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/certs/certs-typha.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/certs/certs-typha.yaml new file mode 100755 index 0000000..4463e89 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/certs/certs-typha.yaml @@ -0,0 +1,23 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +kind: ConfigMap +apiVersion: v1 +metadata: + name: typha-ca + namespace: tigera-operator +data: + caBundle: | +{{ required "must set certs.typha.caBundle" .Values.certs.typha.caBundle | indent 4}} +--- + +apiVersion: v1 +kind: Secret +metadata: + name: typha-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.typha.cert" .Values.certs.typha.cert | b64enc }} + key.key: {{ required "must set certs.typha.key" .Values.certs.typha.key | b64enc }} + common-name: {{ required "must set certs.typha.commonName" .Values.certs.typha.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_bgpconfigurations.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_bgpconfigurations.yaml new file mode 100755 index 0000000..0baa072 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_bgpconfigurations.yaml @@ -0,0 +1,141 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgpconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPConfiguration + listKind: BGPConfigurationList + plural: bgpconfigurations + singular: bgpconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: BGPConfiguration contains the configuration for any BGP routing. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPConfigurationSpec contains the values of the BGP configuration. + properties: + asNumber: + description: 'ASNumber is the default AS number used by a node. [Default: + 64512]' + format: int32 + type: integer + communities: + description: Communities is a list of BGP community values and their + arbitrary names for tagging routes. + items: + description: Community contains standard or large community value + and its name. + properties: + name: + description: Name given to community value. + type: string + value: + description: Value must be of format `aa:nn` or `aa:nn:mm`. + For standard community use `aa:nn` format, where `aa` and + `nn` are 16 bit number. For large community use `aa:nn:mm` + format, where `aa`, `nn` and `mm` are 32 bit number. Where, + `aa` is an AS Number, `nn` and `mm` are per-AS identifier. + pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$ + type: string + type: object + type: array + listenPort: + description: ListenPort is the port where BGP protocol should listen. + Defaults to 179 + maximum: 65535 + minimum: 1 + type: integer + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: INFO]' + type: string + nodeToNodeMeshEnabled: + description: 'NodeToNodeMeshEnabled sets whether full node to node + BGP mesh is enabled. [Default: true]' + type: boolean + prefixAdvertisements: + description: PrefixAdvertisements contains per-prefix advertisement + configuration. + items: + description: PrefixAdvertisement configures advertisement properties + for the specified CIDR. + properties: + cidr: + description: CIDR for which properties should be advertised. + type: string + communities: + description: Communities can be list of either community names + already defined in `Specs.Communities` or community value + of format `aa:nn` or `aa:nn:mm`. For standard community use + `aa:nn` format, where `aa` and `nn` are 16 bit number. For + large community use `aa:nn:mm` format, where `aa`, `nn` and + `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and + `mm` are per-AS identifier. + items: + type: string + type: array + type: object + type: array + serviceClusterIPs: + description: ServiceClusterIPs are the CIDR blocks from which service + cluster IPs are allocated. If specified, Calico will advertise these + blocks, as well as any cluster IPs within them. + items: + description: ServiceClusterIPBlock represents a single allowed ClusterIP + CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceExternalIPs: + description: ServiceExternalIPs are the CIDR blocks for Kubernetes + Service External IPs. Kubernetes Service ExternalIPs will only be + advertised if they are within one of these blocks. + items: + description: ServiceExternalIPBlock represents a single allowed + External IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceLoadBalancerIPs: + description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes + Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress + IPs will only be advertised if they are within one of these blocks. + items: + description: ServiceLoadBalancerIPBlock represents a single allowed + LoadBalancer IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_bgppeers.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_bgppeers.yaml new file mode 100755 index 0000000..57e945e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_bgppeers.yaml @@ -0,0 +1,106 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgppeers.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPPeer + listKind: BGPPeerList + plural: bgppeers + singular: bgppeer + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPPeerSpec contains the specification for a BGPPeer resource. + properties: + asNumber: + description: The AS Number of the peer. + format: int32 + type: integer + keepOriginalNextHop: + description: Option to keep the original nexthop field when routes + are sent to a BGP Peer. Setting "true" configures the selected BGP + Peers node to use the "next hop keep;" instead of "next hop self;"(default) + in the specific branch of the Node on "bird.cfg". + type: boolean + node: + description: The node name identifying the Calico node instance that + is targeted by this peer. If this is not set, and no nodeSelector + is specified, then this BGP peer selects all nodes in the cluster. + type: string + nodeSelector: + description: Selector for the nodes that should have this peering. When + this is set, the Node field must be empty. + type: string + password: + description: Optional BGP password for the peerings generated by this + BGPPeer resource. + properties: + secretKeyRef: + description: Selects a key of a secret in the node pod's namespace. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + type: object + peerIP: + description: The IP address of the peer followed by an optional port + number to peer with. If port number is given, format should be `[]:port` + or `:` for IPv4. If optional port number is not set, + and this peer IP and ASNumber belongs to a calico/node with ListenPort + set in BGPConfiguration, then we use that port to peer. + type: string + peerSelector: + description: Selector for the remote nodes to peer with. When this + is set, the PeerIP and ASNumber fields must be empty. For each + peering between the local node and selected remote nodes, we configure + an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, + and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The + remote AS number comes from the remote node's NodeBGPSpec.ASNumber, + or the global default if that is not set. + type: string + sourceAddress: + description: Specifies whether and how to configure a source address + for the peerings generated by this BGPPeer resource. Default value + "UseNodeIP" means to configure the node IP as the source address. "None" + means not to configure a source address. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_blockaffinities.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_blockaffinities.yaml new file mode 100755 index 0000000..4f03208 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_blockaffinities.yaml @@ -0,0 +1,59 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BlockAffinity + listKind: BlockAffinityList + plural: blockaffinities + singular: blockaffinity + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BlockAffinitySpec contains the specification for a BlockAffinity + resource. + properties: + cidr: + type: string + deleted: + description: Deleted indicates that this block affinity is being deleted. + This field is a string for compatibility with older releases that + mistakenly treat this field as a string. + type: string + node: + type: string + state: + type: string + required: + - cidr + - deleted + - node + - state + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_clusterinformations.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_clusterinformations.yaml new file mode 100755 index 0000000..c0c4149 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_clusterinformations.yaml @@ -0,0 +1,62 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: ClusterInformation + listKind: ClusterInformationList + plural: clusterinformations + singular: clusterinformation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ClusterInformation contains the cluster specific information. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterInformationSpec contains the values of describing + the cluster. + properties: + calicoVersion: + description: CalicoVersion is the version of Calico that the cluster + is running + type: string + clusterGUID: + description: ClusterGUID is the GUID of the cluster + type: string + clusterType: + description: ClusterType describes the type of the cluster + type: string + datastoreReady: + description: DatastoreReady is used during significant datastore migrations + to signal to components such as Felix that it should wait before + accessing the datastore. + type: boolean + variant: + description: Variant declares which variant of Calico should be active. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_felixconfigurations.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_felixconfigurations.yaml new file mode 100755 index 0000000..1756e24 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_felixconfigurations.yaml @@ -0,0 +1,561 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: FelixConfiguration + listKind: FelixConfigurationList + plural: felixconfigurations + singular: felixconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Felix Configuration contains the configuration for Felix. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FelixConfigurationSpec contains the values of the Felix configuration. + properties: + allowIPIPPacketsFromWorkloads: + description: 'AllowIPIPPacketsFromWorkloads controls whether Felix + will add a rule to drop IPIP encapsulated traffic from workloads + [Default: false]' + type: boolean + allowVXLANPacketsFromWorkloads: + description: 'AllowVXLANPacketsFromWorkloads controls whether Felix + will add a rule to drop VXLAN encapsulated traffic from workloads + [Default: false]' + type: boolean + awsSrcDstCheck: + description: 'Set source-destination-check on AWS EC2 instances. Accepted + value must be one of "DoNothing", "Enabled" or "Disabled". [Default: + DoNothing]' + enum: + - DoNothing + - Enable + - Disable + type: string + bpfConnectTimeLoadBalancingEnabled: + description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, + controls whether Felix installs the connection-time load balancer. The + connect-time load balancer is required for the host to be able to + reach Kubernetes services and it improves the performance of pod-to-service + connections. The only reason to disable it is for debugging purposes. [Default: + true]' + type: boolean + bpfDataIfacePattern: + description: BPFDataIfacePattern is a regular expression that controls + which interfaces Felix should attach BPF programs to in order to + catch traffic to/from the network. This needs to match the interfaces + that Calico workload traffic flows over as well as any interfaces + that handle incoming traffic to nodeports and services from outside + the cluster. It should not match the workload interfaces (usually + named cali...). + type: string + bpfDisableUnprivileged: + description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled + sysctl to disable unprivileged use of BPF. This ensures that unprivileged + users cannot access Calico''s BPF maps and cannot insert their own + BPF programs to interfere with Calico''s. [Default: true]' + type: boolean + bpfEnabled: + description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. + [Default: false]' + type: boolean + bpfExtToServiceConnmark: + description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit + mark that is set on connections from an external client to a local + service. This mark allows us to control how packets of that connection + are routed within the host and how is routing intepreted by RPF + check. [Default: 0]' + type: integer + bpfExternalServiceMode: + description: 'BPFExternalServiceMode in BPF mode, controls how connections + from outside the cluster to services (node ports and cluster IPs) + are forwarded to remote workloads. If set to "Tunnel" then both + request and response traffic is tunneled to the remote node. If + set to "DSR", the request traffic is tunneled but the response traffic + is sent directly from the remote node. In "DSR" mode, the remote + node appears to use the IP of the ingress node; this requires a + permissive L2 network. [Default: Tunnel]' + type: string + bpfKubeProxyEndpointSlicesEnabled: + description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls + whether Felix's embedded kube-proxy accepts EndpointSlices or not. + type: boolean + bpfKubeProxyIptablesCleanupEnabled: + description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF + mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s + iptables chains. Should only be enabled if kube-proxy is not running. [Default: + true]' + type: boolean + bpfKubeProxyMinSyncPeriod: + description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the + minimum time between updates to the dataplane for Felix''s embedded + kube-proxy. Lower values give reduced set-up latency. Higher values + reduce Felix CPU usage by batching up more work. [Default: 1s]' + type: string + bpfLogLevel: + description: 'BPFLogLevel controls the log level of the BPF programs + when in BPF dataplane mode. One of "Off", "Info", or "Debug". The + logs are emitted to the BPF trace pipe, accessible with the command + `tc exec bpf debug`. [Default: Off].' + type: string + chainInsertMode: + description: 'ChainInsertMode controls whether Felix hooks the kernel''s + top-level iptables chains by inserting a rule at the top of the + chain or by appending a rule at the bottom. insert is the safe default + since it prevents Calico''s rules from being bypassed. If you switch + to append mode, be sure that the other rules in the chains signal + acceptance by falling through to the Calico rules, otherwise the + Calico policy will be bypassed. [Default: insert]' + type: string + dataplaneDriver: + type: string + debugDisableLogDropping: + type: boolean + debugMemoryProfilePath: + type: string + debugSimulateCalcGraphHangAfter: + type: string + debugSimulateDataplaneHangAfter: + type: string + defaultEndpointToHostAction: + description: 'DefaultEndpointToHostAction controls what happens to + traffic that goes from a workload endpoint to the host itself (after + the traffic hits the endpoint egress policy). By default Calico + blocks traffic from workload endpoints to the host itself with an + iptables "DROP" action. If you want to allow some or all traffic + from endpoint to host, set this parameter to RETURN or ACCEPT. Use + RETURN if you have your own rules in the iptables "INPUT" chain; + Calico will insert its rules at the top of that chain, then "RETURN" + packets to the "INPUT" chain once it has completed processing workload + endpoint egress policy. Use ACCEPT to unconditionally accept packets + from workloads after processing workload endpoint egress policy. + [Default: Drop]' + type: string + deviceRouteProtocol: + description: This defines the route protocol added to programmed device + routes, by default this will be RTPROT_BOOT when left blank. + type: integer + deviceRouteSourceAddress: + description: This is the source address to use on programmed device + routes. By default the source address is left blank, leaving the + kernel to choose the source address used. + type: string + disableConntrackInvalidCheck: + type: boolean + endpointReportingDelay: + type: string + endpointReportingEnabled: + type: boolean + externalNodesList: + description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes + which may source tunnel traffic and have the tunneled traffic be + accepted at calico nodes. + items: + type: string + type: array + failsafeInboundHostPorts: + description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow incoming traffic to host endpoints + on irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all inbound host ports, use the value + none. The default value allows ssh access and DHCP. [Default: tcp:22, + udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + failsafeOutboundHostPorts: + description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow outgoing traffic from host endpoints + to irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all outbound host ports, use the value + none. The default value opens etcd''s standard ports to ensure that + Felix does not get cut off from etcd as well as allowing DHCP and + DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, + tcp:6667, udp:53, udp:67]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + featureDetectOverride: + description: FeatureDetectOverride is used to override the feature + detection. Values are specified in a comma separated list with no + spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". + "true" or "false" will force the feature, empty or omitted values + are auto-detected. + type: string + genericXDPEnabled: + description: 'GenericXDPEnabled enables Generic XDP so network cards + that don''t support XDP offload or driver modes can use XDP. This + is not recommended since it doesn''t provide better performance + than iptables. [Default: false]' + type: boolean + healthEnabled: + type: boolean + healthHost: + type: string + healthPort: + type: integer + interfaceExclude: + description: 'InterfaceExclude is a comma-separated list of interfaces + that Felix should exclude when monitoring for host endpoints. The + default value ensures that Felix ignores Kubernetes'' IPVS dummy + interface, which is used internally by kube-proxy. If you want to + exclude multiple interface names using a single value, the list + supports regular expressions. For regular expressions you must wrap + the value with ''/''. For example having values ''/^kube/,veth1'' + will exclude all interfaces that begin with ''kube'' and also the + interface ''veth1''. [Default: kube-ipvs0]' + type: string + interfacePrefix: + description: 'InterfacePrefix is the interface name prefix that identifies + workload endpoints and so distinguishes them from host endpoint + interfaces. Note: in environments other than bare metal, the orchestrators + configure this appropriately. For example our Kubernetes and Docker + integrations set the ''cali'' value, and our OpenStack integration + sets the ''tap'' value. [Default: cali]' + type: string + interfaceRefreshInterval: + description: InterfaceRefreshInterval is the period at which Felix + rescans local interfaces to verify their state. The rescan can be + disabled by setting the interval to 0. + type: string + ipipEnabled: + type: boolean + ipipMTU: + description: 'IPIPMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + ipsetsRefreshInterval: + description: 'IpsetsRefreshInterval is the period at which Felix re-checks + all iptables state to ensure that no other process has accidentally + broken Calico''s rules. Set to 0 to disable iptables refresh. [Default: + 90s]' + type: string + iptablesBackend: + description: IptablesBackend specifies which backend of iptables will + be used. The default is legacy. + type: string + iptablesFilterAllowAction: + type: string + iptablesLockFilePath: + description: 'IptablesLockFilePath is the location of the iptables + lock file. You may need to change this if the lock file is not in + its standard location (for example if you have mapped it into Felix''s + container at a different path). [Default: /run/xtables.lock]' + type: string + iptablesLockProbeInterval: + description: 'IptablesLockProbeInterval is the time that Felix will + wait between attempts to acquire the iptables lock if it is not + available. Lower values make Felix more responsive when the lock + is contended, but use more CPU. [Default: 50ms]' + type: string + iptablesLockTimeout: + description: 'IptablesLockTimeout is the time that Felix will wait + for the iptables lock, or 0, to disable. To use this feature, Felix + must share the iptables lock file with all other processes that + also take the lock. When running Felix inside a container, this + requires the /run directory of the host to be mounted into the calico/node + or calico/felix container. [Default: 0s disabled]' + type: string + iptablesMangleAllowAction: + type: string + iptablesMarkMask: + description: 'IptablesMarkMask is the mask that Felix selects its + IPTables Mark bits from. Should be a 32 bit hexadecimal number with + at least 8 bits set, none of which clash with any other mark bits + in use on the system. [Default: 0xff000000]' + format: int32 + type: integer + iptablesNATOutgoingInterfaceFilter: + type: string + iptablesPostWriteCheckInterval: + description: 'IptablesPostWriteCheckInterval is the period after Felix + has done a write to the dataplane that it schedules an extra read + back in order to check the write was not clobbered by another process. + This should only occur if another application on the system doesn''t + respect the iptables lock. [Default: 1s]' + type: string + iptablesRefreshInterval: + description: 'IptablesRefreshInterval is the period at which Felix + re-checks the IP sets in the dataplane to ensure that no other process + has accidentally broken Calico''s rules. Set to 0 to disable IP + sets refresh. Note: the default for this value is lower than the + other refresh intervals as a workaround for a Linux kernel bug that + was fixed in kernel version 4.11. If you are using v4.11 or greater + you may want to set this to, a higher value to reduce Felix CPU + usage. [Default: 10s]' + type: string + ipv6Support: + type: boolean + kubeNodePortRanges: + description: 'KubeNodePortRanges holds list of port ranges used for + service node ports. Only used if felix detects kube-proxy running + in ipvs mode. Felix uses these ranges to separate host and workload + traffic. [Default: 30000:32767].' + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + logFilePath: + description: 'LogFilePath is the full path to the Felix log. Set to + none to disable file logging. [Default: /var/log/calico/felix.log]' + type: string + logPrefix: + description: 'LogPrefix is the log prefix that Felix uses when rendering + LOG rules. [Default: calico-packet]' + type: string + logSeverityFile: + description: 'LogSeverityFile is the log severity above which logs + are sent to the log file. [Default: Info]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + logSeveritySys: + description: 'LogSeveritySys is the log severity above which logs + are sent to the syslog. Set to None for no logging to syslog. [Default: + Info]' + type: string + maxIpsetSize: + type: integer + metadataAddr: + description: 'MetadataAddr is the IP address or domain name of the + server that can answer VM queries for cloud-init metadata. In OpenStack, + this corresponds to the machine running nova-api (or in Ubuntu, + nova-api-metadata). A value of none (case insensitive) means that + Felix should not set up any NAT rule for the metadata path. [Default: + 127.0.0.1]' + type: string + metadataPort: + description: 'MetadataPort is the port of the metadata server. This, + combined with global.MetadataAddr (if not ''None''), is used to + set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. + In most cases this should not need to be changed [Default: 8775].' + type: integer + mtuIfacePattern: + description: MTUIfacePattern is a regular expression that controls + which interfaces Felix should scan in order to calculate the host's + MTU. This should not match workload interfaces (usually named cali...). + type: string + natOutgoingAddress: + description: NATOutgoingAddress specifies an address to use when performing + source NAT for traffic in a natOutgoing pool that is leaving the + network. By default the address used is an address on the interface + the traffic is leaving on (ie it uses the iptables MASQUERADE target) + type: string + natPortRange: + anyOf: + - type: integer + - type: string + description: NATPortRange specifies the range of ports that is used + for port mapping when doing outgoing NAT. When unset the default + behavior of the network stack is used. + pattern: ^.* + x-kubernetes-int-or-string: true + netlinkTimeout: + type: string + openstackRegion: + description: 'OpenstackRegion is the name of the region that a particular + Felix belongs to. In a multi-region Calico/OpenStack deployment, + this must be configured somehow for each Felix (here in the datamodel, + or in felix.cfg or the environment on each compute node), and must + match the [calico] openstack_region value configured in neutron.conf + on each node. [Default: Empty]' + type: string + policySyncPathPrefix: + description: 'PolicySyncPathPrefix is used to by Felix to communicate + policy changes to external services, like Application layer policy. + [Default: Empty]' + type: string + prometheusGoMetricsEnabled: + description: 'PrometheusGoMetricsEnabled disables Go runtime metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + prometheusMetricsEnabled: + description: 'PrometheusMetricsEnabled enables the Prometheus metrics + server in Felix if set to true. [Default: false]' + type: boolean + prometheusMetricsHost: + description: 'PrometheusMetricsHost is the host that the Prometheus + metrics server should bind to. [Default: empty]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. [Default: 9091]' + type: integer + prometheusProcessMetricsEnabled: + description: 'PrometheusProcessMetricsEnabled disables process metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + removeExternalRoutes: + description: Whether or not to remove device routes that have not + been programmed by Felix. Disabling this will allow external applications + to also add device routes. This is enabled by default which means + we will remove externally added routes. + type: boolean + reportingInterval: + description: 'ReportingInterval is the interval at which Felix reports + its status into the datastore or 0 to disable. Must be non-zero + in OpenStack deployments. [Default: 30s]' + type: string + reportingTTL: + description: 'ReportingTTL is the time-to-live setting for process-wide + status reports. [Default: 90s]' + type: string + routeRefreshInterval: + description: 'RouteRefreshInterval is the period at which Felix re-checks + the routes in the dataplane to ensure that no other process has + accidentally broken Calico''s rules. Set to 0 to disable route refresh. + [Default: 90s]' + type: string + routeSource: + description: 'RouteSource configures where Felix gets its routing + information. - WorkloadIPs: use workload endpoints to construct + routes. - CalicoIPAM: the default - use IPAM data to construct routes.' + type: string + routeTableRange: + description: Calico programs additional Linux route tables for various + purposes. RouteTableRange specifies the indices of the route tables + that Calico should use. + properties: + max: + type: integer + min: + type: integer + required: + - max + - min + type: object + serviceLoopPrevention: + description: 'When service IP advertisement is enabled, prevent routing + loops to service IPs that are not in use, by dropping or rejecting + packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled", + in which case such routing loops continue to be allowed. [Default: + Drop]' + type: string + sidecarAccelerationEnabled: + description: 'SidecarAccelerationEnabled enables experimental sidecar + acceleration [Default: false]' + type: boolean + usageReportingEnabled: + description: 'UsageReportingEnabled reports anonymous Calico version + number and cluster size to projectcalico.org. Logs warnings returned + by the usage server. For example, if a significant security vulnerability + has been discovered in the version of Calico being used. [Default: + true]' + type: boolean + usageReportingInitialDelay: + description: 'UsageReportingInitialDelay controls the minimum delay + before Felix makes a report. [Default: 300s]' + type: string + usageReportingInterval: + description: 'UsageReportingInterval controls the interval at which + Felix makes reports. [Default: 86400s]' + type: string + useInternalDataplaneDriver: + type: boolean + vxlanEnabled: + type: boolean + vxlanMTU: + description: 'VXLANMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + vxlanPort: + type: integer + vxlanVNI: + type: integer + wireguardEnabled: + description: 'WireguardEnabled controls whether Wireguard is enabled. + [Default: false]' + type: boolean + wireguardInterfaceName: + description: 'WireguardInterfaceName specifies the name to use for + the Wireguard interface. [Default: wg.calico]' + type: string + wireguardListeningPort: + description: 'WireguardListeningPort controls the listening port used + by Wireguard. [Default: 51820]' + type: integer + wireguardMTU: + description: 'WireguardMTU controls the MTU on the Wireguard interface. + See Configuring MTU [Default: 1420]' + type: integer + wireguardRoutingRulePriority: + description: 'WireguardRoutingRulePriority controls the priority value + to use for the Wireguard routing rule. [Default: 99]' + type: integer + xdpEnabled: + description: 'XDPEnabled enables XDP acceleration for suitable untracked + incoming deny rules. [Default: true]' + type: boolean + xdpRefreshInterval: + description: 'XDPRefreshInterval is the period at which Felix re-checks + all XDP state to ensure that no other process has accidentally broken + Calico''s BPF maps or attached programs. Set to 0 to disable XDP + refresh. [Default: 90s]' + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_globalnetworkpolicies.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_globalnetworkpolicies.yaml new file mode 100755 index 0000000..4360dda --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_globalnetworkpolicies.yaml @@ -0,0 +1,769 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkPolicy + listKind: GlobalNetworkPolicyList + plural: globalnetworkpolicies + singular: globalnetworkpolicy + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + applyOnForward: + description: ApplyOnForward indicates to apply the rules in this policy + on forward traffic. + type: boolean + doNotTrack: + description: DoNotTrack indicates whether packets matched by the rules + in this policy should go through the data plane's connection tracking, + such as Linux conntrack. If True, the rules in this policy are + applied before any data plane connection tracking, and packets allowed + by this policy are marked as not to be tracked. + type: boolean + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + namespaceSelector: + description: NamespaceSelector is an optional field for an expression + used to select a pod based on namespaces. + type: string + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + preDNAT: + description: PreDNAT indicates to apply the rules in this policy before + any DNAT. + type: boolean + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress rules are present in the policy. The + default is: \n - [ PolicyTypeIngress ], if there are no Egress rules + (including the case where there are also no Ingress rules) \n + - [ PolicyTypeEgress ], if there are Egress rules but no Ingress + rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are + both Ingress and Egress rules. \n When the policy is read back again, + Types will always be one of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_globalnetworksets.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_globalnetworksets.yaml new file mode 100755 index 0000000..00a2980 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_globalnetworksets.yaml @@ -0,0 +1,51 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkSet + listKind: GlobalNetworkSetList + plural: globalnetworksets + singular: globalnetworkset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs + that share labels to allow rules to refer to them via selectors. The labels + of GlobalNetworkSet are not namespaced. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GlobalNetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_hostendpoints.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_hostendpoints.yaml new file mode 100755 index 0000000..4824531 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_hostendpoints.yaml @@ -0,0 +1,106 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: HostEndpoint + listKind: HostEndpointList + plural: hostendpoints + singular: hostendpoint + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HostEndpointSpec contains the specification for a HostEndpoint + resource. + properties: + expectedIPs: + description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. + If \"InterfaceName\" is not present, Calico will look for an interface + matching any of the IPs in the list and apply policy to that. Note: + \tWhen using the selector match criteria in an ingress or egress + security Policy \tor Profile, Calico converts the selector into + a set of IP addresses. For host \tendpoints, the ExpectedIPs field + is used for that purpose. (If only the interface \tname is specified, + Calico does not learn the IPs of the interface for use in match + \tcriteria.)" + items: + type: string + type: array + interfaceName: + description: "Either \"*\", or the name of a specific Linux interface + to apply policy to; or empty. \"*\" indicates that this HostEndpoint + governs all traffic to, from or through the default network namespace + of the host named by the \"Node\" field; entering and leaving that + namespace via any interface, including those from/to non-host-networked + local workloads. \n If InterfaceName is not \"*\", this HostEndpoint + only governs traffic that enters or leaves the host through the + specific interface named by InterfaceName, or - when InterfaceName + is empty - through the specific interface that has one of the IPs + in ExpectedIPs. Therefore, when InterfaceName is empty, at least + one expected IP must be specified. Only external interfaces (such + as \"eth0\") are supported here; it isn't possible for a HostEndpoint + to protect traffic through a specific local workload interface. + \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; + initially just pre-DNAT policy. Please check Calico documentation + for the latest position." + type: string + node: + description: The node name identifying the Calico node instance. + type: string + ports: + description: Ports contains the endpoint's named ports, which may + be referenced in security policy rules. + items: + properties: + name: + type: string + port: + type: integer + protocol: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + required: + - name + - port + - protocol + type: object + type: array + profiles: + description: A list of identifiers of security Profile objects that + apply to this endpoint. Each profile is applied in the order that + they appear in this list. Profile rules are applied after the selector-based + security policy. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamblocks.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamblocks.yaml new file mode 100755 index 0000000..6c333a0 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamblocks.yaml @@ -0,0 +1,79 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMBlock + listKind: IPAMBlockList + plural: ipamblocks + singular: ipamblock + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMBlockSpec contains the specification for an IPAMBlock + resource. + properties: + affinity: + type: string + allocations: + items: + type: integer + # TODO: This nullable is manually added in. We should update controller-gen + # to handle []*int properly itself. + nullable: true + type: array + attributes: + items: + properties: + handle_id: + type: string + secondary: + additionalProperties: + type: string + type: object + type: object + type: array + cidr: + type: string + deleted: + type: boolean + strictAffinity: + type: boolean + unallocated: + items: + type: integer + type: array + required: + - allocations + - attributes + - cidr + - strictAffinity + - unallocated + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamconfigs.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamconfigs.yaml new file mode 100755 index 0000000..3d85b16 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamconfigs.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMConfig + listKind: IPAMConfigList + plural: ipamconfigs + singular: ipamconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMConfigSpec contains the specification for an IPAMConfig + resource. + properties: + autoAllocateBlocks: + type: boolean + maxBlocksPerHost: + description: MaxBlocksPerHost, if non-zero, is the max number of blocks + that can be affine to each host. + type: integer + strictAffinity: + type: boolean + required: + - autoAllocateBlocks + - strictAffinity + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamhandles.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamhandles.yaml new file mode 100755 index 0000000..5c875cc --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ipamhandles.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMHandle + listKind: IPAMHandleList + plural: ipamhandles + singular: ipamhandle + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMHandleSpec contains the specification for an IPAMHandle + resource. + properties: + block: + additionalProperties: + type: integer + type: object + deleted: + type: boolean + handleID: + type: string + required: + - block + - handleID + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ippools.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ippools.yaml new file mode 100755 index 0000000..7e41753 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_ippools.yaml @@ -0,0 +1,97 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPPool + listKind: IPPoolList + plural: ippools + singular: ippool + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec contains the specification for an IPPool resource. + properties: + blockSize: + description: The block size to use for IP address assignments from + this pool. Defaults to 26 for IPv4 and 112 for IPv6. + type: integer + cidr: + description: The pool CIDR. + type: string + disabled: + description: When disabled is true, Calico IPAM will not assign addresses + from this pool. + type: boolean + ipip: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + properties: + enabled: + description: When enabled is true, ipip tunneling will be used + to deliver packets to destinations within this pool. + type: boolean + mode: + description: The IPIP mode. This can be one of "always" or "cross-subnet". A + mode of "always" will also use IPIP tunneling for routing to + destination IP addresses within this pool. A mode of "cross-subnet" + will only use IPIP tunneling when the destination node is on + a different subnet to the originating node. The default value + (if not specified) is "always". + type: string + type: object + ipipMode: + description: Contains configuration for IPIP tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling + is disabled). + type: string + nat-outgoing: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + type: boolean + natOutgoing: + description: When nat-outgoing is true, packets sent from Calico networked + containers in this pool to destinations outside of this pool will + be masqueraded. + type: boolean + nodeSelector: + description: Allows IPPool to allocate for a specific node by label + selector. + type: string + vxlanMode: + description: Contains configuration for VXLAN tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. VXLAN + tunneling is disabled). + type: string + required: + - cidr + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_kubecontrollersconfigurations.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_kubecontrollersconfigurations.yaml new file mode 100755 index 0000000..aa23fd9 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_kubecontrollersconfigurations.yaml @@ -0,0 +1,230 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: kubecontrollersconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: KubeControllersConfiguration + listKind: KubeControllersConfigurationList + plural: kubecontrollersconfigurations + singular: kubecontrollersconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: KubeControllersConfigurationSpec contains the values of the + Kubernetes controllers configuration. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host endpoints. + Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation of + host endpoints for every node. [Default: Disabled]' + type: string + type: object + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: 9094]' + type: integer + required: + - controllers + type: object + status: + description: KubeControllersConfigurationStatus represents the status + of the configuration. It's useful for admins to be able to see the actual + config that was applied, which can be modified by environment variables + on the kube-controllers process. + properties: + environmentVars: + additionalProperties: + type: string + description: EnvironmentVars contains the environment variables on + the kube-controllers that influenced the RunningConfig. + type: object + runningConfig: + description: RunningConfig contains the effective config that is running + in the kube-controllers pod, after merging the API resource with + any environment variables. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace + controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host + endpoints. Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation + of host endpoints for every node. [Default: Disabled]' + type: string + type: object + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which + logs are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: + 9094]' + type: integer + required: + - controllers + type: object + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_networkpolicies.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_networkpolicies.yaml new file mode 100755 index 0000000..8e4bd8b --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_networkpolicies.yaml @@ -0,0 +1,750 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkPolicy + listKind: NetworkPolicyList + plural: networkpolicies + singular: networkpolicy + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress are present in the policy. The default + is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including + the case where there are also no Ingress rules) \n - [ PolicyTypeEgress + ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, + PolicyTypeEgress ], if there are both Ingress and Egress rules. + \n When the policy is read back again, Types will always be one + of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_networksets.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_networksets.yaml new file mode 100755 index 0000000..4bb0e21 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crd.projectcalico.org_networksets.yaml @@ -0,0 +1,49 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkSet + listKind: NetworkSetList + plural: networksets + singular: networkset + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: NetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/crs/custom-resources.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/crs/custom-resources.yaml new file mode 100755 index 0000000..7e97770 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/crs/custom-resources.yaml @@ -0,0 +1,24 @@ +{{ if .Values.installation.enabled }} +{{ $installSpec := omit .Values.installation "enabled" }} +{{ $secrets := list }} +{{ range $name := keys .Values.imagePullSecrets -}} +{{ $item := dict "name" $name }} +{{ $secrets = append $secrets $item }} +{{ end }} +{{ $_ := set $installSpec "imagePullSecrets" $secrets }} +{{ $defaultRegistry := get $installSpec "registry" }} +{{ $finalRegistry := coalesce .Values.global.systemDefaultRegistry $defaultRegistry }} +{{ $_ := set $installSpec "registry" $finalRegistry }} +{{ $defaultipPools := get .Values.installation.calicoNetwork "ipPools" | first }} +{{ $defaultCIDR := get $defaultipPools "cidr" }} +{{ $finalCIDR := coalesce .Values.global.clusterCIDR $defaultCIDR }} +{{ $_ := set $defaultipPools "cidr" $finalCIDR }} + +apiVersion: operator.tigera.io/v1 +kind: Installation +metadata: + name: default +spec: +{{ $installSpec | toYaml | indent 2 }} + +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/00-namespace-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/00-namespace-tigera-operator.yaml new file mode 100755 index 0000000..b7e260e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/00-namespace-tigera-operator.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: tigera-operator + annotations: +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/node-selector: "" +{{- end }} + labels: + name: tigera-operator +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/run-level: "0" +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/01-imagepullsecret.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/01-imagepullsecret.yaml new file mode 100755 index 0000000..b90407c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/01-imagepullsecret.yaml @@ -0,0 +1,15 @@ +{{- $envAll := . }} +{{- if .Values.imagePullSecrets -}} + +{{range $key, $value := .Values.imagePullSecrets -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $key }} + namespace: tigera-operator +data: + .dockerconfigjson: {{ $value | b64enc }} +type: kubernetes.io/dockerconfigjson +{{- end -}} + +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-configmap-calico-resources.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-configmap-calico-resources.yaml new file mode 100755 index 0000000..2270813 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-configmap-calico-resources.yaml @@ -0,0 +1,27 @@ +{{- if eq .Values.installation.kubernetesProvider "openshift" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: calico-resources + namespace: tigera-operator +data: + # To create Calico resources before Calico components are started add + # an entry here and the contents of the resource under the entry. + # The resources here should all be projectcalico.org/v3. + # Multiple resources/entries can be added to this ConfigMap. + # + # If you need to remove a resource that was added to this ConfigMap + # you should remove it from here or else it will be re-created. + # + # example-global-network-set.yaml: | + # apiVersion: projectcalico.org/v3 + # kind: GlobalNetworkSet + # metadata: + # name: a-name-for-the-set + # labels: + # role: external-database + # spec: + # nets: + # - 198.51.100.0/28 + # - 203.0.113.0/24 +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml new file mode 100755 index 0000000..97e5c04 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml @@ -0,0 +1,47 @@ +{{ if ne .Values.installation.kubernetesProvider "openshift" }} +# This should not be rendered for an OpenShift install. +# OpenShift uses SecurityContextConstraints instead. +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: tigera-operator + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'hostPath' + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + # Assume that persistentVolumes set up by the cluster admin are safe to use. + - 'persistentVolumeClaim' + hostNetwork: true + hostPorts: + - min: 0 + max: 65535 + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-role-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-role-tigera-operator.yaml new file mode 100755 index 0000000..70b68b2 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-role-tigera-operator.yaml @@ -0,0 +1,253 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tigera-operator +rules: + - apiGroups: + - "" + resources: + - namespaces + - pods + - podtemplates + - services + - endpoints + - events + - configmaps + - secrets + - serviceaccounts + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + # Need to update node labels when migrating nodes. + - 'get' + - 'patch' + - 'list' + # We need this for Typha autoscaling + - 'watch' + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - rolebindings + - roles + verbs: + - create + - get + - list + - update + - delete + - watch + - bind + - escalate + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - statefulsets + verbs: + - create + - get + - list + - patch + - update + - delete + - watch + - apiGroups: + - apps + resourceNames: + - tigera-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - operator.tigera.io + resources: + - '*' + verbs: + - create + - get + - list + - update + - patch + - delete + - watch + - apiGroups: + - crd.projectcalico.org + resources: + - felixconfigurations + verbs: + - patch + - apiGroups: + - crd.projectcalico.org + resources: + - ippools + - kubecontrollersconfigurations + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - apiregistration.k8s.io + resources: + - apiservices + verbs: + - list + - watch + # Needed for operator lock + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - update + - delete + - watch +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + # When running in OpenShift, we need to update networking config. + - apiGroups: + - config.openshift.io + resources: + - networks/status + verbs: + - get + - list + - update + - apiGroups: + - config.openshift.io + resources: + - networks + - infrastructures + verbs: + - get + - list + - patch + - watch + # On OpenShift, we need to modify SCCs. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - create + - get + - list + - update + - delete + - watch + # The following rule is only for operator certification purposes. + # The operator normally runs in a namespace with openshift.io/run-level=0 which bypasses SCC. + # However in certification tests, the operator is run in a normal namespace so this + # rule is needed for host networking and hostPath volume access. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - hostaccess + verbs: + - use + # Need these permissions for the calicoctl init container. + - apiGroups: + - crd.projectcalico.org + resources: + - bgpconfigurations + - bgppeers + - felixconfigurations + - kubecontrollersconfigurations + - globalnetworkpolicies + - globalnetworksets + - hostendpoints + - ippools + - networkpolicies + - networksets + verbs: + - create + - apiGroups: + - crd.projectcalico.org + resources: + - ipamblocks + verbs: + - list + # For AWS security group setup. + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - create + - update + - list + - watch +{{- else }} + # Add the appropriate pod security policy permissions + - apiGroups: + - policy + resources: + - podsecuritypolicies + resourceNames: + - tigera-operator + verbs: + - use + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - get + - list + - watch + - create + - update +# Add the permissions to monitor the status of certificatesigningrequests when certificate management is enabled. + - apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + verbs: + - list +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-rolebinding-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-rolebinding-tigera-operator.yaml new file mode 100755 index 0000000..5689683 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-rolebinding-tigera-operator.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tigera-operator +subjects: +- kind: ServiceAccount + name: tigera-operator + namespace: tigera-operator +roleRef: + kind: ClusterRole + name: tigera-operator + apiGroup: rbac.authorization.k8s.io diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml new file mode 100755 index 0000000..14cd955 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tigera-operator + namespace: tigera-operator diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-tigera-operator.yaml new file mode 100755 index 0000000..e705255 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/tigera-operator/02-tigera-operator.yaml @@ -0,0 +1,85 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tigera-operator + namespace: tigera-operator + labels: + k8s-app: tigera-operator +spec: + replicas: 1 + selector: + matchLabels: + name: tigera-operator + template: + metadata: + labels: + name: tigera-operator + k8s-app: tigera-operator + spec: + nodeSelector: + kubernetes.io/os: linux + tolerations: + - effect: NoExecute + operator: Exists + - effect: NoSchedule + operator: Exists + serviceAccountName: tigera-operator + hostNetwork: true + # This must be set when hostNetwork is true or else the cluster services won't resolve + dnsPolicy: ClusterFirstWithHostNet + containers: + - name: tigera-operator + image: {{ template "tigera-operator.image" . }} + imagePullPolicy: IfNotPresent + command: + - operator + volumeMounts: + - name: var-lib-calico + readOnly: true + mountPath: /var/lib/calico + env: + - name: WATCH_NAMESPACE + value: "" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: "tigera-operator" + - name: TIGERA_OPERATOR_INIT_IMAGE_VERSION + value: {{.Values.tigeraOperator.version}} + envFrom: + - configMapRef: + name: kubernetes-services-endpoint + optional: true + volumes: + - name: var-lib-calico + hostPath: + path: /var/lib/calico +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + - name: calico-resources + configMap: + defaultMode: 0400 + name: calico-resources + - name: install-resources-script + configMap: + defaultMode: 0777 + name: install-resources-script + initContainers: + - name: create-initial-resources + image: {{.Values.calicoctl.image}}:{{.Values.calicoctl.tag}} + env: + - name: DATASTORE_TYPE + value: kubernetes + command: + - calicoctl + args: + - create + - --skip-exists + - --skip-empty + - -f + - /calico-resources + volumeMounts: + - name: calico-resources + mountPath: /calico-resources +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.1907/templates/validate-install-crd.yaml b/charts/rke2-calico/rke2-calico/v3.1907/templates/validate-install-crd.yaml new file mode 100755 index 0000000..991eb46 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/templates/validate-install-crd.yaml @@ -0,0 +1,16 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "operator.tigera.io/v1/ImageSet" false -}} +# {{- set $found "operator.tigera.io/v1/Installation" false -}} +# {{- set $found "operator.tigera.io/v1/TigeraStatus" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rke2-calico/rke2-calico/v3.1907/values.yaml b/charts/rke2-calico/rke2-calico/v3.1907/values.yaml new file mode 100755 index 0000000..216e689 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.1907/values.yaml @@ -0,0 +1,44 @@ +imagePullSecrets: {} + +installation: + controlPlaneTolerations: + - key: "node-role.kubernetes.io/control-plane" + operator: "Exists" + effect: "NoSchedule" + - key: "node-role.kubernetes.io/etcd" + operator: "Exists" + effect: "NoExecute" + enabled: true + kubernetesProvider: "" + calicoNetwork: + bgp: Disabled + ipPools: + - natOutgoing: Enabled + encapsulation: VXLAN + cidr: 10.42.0.0/16 + imagePath: "rancher" + imagePrefix: "mirrored-calico-" + + +certs: + node: + key: + cert: + commonName: + typha: + key: + cert: + commonName: + caBundle: + +# Configuration for the tigera operator +tigeraOperator: + image: rancher/mirrored-calico-operator + version: v1.17.4 + registry: docker.io +calicoctl: + image: rancher/mirrored-calico-ctl + tag: v3.19.1 + +global: + systemDefaultRegistry: "" diff --git a/index.yaml b/index.yaml index 2f4781e..5e70642 100755 --- a/index.yaml +++ b/index.yaml @@ -1,6 +1,17 @@ apiVersion: v1 entries: rke2-calico: + - annotations: + catalog.cattle.io/namespace: tigera-operator + apiVersion: v2 + appVersion: v3.19.1-2 + created: "2021-07-07T08:18:57.719441602Z" + description: Installs the Tigera operator for Calico + digest: 179c42fa4dbc70a75f28357bf85c06b685e7f90aeab1c6c121c76075e65bbf56 + name: rke2-calico + urls: + - assets/rke2-calico/rke2-calico-v3.1907.tgz + version: v3.1907 - annotations: catalog.cattle.io/namespace: tigera-operator apiVersion: v2 @@ -68,6 +79,15 @@ entries: - assets/rke2-calico/rke2-calico-v3.18.1-101.tgz version: v3.18.1-101 rke2-calico-crd: + - apiVersion: v1 + created: "2021-07-07T08:18:57.708528959Z" + description: Installs the CRDs for rke2-calico + digest: e4ccb0d5cb8131053d77aabf716d7b7b4d4498965bfe58820926099c28bdcaad + name: rke2-calico-crd + type: application + urls: + - assets/rke2-calico/rke2-calico-crd-v1.0.007.tgz + version: v1.0.007 - apiVersion: v1 created: "2021-06-04T06:41:00.03520429Z" description: Installs the CRDs for rke2-calico