From f2b325b040ac4ed4536b63b7ee74d50543f390ad Mon Sep 17 00:00:00 2001 From: actions Date: Thu, 30 Sep 2021 22:22:01 +0000 Subject: [PATCH] Fix canal network configuration when ipv6 not enabled Signed-off-by: Brad Davidson --- .../rke2-canal-v3.19.1-build2021061110.tgz | Bin 0 -> 27871 bytes .../v3.19.1-build2021061110/Chart.yaml | 13 + .../templates/NOTES.txt | 3 + .../templates/_helpers.tpl | 7 + .../templates/config.yaml | 71 ++ .../templates/crds/bgpconfigurations.crd.yaml | 144 +++ .../templates/crds/bgppeers.crd.yaml | 115 +++ .../templates/crds/blockaffinities.crd.yaml | 62 ++ .../crds/clusterinformations.crd.yaml | 65 ++ .../crds/felixconfigurations.crd.yaml | 565 ++++++++++++ .../crds/globalnetworkpolicies.crd.yaml | 856 ++++++++++++++++++ .../templates/crds/globalnetworksets.crd.yaml | 55 ++ .../templates/crds/hostendpoints.crd.yaml | 109 +++ .../templates/crds/ipamblocks.crd.yaml | 82 ++ .../templates/crds/ipamconfigs.crd.yaml | 57 ++ .../templates/crds/ipamhandles.crd.yaml | 57 ++ .../templates/crds/ippools.crd.yaml | 100 ++ .../templates/crds/networkpolicies.crd.yaml | 838 +++++++++++++++++ .../templates/crds/networksets.crd.yaml | 52 ++ .../templates/daemonset.yaml | 266 ++++++ .../templates/rbac.yaml | 163 ++++ .../templates/serviceaccount.yaml | 6 + .../v3.19.1-build2021061110/values.yaml | 82 ++ index.yaml | 17 + 24 files changed, 3785 insertions(+) create mode 100755 assets/rke2-canal/rke2-canal-v3.19.1-build2021061110.tgz create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/Chart.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/NOTES.txt create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/_helpers.tpl create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/config.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/bgpconfigurations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/bgppeers.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/blockaffinities.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/clusterinformations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/felixconfigurations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/globalnetworkpolicies.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/globalnetworksets.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/hostendpoints.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamblocks.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamconfigs.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamhandles.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ippools.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/networkpolicies.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/networksets.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/daemonset.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/rbac.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/serviceaccount.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/values.yaml diff --git a/assets/rke2-canal/rke2-canal-v3.19.1-build2021061110.tgz b/assets/rke2-canal/rke2-canal-v3.19.1-build2021061110.tgz new file mode 100755 index 0000000000000000000000000000000000000000..7e5dd72790b169a2e5fa8d32e430f9abe9459b65 GIT binary patch literal 27871 zcmYg%b95&`({60rwr$(CZJQh0_QtmH3pTcsjkO!wPJVa4_q*@8cm9}DRbAE7^PKLP zKJ`=+$H8EL{LclX1)(>UQDZTeQRGta<>fSE*J80y=d{&R=jBq?(&AFocCa&bvhdYV zbrzJdbZ`W@?6ddZ;`&XqIsc7`^OWz}l0;$rhlg;U-#yX3vc6E3z;VkKP%hQ3P=E&naBpwV_#61WxLDhWl!%06Ow`B2w=Mi_2izYW9K6%E0LGl42Dmv^z1soP z#`TQ08xMoGZr81o39KBR5MvSM=#Q_1pH*X2Fr zr4)s3tlK%0=>^F-tT{p(TY!N9Vk^0CVyv8KDuGn->I#2;ZwFUq%{pZ-CT&~| zDMl0Y+mTgf zk|VKy!+_u?$k=)gbGBgB&k{L0VWTQnlqlm#MjYOr5hD@DgAEK6!8HDlQ z-#jJ7oy<0f=jc9>6&rInu}7ONvkFy6SBS}RRm8wl=h~jM2pBW>6!U}r7%m+?_;v}p z+3)IXWtXi&Vc^{$J+ybrO4|7KCFUbn=@7LKyz&>rm@Ye(su_j7gZ7ouoPmh@@?Kb2 zID^f(K}JrD{CHYM_`Ck(W}2P55S?PsnjMcVlQ1Dc$CkF448;4y1x8!s9*0V=Ed3(& zaA75d&BI|+s_MExXEz`Eu3VyBBf{!FHiL7Hh~H?4L^9(l_BD%6?KbUDb{gO#?c1dz zxqQ_a39qsJ$!5y2LHbO*31%tc7X~^HMY|ew^Arj{PRbdyImER8mk!= zZde~U2Vp9_Ij{wPw5z$Zct?FS+%#84GCRhMzjfW)rFCK*mJ4l$MPj&+hI_%*Adwsv zd)p=VHt5&pH7)m^tme#NI8Fw8cozn`&@8670F?)yrbDd1V8yeJtSB39T5H?`{g!sa zhRoQrafZ=ccg5fE6z2hAQDFlG(~D%lzS(>IIJbO&%Ra?gBrQa2f$L28K^i1MYqn*K z!Fn3l4d`Bz;82nGOTslchJX7VwSXx_%5t?}qh4wfmQIT7rSm&^bJ`+^ngftfc^%(@ zP-kY;=7)neFbixyn3~}L8GGaNm2aM{dImOULE>)~c|}+JM>u?mE`?;>$Mg2iybs4P za*P>xt|hE>t`1YY^;lv#V<1=EB~ehH8T#ns(6E+K%mW$U}bN$}(8a=ajILOD#@@OFyq=+YUp{h=|Mc6JRey2|_%t zbfa4gs(Y#Fs&x}9jN}}GjfL^g?ek_G}~`&&=Ha6O|_h7v&}9@+7%RpYJ`Q5NxuWg^k!bPf!66UIQc$&pwnh zAfQAumZ_Bv$ss&!(cNz8Z_=-X<>~GXN)x;JHGSbpFW0vZf}d!@5>wF>xh|}k-F+Oi z${YncU3AlLy-Mt@B%3sGqqL=B*ilw8yY^CER~X)=l>)wZhPSY~6Ztcz`5VF*DKDW_ z0@caUHwIhq1iM3C7SK#M5Zr<}dBD@p-R`>!^z9rfH-(VOWq3!O^W>vg#cr-=sc=o6 z5(nq7H`V=4^VcikSu$WnVeF^1PA=sNOP}}K_3_iwf^DE3(E82c z0P`JB=Ej+8@^=dEs>Mw9Z7+awh#!kqiD5Zs36k}3&S?0B;)tvhp)v!pR||%T7sxmP zlG(g863g-{KS`HDeJhkk>Mx`l^YC>M5c=o-8<53Zb}XGJ_mWma^kNPe_htDtKb`gQ z?+Z#cFAU^u3IN59f4r^v-d_(#o-+I`$oBd&;O!tTL^@2YDj$vg$>IaRzG5GZ$VuJ> z*1z~|1x}*P#s)o3;p*60zTE&hV1ibaZ$G7fwFu`>`OLlv^YQQ*2?3dr01rUPpMxe% z51idlag#CVbT!!^!U%LQpi^cI1v)R8R$5x%kToe3bQXeg9P(7)^l~lh50IFO`z|Mm zaj#{UR@Ref8EoR_cBitYk8dZ!lee*y@pfEoVkB=b13M!I=mjBAn4X0qMqUBPj&4WL z386<(ZaC64`Kxxi?-W3?p!xD<^w)B_G}BvTrE&w^l(pBPymP+(^m9|po($5=ljSl# zm)tPq>Pc}yzxpA$Ag@ve{__pPq=uDR9)Wo}NK=kn(C8?L{$<=a9>pT!wshTZOa_AW zgwBxQ4*K#)X%1N|iZorPd9};7UE=M1;@evE`$o{J5a5}|sbE}$;EE~|8!ocJhtVE) zbht20$Hw>V=xtHJ83#@u`u&<1EpR^8uiqLA*CVNkPAJ?vCjW=bdOl?bsLhdGBRu9E z^qy?BLPKYp%frR%?E&-6KwzNf+xx#+6E*F9(kN{3vp?|bK>RCi zjBr3z-x02&KXrS=3YIzYZ;}*LMY}#R{I<|_Ev1(kb4^a2PXL!16*>{)=2*{%6nBsj zs7w*O3iWVDRxq!>_uJ0s3voZd=fTgz?_oF!xqZ$XY#5@GJ#DItqZV8f-VWPIW6o|s znxoYGr^~SG&)X;cTuTFm_79VX;&F|U7XhwTqYn~GKnCizanROa5HC7B-au%Sr_An@ z!Fp{3Jb8#f`WV}Z{JsK=i!=f-spDm8;9PpPoB1&~S|XK7LE0flwVt**Hft_lmy|Vd zp3He^@y<>9!Ms<|#0b0e?e4cbyr*tK!393&oL4v)y8yeP(l6UtQ`P?r+@1 z=6v`{z)R-IWuqM8i**5RhZ{U*oMoDTP);hY`m>pE_4aFqV*{&DJMZPDtr>l#_t4^w zn(n2R)Zs`sax+14n<`su=EtaZqrMp z$jho)8KtN06w2TSaocZNLzK}=8Vc-;@BC>3UwTY%`X|}dzYC?EX|FS8^I!&du1;l3 z{>?{iFC2wPRk2pvO%sQ)SBvq;Cg)&_d_st+_h7f3me34f`XQ-) z7bJBh5N%n^jYh_MD8d{LV{DJ0*GEx3+hFi4OjHU7RD8}XTCD8)@$x+A)B9_0JV#^K zAA9ZTRpt9`ZosSaOHj|LC+ytH=}%H*nfo5$})52o}X$^~oGi_%xeZ@f%merv6~0@3IrG6xtCVy?Ms3kE~|LBf|kbtaxf@~l>$Suzfg}ISFpCgiC;%HZ#BKsgpNBrtn zdMC<5YTFQEG7%$Ad7rX`PAa5Vbx=rc``&CT6dpjW347*-*=;4MyzW}KJ)a$FEUZVv z{rtN4LmZPFdfZ|rfuB(v$JUp4+VqkEA7D@*x`#+^cF(Hl+KV04e)pp#A?t}E!*cdcjZmeuNhp z9~OvQH-7Ck^*A#WW=g#}ij&bgHX2{9fMaN7%05cT3xc(mmtu{j3AjlMzAVFkHX>}?+yh77dF+Z!*S}DKN+gBT8dQoQ1HdKj=#&I+p{(kX3*-r-- z+-X#?3no-e`yyl0&9lRhk5SuhYjtDY@*`u@&y!2J^-0cgfOpNi=PqH>hwV-`F2Qk) z%=a_l9HCk%#FbS~dZHm~3mk(1G+3Qi$-?6#Tw0*ODHw&;{SKrbJ(q&bE%i@X8Fipr z@V>W;Gqc4p7&EZvx!txu$bP4*>&I~oD%RJ1t;O;B1fk7%$Gp8Mgh_VbvnfV-}>A`FHS*MHiiG@;Q*M02SvRwuO% z8g?#MsE)7=|CzSb7jM*NCo~}l$6#F-dW3zu*z;=A#sZ!yf<2E@Hv!u=fox+de`kM; zwvK&!`vf!%90Fg?N2j$5zHa0NlpTQL@o&9W18DSxE1TSAO3rHR_Z!CI9fH{-HL}dZ zN)_tTQs(e0_XSpy zhe>_bb2V=Q3;c2)kW9&}W!|^??zYkyp^sw*qr*0ASM^RBd15@}$l3_^_1m|}qxFdd z0uhv8$VjhMMYM|-xnIdj+sG3p(h*0-0%HYfE`G+Sj@AFw;R%+i|n@zx=x zDYu&;S@as9lOTdSbK<={ac|Lnqc)Fxjp*txf)A zdRjwTs9%?sBI6dJuxCc27kIQ3F6hLisFtcv#^IAw1W2dK;0#&j^rvJ#H_6bq8TSoI z;E3s6%Fq1M^ldXfU)O*=|MDlm&rb9Y(Fth@y8Fcr-uH*epbf4ds9J0azpxNH^t$*{ z=5`bSl#A2@DJ89uiN(x}pnFIt z%6oWc*j3+tVr}cSJ_#0rk&8VmWD#+&@`O%qP6jcj(f2bJ@cAQ!5=DILait(c3kn5o z4OStl-F0o8-q0M!s3@p&Z0Um~bwA`}bPo=}%hQoy0Jc~c;5g2c7wQe!$IqF;-hv56 zhJKLQfdsxYBoD-ZpUCMoj%k%N3@MckDX%*T(0a=sQm^UatCWF77=dLqBDicCh*SmJ8T ztx}er2-HqQI&d_;G+F&akt%UH30fc+40={5poB1%dQYiV9j4lgy%i|n%`hI)hDB|7 zC(utbx4L}AXSs~S+i}6y$I1%{c(Q&N-pLYU_y%P~0gv2zfVPp9{&vdjz#9alOt;#{ zG&YdB1EBFWG1CJOdVJjQ6Zr4NQh~^(@uOJxIpM)n2!VW}zW};fv-v+>9hJlQ`88ZFCrbyq@`FI6FR4*`#m; z%R$XQo-@=s25wjJuXq{FK@Lx1jA{&Zpl86NvN?1#9W@Nx>>1}b=Gks6&7*&NQT0{C z)Dz>^#5-_wIG%Y=EecoJ+`rOd$i6q=B!FXm_f%=y8(7@OyB9&_Dnm{*4rxpcmj&p} z+O%@8!Wu7*M0{JTi8KYzmF8s3G_6Bys=(5R>rC~ zGc9~bJ4l*gQEG&oMM$#)T_Jtxi;GhZ9>yj=;TTc>VbQh0a@o)L}#^{kk1)tDsn)-NMt5Ed!#wMBa_j`76%p|}A#a>Mz zp4YOpFTRaNq%WoC53rU!x?a2~qHXCZd} z`c&tjMW3$^dCSw%;^lW2%Fys0Uxgvlef?UC-CWk}SUdG$!<_7MarP?JWGumSi4t&b z@5`LNfnGWg)~BQ^dNY~zrmr&>)w?VZ{oYK>-)6byVY z!J#n%hF?}HKhS-m++hO4A2y`=iLKMvX(8fB1ghd2Pt1Bu>FS)N_v+6;#XGu4_7eNa ztK-8a{|wPw$kSj5gcFWmHyzNDV}Vbup9tC9pL!TW3V~)MvzKE1NKnxn7SU9rF}JZO zQigmYpp(TlIET5qCqw&bB{xS%oXQHx$At&M-Awtrwdg%C)Y-+TB1d} z38Q~I`hgoIeiRQr`xo}A8J%cfhGCpC;-QSCtO&YqV@y7Kdp@*HU?Dr58Q_L2m9|O4 z5)+fu9BP!WV7_BmS|@cT;dl_iL-UG}6uUyN6=2}d90~VYc*IvJiw2j|v?PJBwCBPT z(4VmtKFTU_{X(W5Fo({y6AcB~e~vD6XZ!R{WSBk3?rW{=#5O~JB^=*632i)2-Newh zkRn@i()i9PfiV#yDVoHkV1sQYr&#Y;^kATm#Vz&|BO@It%*&foO)2+aw@1prhCW6F zNtf(KoRztDe9(#5-PUO8TbT81pC`}Zhi>mPzM50w7QTs8fJc2n&yiPac&v%aW@R(3 z*A$a_%Cz!>S0D?GLeNv~=Bk#F1-q|t`C$m9#=O<69NeJGHHfggs^7PTc4|aKNlbO< z)Ygl}sE))mBm)LPp5QUMu?xUE4Sq0{DDvNS9yTJHry5pDTftiGwB-l-+K31-&!$>5 z1OgVHoYU*WMXk|ZV0c*gJK@P#do?l<*S*NA_Y7v7LJJI()4DD!!M3B`28qNR2@2IT zj%E)Y$Pd>0A=L3U`Gxx=qfwB62r7;R^D&L7_G5RcT>>qpJhVzzeN+s@|Q%M!86n#UNwB zPr+MJIl=CTQEICRM^oGiz(?3~XD45bcQd(eOxd}Y-H3fttV#B|GoADM(#81z^KtI( zGK#ht!N}4V?Rz#I2=U7<3O~MA5oe1gLqW}Oi_mM|hm_m7bAn_A@5=-sK)aXPWk1r? zQ2gn8}onsd6=t|Qx0Z6&7$8SFfT)gY1G5n z@}sDe>g-?g8!@j{r0Z$Q=(U2=M?BS$W>`Djqsk@Xpw(FBf^tQ@mwS)5d;&08wnp6t zUv(Zeg+d?lj8}dup~Ol{Cg06U*=i!q8Y>lVAz&WpT-dqId0R#EQfbTc_evTa_4yYW zJWYCtuomqtVDiv;xE=%v`T>mRLJ?=E)$f6daZF(fP_vF&fh1)GzFkGhXX*;y9T;bz zqXb(Y;e}2Zn=#+UUiSIX2;OItqKzU2;}NGm83WuPa*QE18xHIxAjH ztGNKMMb!5;9v5$S<#xhkq4X%oJ!oP}@4x=pS?jvQIW+Kr}p1h+>cF9}PHiB$C8r?Wl5P{8%TR z2GK(}GpM@IzWcTcP(|J@D5E(Y67-A#kbI?Q(zdq6QOU;rf_|t8otZ030;8hHEQ+m| zfnC*Zblx>K+*DHj533M)7|5dBX+Q3&m#k_+>b}sj5~JK*6gR#2kw>IfD$KQvK!Wvi z1y7kF%eEU+(?OcaP!jnBJ=XDsEom!qlOx(g!cU6RXWo=VtD?+1&&`Dlzy3WJb^5|DeZBGlAG5i`QH8={{ zbS@)@mml`HX*q*eX}FH8jQLt8cA9WfaNDlw3gFE>k(uGymj_YjBGx~} z*Vs9M=lU1Tx&B!H)(?fYL&qlJ7UKP|N2^P~)Z_XSO6*e5MXd-tTlP$YO`g!H0CkSm zYrYI6leQ0ll5AEph_&Grq19uP9-&YDXN56~&FUR-?V?x9 zSbM9`FyDB?`TS|-vJtS4yU$MyLkrc=BU~0`%dubPao`R6bwSaZOTjRdVs;`5uw)JpWW zPtWqc)h@g0Z*Zw_Gp#ohVoVh6w~~dW#l|5uQu!Arxja-zC=f5=VvxLT=C&zCT(@wH zA}B_BiV{GmdX$~ugB5uk;fZj5f}K_Y4L`2{0`Beu4?pjB1v2BmgcT@|CqVW4X;$dl zGr;3<=*u%8z~J+V&gHL@-nlH^*+r2g8zKJ-Vp9sB?-JbS9day+{WBqUOM4`HVVd7H z9kx(xX1ND1f}zTkJnwLFIy7RxhB(Uk+{_AbW+*nIK4Y(imn*q+k>&1qlG-fI9fw43Pf3qo^s-7M&j<;sr;4}PdmW_>Z5`K zHCnJaW8=!Na%R0C)KH9eMZ$Hqe7Irvx|DJZkrFV++?X}_$R)wkCZ5Rf64Ejd5CXiJ z@Q|+1pWrB^(!R{c#mez^ufQ;_{rF~jR78ESrtsmRz1i58g87qcs)YDhS{q+iLy6x_ zg24zP(Hd`7AzB0!L6?;AhRligENp_#wSxU1KQlD`xf_s0J^3d#R;MC}jn4Y3vvLjC z`cBT1`q+pw(rkEwyAZ+6*7KoGa>jSpeOOK=_}UUB;Y_yJ-lyY1{NS<~xr8f>mmsg= zz{KqqY_g#i5TOw-@ctIiR=n}}afF-?sfPX%`T38y)bk^TL{r7|c#pW?%rx^}LrF*u zQ$Df)J13}?K{$6%*1^0G#KK8Is z{J(hFTf=r#*j!1%i9l%Xuo6p~RL!}LhLCOiw{}KX`eQN?;RetG005`MbJWPbgAD_2 zzzzhm<|3mO(eA5*iF+eq{Y^dn@MUjtz}IS#n!{=d*fro6ggzCQ{bj&3Oci;WyV>;>Qk^H*8c5hzZv$v2Rhq;iBuSjWEeva6f#090LPe1*q**n)e2-Pl)!iDT4VM}l# zxgdGR%l>eK!8B1UqLJ<_dOveD!E0e6lM;redMhyady5EC{)*S*h$S{W$lWY0`ED90 zXHLKQ*2mjvKC)TCyfs?U#|Dd-A7b?y(1#kE-`dq9#bM!~SjB)dsm)zVmURo`3>Zfr z#*nz<^d)v!h{IIuxA&OW8S7Ye7HAQ5w5MLwuHOXJ5gD5M_X|({WS-VufP@$?!cB~= z2H@o9R@+?p`Vu|Dv0xf1ux44OO*yKyk5qC@<3Q=clEZ8Nx^=Xq!B*ICmyn&I)~SxL zSef~$-54sE5!VMzjlHfbjKs<4A}yD=am-P4AU?pkkJeoVKxjtIet;6Bu4dKRAL+qG zt-?8*J5D;rsj@)a1kW{S{|Q zk<%lG$NnBd=9gt@G-&t<{5skW#LFFOM-^xsXsx5aQ1%OuSrcDBBKShh(4R65vT{Qz zYKd^X1WO0&!_Xs)xMbBT&t_$vQd&CzC!IFYi?%b% z_4JE~Y_V>Z&V)eL*_IJ&_QqnF;%)di5!|>LI#q%np;>)5Hug|LuN%*51?K00D!4KY zbAwGSomVpf;QcF?v0E$;*u`R1EUlpc>8sFcmQf#Ux2s3lOlhcHP!B}Y`oxFRF(LSB zb@SaP|LW^1um|E}K+v${_rBr4*jw9KOREn50kVyd%WUA%MCrkxXmNilHpBVB@w2!8 zl>%m|DfL#wU!T50y8{b5i$WE)T8KoGLrXywiUsoU#1$29|7x2bmkO9$vRmG7ICM-2 zWo+7+?#A|M!09P$3#v37>|B$DclrSE&1KmIrYo~|8QgU~iW`O)k%S8fb{*bf70#*} z)*xyFPJujo?21s5`4oJ!+&9_5pT*xj2v7E|p`Mu+=TLo3YpauS!`kDGV#SmRRGM^H zH=&aJ(DqmHVV+(iGnD2eK>t@^uts7iOUx-yY%7vgkdGRR@H$4oqDuC}Sq0chUQ2al zbee#y$n!ln_O&`$s_1F{O?9gKMf>hV40C&O&RvF}TaAlFsz|+6<@VfBz0{A2 z-|v&Zn-?eUyd%PQimNO2{)J1y?Q+)_0 zFWHsMTP2QhuKb5Al)QW~9$ri4NNnyb*eYKjZEDx;X1trlw@P}?ZJ+usKt`$W?=r;M zX=}6{jpkhVape4lyRl>Q>``?p`dEvAFVy|s(HSBXnjc~`F}6$q|1JSRKi)O+OBA#| zSrR^}0~m5?@QVRh=JxlM2KuOjYuX|_X?_kJq5Hu-L>Jo6VZ2bmzvv)y*A0Sl0KohQ zrf@b3KB5SN$h!3M?%*A9WE68!HKQ;gE<)v?$VGmC6fvj0vU_0x~SvzpVd^+fzh3$ z{Ydyd-9b7Oud#TYfuyozNr%Z6zU5oZ1L>AnScj;1!fqx;NeC*V z+4|ZL===TS*jbqSf#U7#-JUsDsXJ2!b;YirLaAv#?R|}=%7&T(>I{Ve2mOaW2%^(3 zuL^C49?`=afS-F%j)o4j{0Q8T<&Cgq7bP#LEt0LK?k0f_WUP@G_!_dE&9j_#)c+LR zl_@~fR)OcdG_*y;Ng<%NvHK#!fWX4LURtw5#W=!4reWr$MYgOO6!8efQ>hz|_54vZ zLniScoaC4`{84_wH0Vn7Xhyd@^@T~9KahccKL`raojIk(P&?*UT86V}Ebi`!J_wLZK@qLnO62>}}CwZCclP|K5>_HFiy8S&!=ALgjSLwIVP{(|U3b1k&mN8^` zwQ+vj5SywXWjlOcWn5e{IUs{7F=&Vnobq*b-p<5@wzZeNj8N5qnZ)$Z$UnYa=ZQDpvB@xiWh%*EG%0*R zu>ON}QJKnMkO;;7D|5lS_%&}6rZH2viWgxksIlvnbCivbn>OuYDXOHdlu~o{2RDT? zp)gGu&SzM4GEu0uhXy8=`q~wtK3*9d%FcH01`Z!Lw{uNDH#j*oY+>sVIi>_o8Fbi( z3za!E9`pcT!j=~-7JCN=lrdz#Z!f!bijIZ9I7`lA5z=dOq{)o)pM?JU{G-1hS2d81 zV8#x5Q;;UQs=J9CmZ$8?x$UiWd~#4D+6rAbXXqN)5aC|lDWXNj7Vo+M}P{vrc zOK}d9r8v1d(WYQT!avU809J6@!vjNTt53sc8^jbTdG!9G=uhrh)eok-lTW4%`E8epwLy67OO{=dtwy@= z5^rabY2HB2YpoPy85&{FDrwcQR(wD%5%E4|2;;<~h_|HDer5DD?PsT3*u~w^7)mxQ zfwkr?cY}i$;4mOB#Hr7QG%ddsFRgEs`FF`qUhiNUU$d+0C&<9t?A;{03GqNO{oz2veRu*!*7Ntak7sx?^^~$A$=Uf6k69g?yn2a{XYg~>_ogb1=sIE_RD=x_d(igxhHov_KZ>bOFknyfP`{y#MesymUqy^Vf4q zA@(shK@b*K^w&B43S9aEK@abx^Efmw>-fWE?n^tHVClRz^WJNtlhd4)*GGpdFtxy8 zP)Axv)KE8t9$C#0H^{?}5BfCS(C|AB+$cZJR^|pF*Q%yKkn(==Z}ZZhgnQjSu_j86 zYz)+yBQMD+ky10&932d=fpV}28i5cD{wkoR{4 z@6tA-*|ziaFjb=GO3Sd2N?xJg*K@FA-!re8C~%65o#je96-qpDGfbg_!ADaou%h~U z;A^y4O>LVP)FZEZl;@U(E*192Tl(~nG0C}Vh#-mjbb@g+rr~I`AVf4tZaS5isAuN@ zZa4{KyttC%(aadcnF@m3PuT8rOrTKQ1V?;903Z4B@@lmOsHJJeaHwJX(6I> zX@d*YU%DJe=qlsZD9wy!5WANGjWVj@r@X4(AQo^JkPJ2d#fzo-)>sQz<+q-Cux0ts z-_KG$w{SLbeU5vK0^RMBT#R4jvAOd1dX@&byJATn5H^5INQ8z*RW9r zKayq31JSoC^$dwxynp#cp#@9H*_r&|5-1y-F2?a8%%R3nSQZn=0#D1PA4Vw)(URea zm9D7Xw10cWNAjARBx#9(z_Mr{obg1{8T%wVLG+DVpthYlQP2ThZso^S5f<~bcKH-yRIzYcO|2)BLIu@cLf`5VSQR|`g|lz7iXo9?vGX|L~gTe0;*8g zj#KP2hE3RUDpM%7TrpAzf|~Z}&@bEJq=aX>t#gm(sU<=C>-cu>Qz&n!Z0JCXht^nv zW;`IEm*NtnTT0R38DIxjEZBJ1N4sRu?xk0&bvOsNPJ-IM$-GCaxI=TLa5F-!*n^3` zTj3Gk;UX(o&hKvU8&&>e8E zc;PDJd?fnEaZ&5>6Sqq23g4`q=!3EkEo&P-kCJX$LaC^SY~ERoMR#Wfo9tKJ?2)22 zbxxNkQ~hEv z43Ig^rkr>7|LN1n+l5K&0Wc7u&&TeGN60T#9WryX=MrzKk@i=ez&Mt4^8XRr*+<%7 zrq0k5=b-cVobPf0(en3HrDwz_-KN&Uk5I^ctULvs!#~;uK7}BC9(N(_a*G$#jAb~l zD5xAkW|v9o8vp83bv2zqkp3iCR!u{D{lFx%M9o#stT((JvBj7)a2Vt;TpRdM+g?U% zcD!OM@+hN7b4}@k<7p1P<&$Ys*D!Fxk991$p)5NNSo~b!^{JYEs1Bw|0)5^j%4_Qd z4R!{zRvX$()w#;|@hxU(Q?UOK-HYZY&!dN$h`dDFNIoL1rM6>Sd%)j0$kkD|8%S>R z*Fl<;1mv3(sy!g%eO=U04Wtvq(?c#;>@^5iW}N^`lU~kSGyJNHAxeS*$TA#xtUmv! z^ICnPBs4&p)?vuq{}qY+(^7Ws$1X!Z-W#uh-!cOVNP*sA{|dt_nN;*ex3y!e`KMFdC)}-VjqO>qc#}E3 zQH^o$xBV3Y$!VSrjw_ms)J1`cJr150+1hF z-MAT6*HX0uqljB=uA94CH|hxAwCwD-&Pw}xW*^i?Ew1e{1+J5r(o$QLTH{STT^-6W zQnAhG!fVzJJcOw?#(R&Gr(cSNEa-@ZX`Kzb767&pPt(RLZ*72-v5c=tkitiZc#Icu0fJ}7>RiiKZ}`aaY=PFm(Z%1z~9^$YqieH z{dC_Pm*K>vnPj;L#^dn>xj{vgc_!P3JiJ#p+L~XWIuglm?(p5PXcxLoW;5VjW@30P zbkS1?7U?)xvk*x(0COZ864i{kWrg#l5CrQcT+O0nr;v9YT*MzFb+i2yABGu_y-_Hl~W6 z)yTFN`R3+C9$l+owO8~rWj2PKpxAE9bkvig3S zJl|r6!=RQwAE$4foYzSWy5wb>%2$5gS<<{c76TGR&ov~0J@kR2G7#^p=a4tWtPm6@ zHIgS++sZq~{gEU&^e|`lu5zc|FAg(gx%MYWzZ;5~sc={!4Kau;=S6vMmZyFP{QYfE zc*^emCvf0>_hI_mbl&4_?Gp#sF9c{F;ChB3>^+DqrpCnx_*Yo@TfQ#Ym4zqZtwpu) zyZcs`n}TDs(kX=jE!PQ!5tE5ZgRm7o-R`OjKK&f5yho&(Nu|bg|KIKZ>a;+QW@y7A z4Qv`rBQw6Jg7APeNjD)Bnq%qPb61fJ&YuZ zSH1qL`l1H%f&G6Pr|`1jqv|=_g~K}r|y5x zDc5JB{#~wry~ODKpCMeI{jao=d;R8|uGjh>mjE1Cm@42u7}l>bshn$L`7c1q{THXFS`w}Q0`_0qD%%E=3f=90uv&2riuxD)zWo0} z{s-=%B}QkHO5_{oj~yXV=U6o#q#2$y8cvdO_fDo`#>^5sM|&M57iJRL$6U_dR!6<- z48CJI2SPp2_c>EEW0n4Op}`d#WL08yn>gzLyNDg4$KPRFTkQys^3+-m?7t|7)?#|C z;jBZAqBCM_$<&?V`;fYl1YjR=Ws7;KW~9DMlH&fIC2bCWffVl5+rBjthO%V(s@X%$=W zkHoAKjYjPtGZ+yNE0;qRV12-Cx+n{a-;jXPWu(IzdH&5Y-<%Gse`jQK+<4)zsHn*u zL1VC}@w$j-vWv*77)ZhJl%6uzYzRhO>AG?aZW05B6HCiC>4UB zVK92`z75W0k0A6?^ud82UpIG!9kWjgbnMYxv2ISmjAK$EM8K!UiutmucijF!Cu3_3 zR%$+lj2U)%zHPi*ig~e2#w=&T0Q-Tmic59|u6XPSfJ=ecZ6 zxS9`(1!`iGQGanaL>py-P41^0xltLbQS|z^{1jFxScYDvRof2OWz<=m7%Pp%36=== z9|?(Tq#A)xSt4@gTodfuR$to%fzkY7#KR||1cjDhtpZ;fn>kuZMX_Z_ zR*-WnMHE`9PKADoYQ`li+ecKvqR}3MQMd7zs-X_1odgnpp|rxzqL;!lO@S$nntJWY zxH-#iM9}k@Ro?cHse^@`OzNwif)>2vk^S5`4Y%iE1;5uGe_7vnb^ZSBJ+gV9WD-<` zh|ia1AR$ZS&u<{Xs0_Q8)rZpi9?tL^yiX8$dgUpn4@tQW3PIjvYEGODnZsVsGw8}C zgh|x-cblNd#1A*VR=9@-oc2oU9&!)4ZkS@)KTx^b%bkwoUj&0kv zZM$RJ>DV?qb~<*_F-B~SlR5X9d#$sceJ;-Z85eam>aOa0s=nXqoP1dV7^YXKHcd(1oVJ`)<0t*GY*~K>criYzinCr14GCWHHOcky1_1q76(H> z-49}%P`&DEO+vJE^1Tp|?Ry_MK$W(KHU`dJXOQA&xWMFR0B-P|B@qlT@DlQNZ_m9# z6Q#>a_VKh>%5xfvk3>vu(eN3O6>QG!mKgFv_H~4Osj)KqE4}9+IB&Af^ziuj7#A12 z1AKjbodEh@pDzAq2g23PP?WlU!n?fIYM6WtqN+Z?|3+gX>NSNYxZmK&8r#fKh`5d6 zf$y7Tb2?+u_%ZJz_s)Nw{is{YpclFv~@7DC`ucH=_*53({rJ zoG|_4AvCuK#I%#GiPz99qxZBxZ0nmK8znYtB58CkP10KZa``*l(*`=4oeInKu1e~A z@4wQ2vVfrl+P5D-nF@;uw^kO1Mdx3d7TdPCQs`p{Sp}!~fevBdqTY>Hy zcilw~j*1-3B_@6^#q1Tl!|j)+*&H7`W$oq{D)?SG`%w3_GsuxU#(kzHG~Kzje-^dN z6K_HDJRn*fS*I}ex&TzQ7&6xZdjO@)u%v03Q$%SpgIT0rLJkrrKG*v2!6)F61_?=z zpqy$O#*I=<{I8H;7x%6<4ftm+ogzL>D(@U1+kQ06IK0*mz;UR8jFG-dpCWBD>_)aXhBRggsH%Ni99`hPEVZ zNZ5&J6h~ImNsR6F92aC@;_rkYOeu?nLWQ@{YMuTB#e9R|{R$6ZnI<`JzR8cU)VS?g zuF@r&bhwe!s$}^)xdv>KKjqj;l}yq#*|6e z|NXC^MxHkyb0jqW;@n8c&KvuIRL)|M7T#%HyMYJ`&U}`bTxrWwmH%-&w2FPpvl>m= zo2jBb&S;WDy*IHh}S*BQ~Qnw+CVd(YkQOPvBQ9gW<0 zxh|CM+Nt;vn;B;};5}|#Z(CbHn!kmZXbPA9CS2`~o`)W8@}0y$Gc#i-eg{Ss8u3nZ zrz6H}#hm&`29~u4i$1GCzr%7md9w6)Xit_=j=)NGbB7)6YNmxIQSEc1%+v;%_uCdB zY-7~0Gp@Et`ko{_IRjPq{-MIXuVPS@d_@>uIa8R~j6}pj-TakQSw4jxq7u3Qewnc)R6q}FUOz5YUHqCJ%X%5uCxqv7{Rb*$5J(=8bgY)dgDDvEX$_VfJ|-r zpB)>d@HhUn8Z1LlJ9nz-rs8he>C%k43fGkKxEda>PsFdIah+NpN)QOXbPE~~${012 zHa0BStYCI-Nuj-snI|?qu!;iRZmsQd!rijWAGAvKI`bdm)`hbDsc=sC)Ql0wbSwPbz7n%L!lOn)J!3u=rO(&&}mo-CdXbc-h15EU0lxxS}y@_qD%Hf#N6{r-gNDO z{+=El8p}X}E-t_OhIydhk0Yx4Ud-s{=rABzmk-y_<tlIwiHFCT)dpxnH z)nkszo7>dB^!#0w#ye`SH=#tGHX-3=Rc*$aOdh^b6{$Fszu-rTH10S^m7z!G^L6dm zROhWbMS6wQzNFB|=w-3W{x{FxoKP+H5`IP>ZzL7*#Moh9Wr8&|dRz7l#6+_hZlVMNLbYScE#oCzwYEEylCmC?%t)Z~3>5C?d&#A3 zV;r~N4S>0wlyYID>ZzqZYon-i95wO)ZuCiqLge{XL3GZ5??yvFbKpUg+{a%_*@QoV zF<&EyhUjEz3dl_UQ2z%VM{mLz5vwDXnL52Jy~$>-97>Rb%w|GO`qKK zW^9`9Y!CPlhondQ>W|mMdHVF(*1Dh}$m6v#lD|wWwe(-!A2kM7xRyS~F zx*|MsUBH{$5>Ict&iG%T!L_{=ZhoN66yNcn3BW-(J<)C#q* zd@@X0lOl=e`(wsVG->!q4a4W{?ci|i&$%VXg5C05TQwvXnEg4uYkM$2=qx)T8G%}j z2r}o_Lsv$nswZ}!X@^&YMrTGcIUdmoGP!|s6R;i$dx$f$H0k!ZL126*=n#&@OyX3< zrw4VF6H9*x9p4Vft>9!;9wo7UN~hSMrIlrjEm7ePRW%--@_Sdc0DP&7a9J(P&iU=& zUToT_jDU`~jMl)UblLsugz83tB^>g@bgz$uOs-b8Up) zGEWQ)R5&%Dv9sJHR$@-&TQ}HGuly^xKA7)x6bf06!pn@`;}#~8Iv>m7D$)BK2))t1 zcKkH`&ZO?XeEX$GClsLVQI>WcXKRX;7noBdlSshd>U_m$C!D+_5twgd>-Y+I*(qc3 z2QR?+u6_VOU)fjt*`uMQv#qYSs}L~=3Zq=}K);$@PT&bOHh)F}+0l~6-GNIvwv0s} zHYIRqM%|wN;hvvnYa*&}YsaEsFuekIER}dtPC#m2y+A@@3)&PrRqtbRpI;jgtfmpV@c}do1<32VwiUIxi|+t zV}(Yw2yQG(w8%C-jWXx^t)bh|I~ozX=5$ z&w{s{0zX^9;*j;}kNh{cFW-PYqqoT~y{4bboL3);6JHMBtSRjvD}%IE|5_&|VCQ#N zYE#H!Ym}0vMlwMpx36I-!}(okuY<3lv=#j*UUMKh0@z*w1hL4`a^wSQbVWF^16}C1 zs0GE*I|lRSpb$;c#Lr1?%|me+-5<@wL~~fE*Y_I|r5Z7LKO)Sy{qwBuWGhG&U0emZ`!z@u4JnP!K!A0kEXeAVnM31Y;YhTPJQWbu0M}I? z4<3lq7E=+F9Yv)U7pMXgPi{J$TEJL@=u5xsd6^_r59@Ehw1nRY(3Nst$JJ6C`L3tN zjpTN!!j7R>CebX6xU8TCVM@{(R@g!OJv7Q{NVgvpvo0aBP%VyTF5nZz`i;b#)v7h* zwc)<3*@GPJ!m366`2!*RQtWEz8DSI`J61W`E9<);H|#0;L$#5Bwg6mBv(>z=K)r#~ z7hM`4vomN11=XO*I~b;V&rTb&5`R?WV|8+z7ReqBLSf9#_#^yXA z2KBdY^_vo{-g4ArL@C>JS6ckO>xZ85h+IMipRaUkMft4dt4iuj_N2{CZzZxyQv*xT z1-90*@1C+bkfg0`GXI<3h$-BBhQGz_Srn^RiC3^f3$DKTJ_PV$m6MFyW%svq=@mPv z8MIQaV8S4tVoj7PNj6viz7~VD`_+ChQL0Cinh_KET3Zd>rMmhUG}#>7E(c~kj3?o$ zwXZQGG-$yOyH7@whZuQluPV~kP1)P0w31~XMw0^|R!;pw-Mb>)QX=GOJVgogaiokM zXg?b_$3aLRt-(i{H3Jujx3<%?&?Ke3lbmGDnEQSUd;J8#NUgnY-Ce=Yp=TSNgx@}m z|8J@l5ChoEj+u>p`S4jVsQqOgoMR(v5I$pOd46ikQ6|?TD8=nVkgzh%k4wC>lxBf`)rU7|+w;E<9=;?&0m%`8%C!LDqHe&R(q&&!b2B-JKBrj|47?0=)yFoKCr z=~pkc1QMY|-81O{Bp<_Nt!IAGq2v?ZT2*lSF!o?BzAkFJ&PK3R=f7ENIeAcVEn^E- zh)|ltUZQjf-`%DiGsjBbUGmqd%jptYg?7G5YpTlTgI0T5tcI;XRc2Iln*2LY4Yuie zvi$)%hUpl~ROFuvfr|Wwx=I`Z#u~M}b+zv+Oo6gNcGfeZh3{HcFPP6urZiy*@&gBb zG-vLHlzNuEVOu07)Q=+8N5-k6uSf4MJ~Rem9v!5LeDBWO2tHG`M_)`X$Wp;u(CJPc zjhRpCC9#T&6kkia(fv;NuKmjqOfl!6mV>xJmi_4Zd-KKyZR2RZ>k8b;@3%a5;w;Yi z0G^IodF8v7@pO&|kM1GT*$56p`AC9^?bUVYgzL;&7M`@$1$<)|uEqaH&$6pKnC}=c z!nCEa;O_@>h>|6zWgdn3e$5B!b@F!K=U<@Fza|M!1vQ;BvYJ)5QUBkf}$(W)csAdc%~WemRZSmlo|S5 zjKF2)?$&e*XH)UqWT~wB!9Xq^x>U((z^RsU-b+C|)Laxag3X~!JN{hr8fLAwVe?&; z%#S-noKoDI&X^FR;$7&Odhy1#dubX(X*!!64?&*|JAysdIIGkCtg;rQQLo}r<*dgYFl!haNJS6MiFUR~^3$uWZ+8`LqGk(j z@@zu!SF^0yFa%h~RXH|P*MEps_v!ydv}Tyr$;6~J@O0KoO-D4MbDrAyjDMZP`v6}` z7be-adp8qoKX6*?H>azM z2^MpLC6S`&2H0L?R~)cm41b-#;-EYTkT?rHkShsg;Ir={Q<&JxV7B|X-@ZWPG^8_H z%_%gM`)uju=G$ask$@wp>V=CEEuOv9yfvC;5{4+@p}##Q!@ zX=(MTN$_C8*u!tf)E2^n*Ay5Zg6=fAqnH0iM+N{JbU&VdmW4L!t%gWIvIO$cN-7Nf zkEG>n?b|`m@#mVOfZ3Y+k7CE_rn}>VTT{6*ghKkTr#h89S;T}K=9lx)(7b_&*faOt z=BXPbubf}1tTh=PGIJ1rawHS(z+JUu6g$2oCoEEH8;qrbCC)TX#6TItIXWeT1z09^r%I-+Dp`n) z-_ZiN{lr+C24<7{W__se;a|8VSNDlqk}JWAO;9pisqLEniaaqc6hG_DZAo0(23xGV zwDTn^g*DwNT-=4$*ZeZvgW}EZ;LG1S{z0v&VvTD{{^q>mjdO<5?2E(+Ey$np?!~oV zew^OlF^EC3h6U{FG#_{6yq2$TETfP*LlWuo$-%x~O4h%z~btbeevuuY*KOlAm%sw^r*XG`@?YZhmwcbK%oxbXU)D1<${bC`H6EjQO!ykeM?%Fq0x@4Ef9A-v8-%+=0uJ_J zloIMOetsx{RxuTiVGY+mFr73a^Mzn;P}Z&;mmWs80SD7_T%{P_#2v}y6sAELGLS-4 zz(d65Z?2kRYxKNde=eyY7Mv`jlyU;>3lePZ`kN34xpFU)3ATYLW7{Zzh9_L~SYhl< zNUq@We*#plyUHe~FO-v^e?t&o?h!I9hs@kQy9@e8Vt*bT*H0W(9qBm=6#AoL=W}yn zG8|>sb(#*~=J2L4@L|i;f5!4g+y(uAi_BV0-tPL*gR2;(Gv4`U3tuDNd3Ay04XufRqh;@$dm(30Fh4e>XwuI@yL$0I zh<1c zOAW|m#956=GZjTieql^Mv%LVr6z*|mmy(BV;?3KpUfQ`|Q9dBVA97>ptf$Tk-rp}J zCmTfQmB@uc;P^(9qd^<O2$vzey55kWy%uv?yV<*YK!aWs9cR$D?GDGo2NL&(M(+GGvXN%_i;vJUHTS3AU`KP0%~nB@gkt#^S}pI z%!SPqC-A2uPw>q;WwnwEv>gtT=*BQE&gDjM`+Z`3M>r_gL!gY1*}FE&L=m+=PtY+m z-rDrPRO;=q`5%?K3?ck?m8zNlFO{nNd?&nGd$&YRBe4-J2EC&Ocdf@I``iI`P=ng9 zjZLV#y&`$5z8q~b9Tfn*fF2}9nQ4ni?6T}&5hJ$BV14R258WxIFsVm720Wkg=y9Z^ zYUFCzs--s3x^J}&qo~o!8<=t`%tN$*l1bP9>(p#c{EMch7-Z!Cp{Xb1ziBEt$U!qkPN8~0Er}65 zIY7-1B9l;kvhUw%3X%MirkdCOlco@p{zX%qgdc6Ui)r2q_}q9RDzhdtb*#as%-#u+ z_qhTL(o@j{V$=lm7MVPD(eIzXy&{q);K#?u4N$*}$K!dif3AObq6k|&{B=Yh@L6q* zhwm%;kmprjK(QQFQTxE}S#>bOXm2TQnZ}(b_Jp}+q;zjs{seZqWloQP?Lj+`+m+M0(fpF^6Fp2v z{yM8Z23waQkR09@#a!IoMJUN+K8`X({2lX+P;`5Z+ZTjQ`%tHiQAV=_^MXhvrqo3c zqp>JnN9E;~&(yveVqi!lSHOwbx1p8eV0h1gbe7Cl-3l~;?mOj{^cd? zsX(}Y0p{^WSl2EP@(VWl3}^6ae#K8gB>LS-rNrqGDvplCEit4qO+)$7#`LdP$YY`3 z%vnvxa2C%S?Li`tz~NV>TE5}UZ{=&=50)ABj)Pldvc~Z>*a&vC^Usvn_dj^${fOuKz2@tbDsnK*I@kh27^-`59*!eJr0z_Ff zfQXxSEf?IdN}hu3g{D!j)0V+!x%Y#HEYTX;_!ltI`fZt~WQqD)w#+=`3Pk1EVRnPa zmG1#LMOMjii5o4rT;w-+D9ee%TzeUo6Bad2iNH4s9KHIGRc@&Bs=q6C4fnT!TjgKb z$8`D3z`JL|in#|Z;qZr^#E>n_GGscRf^MtU#RZC9N^Ta%-3K>)mWQP#=ONjJ*WAdG zLZVK*EkJrJPZ@eflKHx@KVzdpBe2{=sR?)7CnfbRwq(sXkcT3f%mv@R-ob{_fGm{N zbw>uLoU+Ci&mJ?-qL*BKfVHmr6~`t2F&z+qhxuShI18NRBnUthJ;rPMVmI1!%JRfE zhLNU_ztG_8m>Yl|>(C;$&(tMOteOfskX7&-Ja5HL@YV2@+-90Y+1105mxT?2?xF4u z3%ci*tXurpQ^+~-nL_sk-E)2(uMisj4fLZQd9$Ot&lGewgo!QT)^BbxmzuYe zVAm(hV5JmtSec)Nx?eddX3?FfYIWDgWv#zMS(VD@@jK`SKWkT9Xt^V_VGNDamB)IG zU{QdQu9_U5ChPOpQF7o;w$Ooh1j;nDl6Ds$mKGwdE#yFM}&02CIm(S_S-D#3Td5jZuXtAQ+hZE_{Mb@bQpyiy6H2D6G zt3!!|kxCBKac_WJkeBZ5%=>Y*mdfzcTk}r3zbBvR&y~MNM7uBZ7eT|iF}Ej|!;Pd{X@G4O)w!Y^ z2T8mnN?7GUU?gUqVln^2;ro~eC*h;rX5=P<-4+>_uX7DTM{Ed9_2c~bQy@WW17-Y0 z04yu5EM`JIu1~tmHmJ~6Gh!Bz`Fh8F?QrK%r~AI4R24&^bj{DoT+(pn|m9Ek_gItY&TMFCTdIf_XfAzs5gV?ju9Si)x1ng zr3@};&aP-GePB=~hJa9$OO|TID}zKyDuJf@hUiL}IO$s^b?mvwlQhtKc1BipA1F~D z8H!xYd8e~{b?68WK$L5WPLMx`N#lat9J(VwT)~?EGNtiQ?<8?l1o}=o<)~aI>_=Eg zUw|=S0E#3ja*3)Oygww`7|toeyImRer25%KMeCFruyQNqiTKJWsqfV$y4HJI668*T z^#^9Z+pm^{y;iSCJvQDS5ZC8R4Ll`W$ku=N1F>EkJCJChb`*{|vT}JxGlQ!x>0^x% zUEG{#4l~3Ws=(JPS3l3V9*=Eg8_`ZUE2M=aWI#2y1T*&qt+?*U*2&32P+x5DAoI$V z%Hz+tWi25)ctY@@22D)ADo`7D~04GXpbdR za>4VoXwQg$Dsd=4RHS_qD|?wvDl{wrx`h&yhEGPGg6GuOOKIIuH-gbBi!hQqGT-oS`exihtM(r&)Qi+c#ol# z1&Y=$%6Y8Cwmq*Hr`F13v2s`ro@_GP{lv@j5t z;78RurukjO&0e8WPW43fJI9c?*dot4*po#6a}@y7dWVm3v4xM|!=NFM;^@L-XM7E1kHI7alwEU5+R+ zcI1uu%g9}0Pm~`7W%Z3nW}uyh#3xiDUqdy-lxMc}CD>_`y>Q2KfgeV0N3Thi4*OUe z`jal6HkDFJ`%_Dth7OT|IW76DnL0BYj~5H@emVE0HQsmtF&o|_dVE;|Ga`zg2}TEk z_8VK2ZH^;}S+VG191!AT!;r2^g~m-i>yG5AV_`qRY$XRQDYfcuN|UrX+8i&-dDt|t0`iGl~#BM2<#o<*AW$6kAtW1Ak|IAZt5RuzMhm|`IG zP#N^K!5O*Bgtuj{=awy>8&4n8GGL$m^D1w$=FStSBiRpYCuQ?T=eKWxq=ikvFpo9uq z(U_3%o-||~Vp(#0NayB>!9ODzi6NDI9F$1((q~Kr%Ljx1LsYYbvtB~`2(6bjB;9-t zEpHsCh8k;(R-j@cs!FYh(EVu^nIyiye+7W6@+9mFmJL?iw@;!#Nq7aAM=Dxa;I9$n zQ}Qo;L8b{;`KD1ptatVBy9uAq-_0fb{PatDttd_xIPp4t7#ZG)Bu|u0ji@H`_-j&s zE9{y1^P`-OYip(O%$pt%H%{N4E&FU$(VoXmJh+{M2QJD!W4WIx_R!^?b^PP4h2wR3 z8|;J*%l~J{USf@H>H|-&3I3Fik-EH*eO{)2OVxm6{5DB*3`=|P0j`?o$`rdMnfKn;te%J zWg3=d>ubHHfoWI-+yO`TePTCl{4M)l=j9D*N-GWaa@Gx1nAyDG>iM-K!c)(6Tr^s? zaNKBCCs4`4bhE;??+Q7pwqg<~OZRWNrmO3}#q^`9c{55FZwhAZ1-^Uv(3;)mxln!l zNNE7(r8R$~F*rQ&6!$vtI)0p$-d-|L-}myrxm>?XzhCM*@+tzeoCn6naBda~7(*Hx zw5N#^kCvimg%rbIUqluI=yqhJ67eUQ@)p^=JiP^d@nm8cO;M>9Z@`2&W!ae`AQPK8Wz!o;VHNA0u!0+-(zLtL zI1zrJbc7E^*34mD#**}S$@e@UV1x~wRXCHdXT}m4LoUFR1QqzWOs0ycUw;){{SBp! z9kPle!aE^%FZ`iVRwmiORtYVJsFkhwghTt23j16Lidu%{oZiRuC zzO7WChQxr@rt@bdR65wI$^gr1L=#hSz}+aFoSN*R_G zUhrg&F3HjJkj$E>H;y+i@ao?JhQDYw5@A&qk<5-HCGjiCHRsPDK?)G{eRNKTHed=p zt*zi_p$v|t0>+foLBE8l)7b=tpSN{e>cr4mhAl6glL>IlW2^Cx)_!j4=V) zr1rO56KEINi!%CViCxONHXg^j`2))oCQH6UiXZM*Jh)VgA|Uw8KEuyhHPg;>JN|&2 z9-Zx%hGBnd`sZb_pxg*xcJK3tEZN8H{Bs;O!*yQop9-mVom5o_v0yxJRD6cziF>DR X9pLO)FX-pD%z*2Bq0J!F;2{4CN~3UW literal 0 HcmV?d00001 diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/Chart.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/Chart.yaml new file mode 100755 index 0000000..711fb5b --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +appVersion: v3.19.1 +description: Install Canal Network Plugin. +home: https://www.projectcalico.org/ +keywords: +- canal +maintainers: +- email: charts@rancher.com + name: Rancher Labs +name: rke2-canal +sources: +- https://github.com/rancher/rke2-charts +version: v3.19.1-build2021061110 diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/NOTES.txt b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/NOTES.txt new file mode 100755 index 0000000..12a30ff --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/NOTES.txt @@ -0,0 +1,3 @@ +Canal network plugin has been installed. + +NOTE: It may take few minutes until Canal image install CNI files and node become in ready state. diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/_helpers.tpl b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/_helpers.tpl new file mode 100755 index 0000000..b647c75 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/_helpers.tpl @@ -0,0 +1,7 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/config.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/config.yaml new file mode 100755 index 0000000..1a005ca --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/config.yaml @@ -0,0 +1,71 @@ +--- +# Source: calico/templates/calico-config.yaml +# This ConfigMap is used to configure a self-hosted Canal installation. +kind: ConfigMap +apiVersion: v1 +metadata: + name: {{ .Release.Name }}-config + namespace: kube-system +data: + # Typha is disabled. + typha_service_name: {{ .Values.calico.typhaServiceName | quote }} + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + canal_iface: {{ .Values.flannel.iface | quote }} + + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: {{ .Values.calico.masquerade | quote }} + + # Configure the MTU to use + veth_mtu: {{ .Values.calico.vethuMTU | quote }} + + # The CNI network configuration to install on each node. The special + # values in this config will be automatically populated. + cni_network_config: |- + { + "name": "k8s-pod-network", + "cniVersion": "0.3.1", + "plugins": [ + { + "type": "calico", + "log_level": "info", + "datastore_type": "kubernetes", + "nodename": "__KUBERNETES_NODE_NAME__", + "mtu": __CNI_MTU__, + "ipam": { + "type": "host-local", + "subnet": "usePodCidr" + }, + "policy": { + "type": "k8s" + }, + "kubernetes": { + "kubeconfig": "__KUBECONFIG_FILEPATH__" + } + }, + { + "type": "portmap", + "snat": true, + "capabilities": {"portMappings": true} + }, + { + "type": "bandwidth", + "capabilities": {"bandwidth": true} + } + ] + } + + # Flannel network configuration. Mounted into the flannel container. + net-conf.json: | + { + "Network": {{ coalesce .Values.global.clusterCIDRv4 .Values.podCidr | quote }}, +{{- if coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 }} + "IPv6Network": {{ coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 | quote }}, + "EnableIPv6": true, +{{- end }} + "Backend": { + "Type": {{ .Values.flannel.backend | quote }} + } + } diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/bgpconfigurations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/bgpconfigurations.crd.yaml new file mode 100755 index 0000000..589c3a2 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/bgpconfigurations.crd.yaml @@ -0,0 +1,144 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_bgpconfigurations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgpconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPConfiguration + listKind: BGPConfigurationList + plural: bgpconfigurations + singular: bgpconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: BGPConfiguration contains the configuration for any BGP routing. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPConfigurationSpec contains the values of the BGP configuration. + properties: + asNumber: + description: 'ASNumber is the default AS number used by a node. [Default: + 64512]' + format: int32 + type: integer + communities: + description: Communities is a list of BGP community values and their + arbitrary names for tagging routes. + items: + description: Community contains standard or large community value + and its name. + properties: + name: + description: Name given to community value. + type: string + value: + description: Value must be of format `aa:nn` or `aa:nn:mm`. + For standard community use `aa:nn` format, where `aa` and + `nn` are 16 bit number. For large community use `aa:nn:mm` + format, where `aa`, `nn` and `mm` are 32 bit number. Where, + `aa` is an AS Number, `nn` and `mm` are per-AS identifier. + pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$ + type: string + type: object + type: array + listenPort: + description: ListenPort is the port where BGP protocol should listen. + Defaults to 179 + maximum: 65535 + minimum: 1 + type: integer + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: INFO]' + type: string + nodeToNodeMeshEnabled: + description: 'NodeToNodeMeshEnabled sets whether full node to node + BGP mesh is enabled. [Default: true]' + type: boolean + prefixAdvertisements: + description: PrefixAdvertisements contains per-prefix advertisement + configuration. + items: + description: PrefixAdvertisement configures advertisement properties + for the specified CIDR. + properties: + cidr: + description: CIDR for which properties should be advertised. + type: string + communities: + description: Communities can be list of either community names + already defined in `Specs.Communities` or community value + of format `aa:nn` or `aa:nn:mm`. For standard community use + `aa:nn` format, where `aa` and `nn` are 16 bit number. For + large community use `aa:nn:mm` format, where `aa`, `nn` and + `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and + `mm` are per-AS identifier. + items: + type: string + type: array + type: object + type: array + serviceClusterIPs: + description: ServiceClusterIPs are the CIDR blocks from which service + cluster IPs are allocated. If specified, Calico will advertise these + blocks, as well as any cluster IPs within them. + items: + description: ServiceClusterIPBlock represents a single allowed ClusterIP + CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceExternalIPs: + description: ServiceExternalIPs are the CIDR blocks for Kubernetes + Service External IPs. Kubernetes Service ExternalIPs will only be + advertised if they are within one of these blocks. + items: + description: ServiceExternalIPBlock represents a single allowed + External IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceLoadBalancerIPs: + description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes + Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress + IPs will only be advertised if they are within one of these blocks. + items: + description: ServiceLoadBalancerIPBlock represents a single allowed + LoadBalancer IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/bgppeers.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/bgppeers.crd.yaml new file mode 100755 index 0000000..bdbd2ee --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/bgppeers.crd.yaml @@ -0,0 +1,115 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_bgppeers.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgppeers.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPPeer + listKind: BGPPeerList + plural: bgppeers + singular: bgppeer + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPPeerSpec contains the specification for a BGPPeer resource. + properties: + asNumber: + description: The AS Number of the peer. + format: int32 + type: integer + keepOriginalNextHop: + description: Option to keep the original nexthop field when routes + are sent to a BGP Peer. Setting "true" configures the selected BGP + Peers node to use the "next hop keep;" instead of "next hop self;"(default) + in the specific branch of the Node on "bird.cfg". + type: boolean + maxRestartTime: + description: Time to allow for software restart. When specified, this + is configured as the graceful restart timeout. When not specified, + the BIRD default of 120s is used. + type: string + node: + description: The node name identifying the Calico node instance that + is targeted by this peer. If this is not set, and no nodeSelector + is specified, then this BGP peer selects all nodes in the cluster. + type: string + nodeSelector: + description: Selector for the nodes that should have this peering. When + this is set, the Node field must be empty. + type: string + password: + description: Optional BGP password for the peerings generated by this + BGPPeer resource. + properties: + secretKeyRef: + description: Selects a key of a secret in the node pod's namespace. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + type: object + peerIP: + description: The IP address of the peer followed by an optional port + number to peer with. If port number is given, format should be `[]:port` + or `:` for IPv4. If optional port number is not set, + and this peer IP and ASNumber belongs to a calico/node with ListenPort + set in BGPConfiguration, then we use that port to peer. + type: string + peerSelector: + description: Selector for the remote nodes to peer with. When this + is set, the PeerIP and ASNumber fields must be empty. For each + peering between the local node and selected remote nodes, we configure + an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, + and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The + remote AS number comes from the remote node's NodeBGPSpec.ASNumber, + or the global default if that is not set. + type: string + sourceAddress: + description: Specifies whether and how to configure a source address + for the peerings generated by this BGPPeer resource. Default value + "UseNodeIP" means to configure the node IP as the source address. "None" + means not to configure a source address. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/blockaffinities.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/blockaffinities.crd.yaml new file mode 100755 index 0000000..dbaaebc --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/blockaffinities.crd.yaml @@ -0,0 +1,62 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_blockaffinities.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BlockAffinity + listKind: BlockAffinityList + plural: blockaffinities + singular: blockaffinity + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BlockAffinitySpec contains the specification for a BlockAffinity + resource. + properties: + cidr: + type: string + deleted: + description: Deleted indicates that this block affinity is being deleted. + This field is a string for compatibility with older releases that + mistakenly treat this field as a string. + type: string + node: + type: string + state: + type: string + required: + - cidr + - deleted + - node + - state + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/clusterinformations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/clusterinformations.crd.yaml new file mode 100755 index 0000000..2f25897 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/clusterinformations.crd.yaml @@ -0,0 +1,65 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_clusterinformations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: ClusterInformation + listKind: ClusterInformationList + plural: clusterinformations + singular: clusterinformation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ClusterInformation contains the cluster specific information. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterInformationSpec contains the values of describing + the cluster. + properties: + calicoVersion: + description: CalicoVersion is the version of Calico that the cluster + is running + type: string + clusterGUID: + description: ClusterGUID is the GUID of the cluster + type: string + clusterType: + description: ClusterType describes the type of the cluster + type: string + datastoreReady: + description: DatastoreReady is used during significant datastore migrations + to signal to components such as Felix that it should wait before + accessing the datastore. + type: boolean + variant: + description: Variant declares which variant of Calico should be active. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/felixconfigurations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/felixconfigurations.crd.yaml new file mode 100755 index 0000000..a1c3d6d --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/felixconfigurations.crd.yaml @@ -0,0 +1,565 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_felixconfigurations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: FelixConfiguration + listKind: FelixConfigurationList + plural: felixconfigurations + singular: felixconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Felix Configuration contains the configuration for Felix. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FelixConfigurationSpec contains the values of the Felix configuration. + properties: + allowIPIPPacketsFromWorkloads: + description: 'AllowIPIPPacketsFromWorkloads controls whether Felix + will add a rule to drop IPIP encapsulated traffic from workloads + [Default: false]' + type: boolean + allowVXLANPacketsFromWorkloads: + description: 'AllowVXLANPacketsFromWorkloads controls whether Felix + will add a rule to drop VXLAN encapsulated traffic from workloads + [Default: false]' + type: boolean + awsSrcDstCheck: + description: 'Set source-destination-check on AWS EC2 instances. Accepted + value must be one of "DoNothing", "Enabled" or "Disabled". [Default: + DoNothing]' + enum: + - DoNothing + - Enable + - Disable + type: string + bpfConnectTimeLoadBalancingEnabled: + description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, + controls whether Felix installs the connection-time load balancer. The + connect-time load balancer is required for the host to be able to + reach Kubernetes services and it improves the performance of pod-to-service + connections. The only reason to disable it is for debugging purposes. [Default: + true]' + type: boolean + bpfDataIfacePattern: + description: BPFDataIfacePattern is a regular expression that controls + which interfaces Felix should attach BPF programs to in order to + catch traffic to/from the network. This needs to match the interfaces + that Calico workload traffic flows over as well as any interfaces + that handle incoming traffic to nodeports and services from outside + the cluster. It should not match the workload interfaces (usually + named cali...). + type: string + bpfDisableUnprivileged: + description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled + sysctl to disable unprivileged use of BPF. This ensures that unprivileged + users cannot access Calico''s BPF maps and cannot insert their own + BPF programs to interfere with Calico''s. [Default: true]' + type: boolean + bpfEnabled: + description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. + [Default: false]' + type: boolean + bpfExternalServiceMode: + description: 'BPFExternalServiceMode in BPF mode, controls how connections + from outside the cluster to services (node ports and cluster IPs) + are forwarded to remote workloads. If set to "Tunnel" then both + request and response traffic is tunneled to the remote node. If + set to "DSR", the request traffic is tunneled but the response traffic + is sent directly from the remote node. In "DSR" mode, the remote + node appears to use the IP of the ingress node; this requires a + permissive L2 network. [Default: Tunnel]' + type: string + bpfExtToServiceConnmark: + description: 'BPFExtToServiceConnmark in BPF mode, controls a + 32bit mark that is set on connections from an external client to + a local service. This mark allows us to control how packets of + that connection are routed within the host and how is routing + intepreted by RPF check. [Default: 0]' + type: integer + + bpfKubeProxyEndpointSlicesEnabled: + description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls + whether Felix's embedded kube-proxy accepts EndpointSlices or not. + type: boolean + bpfKubeProxyIptablesCleanupEnabled: + description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF + mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s + iptables chains. Should only be enabled if kube-proxy is not running. [Default: + true]' + type: boolean + bpfKubeProxyMinSyncPeriod: + description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the + minimum time between updates to the dataplane for Felix''s embedded + kube-proxy. Lower values give reduced set-up latency. Higher values + reduce Felix CPU usage by batching up more work. [Default: 1s]' + type: string + bpfLogLevel: + description: 'BPFLogLevel controls the log level of the BPF programs + when in BPF dataplane mode. One of "Off", "Info", or "Debug". The + logs are emitted to the BPF trace pipe, accessible with the command + `tc exec bpf debug`. [Default: Off].' + type: string + chainInsertMode: + description: 'ChainInsertMode controls whether Felix hooks the kernel''s + top-level iptables chains by inserting a rule at the top of the + chain or by appending a rule at the bottom. insert is the safe default + since it prevents Calico''s rules from being bypassed. If you switch + to append mode, be sure that the other rules in the chains signal + acceptance by falling through to the Calico rules, otherwise the + Calico policy will be bypassed. [Default: insert]' + type: string + dataplaneDriver: + type: string + debugDisableLogDropping: + type: boolean + debugMemoryProfilePath: + type: string + debugSimulateCalcGraphHangAfter: + type: string + debugSimulateDataplaneHangAfter: + type: string + defaultEndpointToHostAction: + description: 'DefaultEndpointToHostAction controls what happens to + traffic that goes from a workload endpoint to the host itself (after + the traffic hits the endpoint egress policy). By default Calico + blocks traffic from workload endpoints to the host itself with an + iptables "DROP" action. If you want to allow some or all traffic + from endpoint to host, set this parameter to RETURN or ACCEPT. Use + RETURN if you have your own rules in the iptables "INPUT" chain; + Calico will insert its rules at the top of that chain, then "RETURN" + packets to the "INPUT" chain once it has completed processing workload + endpoint egress policy. Use ACCEPT to unconditionally accept packets + from workloads after processing workload endpoint egress policy. + [Default: Drop]' + type: string + deviceRouteProtocol: + description: This defines the route protocol added to programmed device + routes, by default this will be RTPROT_BOOT when left blank. + type: integer + deviceRouteSourceAddress: + description: This is the source address to use on programmed device + routes. By default the source address is left blank, leaving the + kernel to choose the source address used. + type: string + disableConntrackInvalidCheck: + type: boolean + endpointReportingDelay: + type: string + endpointReportingEnabled: + type: boolean + externalNodesList: + description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes + which may source tunnel traffic and have the tunneled traffic be + accepted at calico nodes. + items: + type: string + type: array + failsafeInboundHostPorts: + description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow incoming traffic to host endpoints + on irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all inbound host ports, use the value + none. The default value allows ssh access and DHCP. [Default: tcp:22, + udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + failsafeOutboundHostPorts: + description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow outgoing traffic from host endpoints + to irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all outbound host ports, use the value + none. The default value opens etcd''s standard ports to ensure that + Felix does not get cut off from etcd as well as allowing DHCP and + DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, + tcp:6667, udp:53, udp:67]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + featureDetectOverride: + description: FeatureDetectOverride is used to override the feature + detection. Values are specified in a comma separated list with no + spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". + "true" or "false" will force the feature, empty or omitted values + are auto-detected. + type: string + genericXDPEnabled: + description: 'GenericXDPEnabled enables Generic XDP so network cards + that don''t support XDP offload or driver modes can use XDP. This + is not recommended since it doesn''t provide better performance + than iptables. [Default: false]' + type: boolean + healthEnabled: + type: boolean + healthHost: + type: string + healthPort: + type: integer + interfaceExclude: + description: 'InterfaceExclude is a comma-separated list of interfaces + that Felix should exclude when monitoring for host endpoints. The + default value ensures that Felix ignores Kubernetes'' IPVS dummy + interface, which is used internally by kube-proxy. If you want to + exclude multiple interface names using a single value, the list + supports regular expressions. For regular expressions you must wrap + the value with ''/''. For example having values ''/^kube/,veth1'' + will exclude all interfaces that begin with ''kube'' and also the + interface ''veth1''. [Default: kube-ipvs0]' + type: string + interfacePrefix: + description: 'InterfacePrefix is the interface name prefix that identifies + workload endpoints and so distinguishes them from host endpoint + interfaces. Note: in environments other than bare metal, the orchestrators + configure this appropriately. For example our Kubernetes and Docker + integrations set the ''cali'' value, and our OpenStack integration + sets the ''tap'' value. [Default: cali]' + type: string + interfaceRefreshInterval: + description: InterfaceRefreshInterval is the period at which Felix + rescans local interfaces to verify their state. The rescan can be + disabled by setting the interval to 0. + type: string + ipipEnabled: + type: boolean + ipipMTU: + description: 'IPIPMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + ipsetsRefreshInterval: + description: 'IpsetsRefreshInterval is the period at which Felix re-checks + all iptables state to ensure that no other process has accidentally + broken Calico''s rules. Set to 0 to disable iptables refresh. [Default: + 90s]' + type: string + iptablesBackend: + description: IptablesBackend specifies which backend of iptables will + be used. The default is legacy. + type: string + iptablesFilterAllowAction: + type: string + iptablesLockFilePath: + description: 'IptablesLockFilePath is the location of the iptables + lock file. You may need to change this if the lock file is not in + its standard location (for example if you have mapped it into Felix''s + container at a different path). [Default: /run/xtables.lock]' + type: string + iptablesLockProbeInterval: + description: 'IptablesLockProbeInterval is the time that Felix will + wait between attempts to acquire the iptables lock if it is not + available. Lower values make Felix more responsive when the lock + is contended, but use more CPU. [Default: 50ms]' + type: string + iptablesLockTimeout: + description: 'IptablesLockTimeout is the time that Felix will wait + for the iptables lock, or 0, to disable. To use this feature, Felix + must share the iptables lock file with all other processes that + also take the lock. When running Felix inside a container, this + requires the /run directory of the host to be mounted into the calico/node + or calico/felix container. [Default: 0s disabled]' + type: string + iptablesMangleAllowAction: + type: string + iptablesMarkMask: + description: 'IptablesMarkMask is the mask that Felix selects its + IPTables Mark bits from. Should be a 32 bit hexadecimal number with + at least 8 bits set, none of which clash with any other mark bits + in use on the system. [Default: 0xff000000]' + format: int32 + type: integer + iptablesNATOutgoingInterfaceFilter: + type: string + iptablesPostWriteCheckInterval: + description: 'IptablesPostWriteCheckInterval is the period after Felix + has done a write to the dataplane that it schedules an extra read + back in order to check the write was not clobbered by another process. + This should only occur if another application on the system doesn''t + respect the iptables lock. [Default: 1s]' + type: string + iptablesRefreshInterval: + description: 'IptablesRefreshInterval is the period at which Felix + re-checks the IP sets in the dataplane to ensure that no other process + has accidentally broken Calico''s rules. Set to 0 to disable IP + sets refresh. Note: the default for this value is lower than the + other refresh intervals as a workaround for a Linux kernel bug that + was fixed in kernel version 4.11. If you are using v4.11 or greater + you may want to set this to, a higher value to reduce Felix CPU + usage. [Default: 10s]' + type: string + ipv6Support: + type: boolean + kubeNodePortRanges: + description: 'KubeNodePortRanges holds list of port ranges used for + service node ports. Only used if felix detects kube-proxy running + in ipvs mode. Felix uses these ranges to separate host and workload + traffic. [Default: 30000:32767].' + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + logFilePath: + description: 'LogFilePath is the full path to the Felix log. Set to + none to disable file logging. [Default: /var/log/calico/felix.log]' + type: string + logPrefix: + description: 'LogPrefix is the log prefix that Felix uses when rendering + LOG rules. [Default: calico-packet]' + type: string + logSeverityFile: + description: 'LogSeverityFile is the log severity above which logs + are sent to the log file. [Default: Info]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + logSeveritySys: + description: 'LogSeveritySys is the log severity above which logs + are sent to the syslog. Set to None for no logging to syslog. [Default: + Info]' + type: string + maxIpsetSize: + type: integer + metadataAddr: + description: 'MetadataAddr is the IP address or domain name of the + server that can answer VM queries for cloud-init metadata. In OpenStack, + this corresponds to the machine running nova-api (or in Ubuntu, + nova-api-metadata). A value of none (case insensitive) means that + Felix should not set up any NAT rule for the metadata path. [Default: + 127.0.0.1]' + type: string + metadataPort: + description: 'MetadataPort is the port of the metadata server. This, + combined with global.MetadataAddr (if not ''None''), is used to + set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. + In most cases this should not need to be changed [Default: 8775].' + type: integer + mtuIfacePattern: + description: MTUIfacePattern is a regular expression that controls + which interfaces Felix should scan in order to calculate the host's + MTU. This should not match workload interfaces (usually named cali...). + type: string + natOutgoingAddress: + description: NATOutgoingAddress specifies an address to use when performing + source NAT for traffic in a natOutgoing pool that is leaving the + network. By default the address used is an address on the interface + the traffic is leaving on (ie it uses the iptables MASQUERADE target) + type: string + natPortRange: + anyOf: + - type: integer + - type: string + description: NATPortRange specifies the range of ports that is used + for port mapping when doing outgoing NAT. When unset the default + behavior of the network stack is used. + pattern: ^.* + x-kubernetes-int-or-string: true + netlinkTimeout: + type: string + openstackRegion: + description: 'OpenstackRegion is the name of the region that a particular + Felix belongs to. In a multi-region Calico/OpenStack deployment, + this must be configured somehow for each Felix (here in the datamodel, + or in felix.cfg or the environment on each compute node), and must + match the [calico] openstack_region value configured in neutron.conf + on each node. [Default: Empty]' + type: string + policySyncPathPrefix: + description: 'PolicySyncPathPrefix is used to by Felix to communicate + policy changes to external services, like Application layer policy. + [Default: Empty]' + type: string + prometheusGoMetricsEnabled: + description: 'PrometheusGoMetricsEnabled disables Go runtime metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + prometheusMetricsEnabled: + description: 'PrometheusMetricsEnabled enables the Prometheus metrics + server in Felix if set to true. [Default: false]' + type: boolean + prometheusMetricsHost: + description: 'PrometheusMetricsHost is the host that the Prometheus + metrics server should bind to. [Default: empty]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. [Default: 9091]' + type: integer + prometheusProcessMetricsEnabled: + description: 'PrometheusProcessMetricsEnabled disables process metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + removeExternalRoutes: + description: Whether or not to remove device routes that have not + been programmed by Felix. Disabling this will allow external applications + to also add device routes. This is enabled by default which means + we will remove externally added routes. + type: boolean + reportingInterval: + description: 'ReportingInterval is the interval at which Felix reports + its status into the datastore or 0 to disable. Must be non-zero + in OpenStack deployments. [Default: 30s]' + type: string + reportingTTL: + description: 'ReportingTTL is the time-to-live setting for process-wide + status reports. [Default: 90s]' + type: string + routeRefreshInterval: + description: 'RouteRefreshInterval is the period at which Felix re-checks + the routes in the dataplane to ensure that no other process has + accidentally broken Calico''s rules. Set to 0 to disable route refresh. + [Default: 90s]' + type: string + routeSource: + description: 'RouteSource configures where Felix gets its routing + information. - WorkloadIPs: use workload endpoints to construct + routes. - CalicoIPAM: the default - use IPAM data to construct routes.' + type: string + routeTableRange: + description: Calico programs additional Linux route tables for various + purposes. RouteTableRange specifies the indices of the route tables + that Calico should use. + properties: + max: + type: integer + min: + type: integer + required: + - max + - min + type: object + serviceLoopPrevention: + description: 'When service IP advertisement is enabled, prevent routing + loops to service IPs that are not in use, by dropping or rejecting + packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled", + in which case such routing loops continue to be allowed. [Default: + Drop]' + type: string + sidecarAccelerationEnabled: + description: 'SidecarAccelerationEnabled enables experimental sidecar + acceleration [Default: false]' + type: boolean + usageReportingEnabled: + description: 'UsageReportingEnabled reports anonymous Calico version + number and cluster size to projectcalico.org. Logs warnings returned + by the usage server. For example, if a significant security vulnerability + has been discovered in the version of Calico being used. [Default: + true]' + type: boolean + usageReportingInitialDelay: + description: 'UsageReportingInitialDelay controls the minimum delay + before Felix makes a report. [Default: 300s]' + type: string + usageReportingInterval: + description: 'UsageReportingInterval controls the interval at which + Felix makes reports. [Default: 86400s]' + type: string + useInternalDataplaneDriver: + type: boolean + vxlanEnabled: + type: boolean + vxlanMTU: + description: 'VXLANMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + vxlanPort: + type: integer + vxlanVNI: + type: integer + wireguardEnabled: + description: 'WireguardEnabled controls whether Wireguard is enabled. + [Default: false]' + type: boolean + wireguardInterfaceName: + description: 'WireguardInterfaceName specifies the name to use for + the Wireguard interface. [Default: wg.calico]' + type: string + wireguardListeningPort: + description: 'WireguardListeningPort controls the listening port used + by Wireguard. [Default: 51820]' + type: integer + wireguardMTU: + description: 'WireguardMTU controls the MTU on the Wireguard interface. + See Configuring MTU [Default: 1420]' + type: integer + wireguardRoutingRulePriority: + description: 'WireguardRoutingRulePriority controls the priority value + to use for the Wireguard routing rule. [Default: 99]' + type: integer + xdpEnabled: + description: 'XDPEnabled enables XDP acceleration for suitable untracked + incoming deny rules. [Default: true]' + type: boolean + xdpRefreshInterval: + description: 'XDPRefreshInterval is the period at which Felix re-checks + all XDP state to ensure that no other process has accidentally broken + Calico''s BPF maps or attached programs. Set to 0 to disable XDP + refresh. [Default: 90s]' + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/globalnetworkpolicies.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/globalnetworkpolicies.crd.yaml new file mode 100755 index 0000000..1cf624f --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/globalnetworkpolicies.crd.yaml @@ -0,0 +1,856 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkPolicy + listKind: GlobalNetworkPolicyList + plural: globalnetworkpolicies + singular: globalnetworkpolicy + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + applyOnForward: + description: ApplyOnForward indicates to apply the rules in this policy + on forward traffic. + type: boolean + doNotTrack: + description: DoNotTrack indicates whether packets matched by the rules + in this policy should go through the data plane's connection tracking, + such as Linux conntrack. If True, the rules in this policy are + applied before any data plane connection tracking, and packets allowed + by this policy are marked as not to be tracked. + type: boolean + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + namespaceSelector: + description: NamespaceSelector is an optional field for an expression + used to select a pod based on namespaces. + type: string + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + preDNAT: + description: PreDNAT indicates to apply the rules in this policy before + any DNAT. + type: boolean + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress rules are present in the policy. The + default is: \n - [ PolicyTypeIngress ], if there are no Egress rules + (including the case where there are also no Ingress rules) \n + - [ PolicyTypeEgress ], if there are Egress rules but no Ingress + rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are + both Ingress and Egress rules. \n When the policy is read back again, + Types will always be one of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/globalnetworksets.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/globalnetworksets.crd.yaml new file mode 100755 index 0000000..6024037 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/globalnetworksets.crd.yaml @@ -0,0 +1,55 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_globalnetworksets.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkSet + listKind: GlobalNetworkSetList + plural: globalnetworksets + singular: globalnetworkset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs + that share labels to allow rules to refer to them via selectors. The labels + of GlobalNetworkSet are not namespaced. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GlobalNetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/hostendpoints.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/hostendpoints.crd.yaml new file mode 100755 index 0000000..797801d --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/hostendpoints.crd.yaml @@ -0,0 +1,109 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_hostendpoints.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: HostEndpoint + listKind: HostEndpointList + plural: hostendpoints + singular: hostendpoint + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HostEndpointSpec contains the specification for a HostEndpoint + resource. + properties: + expectedIPs: + description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. + If \"InterfaceName\" is not present, Calico will look for an interface + matching any of the IPs in the list and apply policy to that. Note: + \tWhen using the selector match criteria in an ingress or egress + security Policy \tor Profile, Calico converts the selector into + a set of IP addresses. For host \tendpoints, the ExpectedIPs field + is used for that purpose. (If only the interface \tname is specified, + Calico does not learn the IPs of the interface for use in match + \tcriteria.)" + items: + type: string + type: array + interfaceName: + description: "Either \"*\", or the name of a specific Linux interface + to apply policy to; or empty. \"*\" indicates that this HostEndpoint + governs all traffic to, from or through the default network namespace + of the host named by the \"Node\" field; entering and leaving that + namespace via any interface, including those from/to non-host-networked + local workloads. \n If InterfaceName is not \"*\", this HostEndpoint + only governs traffic that enters or leaves the host through the + specific interface named by InterfaceName, or - when InterfaceName + is empty - through the specific interface that has one of the IPs + in ExpectedIPs. Therefore, when InterfaceName is empty, at least + one expected IP must be specified. Only external interfaces (such + as \"eth0\") are supported here; it isn't possible for a HostEndpoint + to protect traffic through a specific local workload interface. + \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; + initially just pre-DNAT policy. Please check Calico documentation + for the latest position." + type: string + node: + description: The node name identifying the Calico node instance. + type: string + ports: + description: Ports contains the endpoint's named ports, which may + be referenced in security policy rules. + items: + properties: + name: + type: string + port: + type: integer + protocol: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + required: + - name + - port + - protocol + type: object + type: array + profiles: + description: A list of identifiers of security Profile objects that + apply to this endpoint. Each profile is applied in the order that + they appear in this list. Profile rules are applied after the selector-based + security policy. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamblocks.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamblocks.crd.yaml new file mode 100755 index 0000000..efc9f1f --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamblocks.crd.yaml @@ -0,0 +1,82 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamblocks.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMBlock + listKind: IPAMBlockList + plural: ipamblocks + singular: ipamblock + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMBlockSpec contains the specification for an IPAMBlock + resource. + properties: + affinity: + type: string + allocations: + items: + type: integer + # TODO: This nullable is manually added in. We should update controller-gen + # to handle []*int properly itself. + nullable: true + type: array + attributes: + items: + properties: + handle_id: + type: string + secondary: + additionalProperties: + type: string + type: object + type: object + type: array + cidr: + type: string + deleted: + type: boolean + strictAffinity: + type: boolean + unallocated: + items: + type: integer + type: array + required: + - allocations + - attributes + - cidr + - strictAffinity + - unallocated + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamconfigs.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamconfigs.crd.yaml new file mode 100755 index 0000000..b03a308 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamconfigs.crd.yaml @@ -0,0 +1,57 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamconfigs.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMConfig + listKind: IPAMConfigList + plural: ipamconfigs + singular: ipamconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMConfigSpec contains the specification for an IPAMConfig + resource. + properties: + autoAllocateBlocks: + type: boolean + maxBlocksPerHost: + description: MaxBlocksPerHost, if non-zero, is the max number of blocks + that can be affine to each host. + type: integer + strictAffinity: + type: boolean + required: + - autoAllocateBlocks + - strictAffinity + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamhandles.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamhandles.crd.yaml new file mode 100755 index 0000000..06a6306 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ipamhandles.crd.yaml @@ -0,0 +1,57 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamhandles.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMHandle + listKind: IPAMHandleList + plural: ipamhandles + singular: ipamhandle + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMHandleSpec contains the specification for an IPAMHandle + resource. + properties: + block: + additionalProperties: + type: integer + type: object + deleted: + type: boolean + handleID: + type: string + required: + - block + - handleID + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ippools.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ippools.crd.yaml new file mode 100755 index 0000000..6b8c9d1 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/ippools.crd.yaml @@ -0,0 +1,100 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ippools.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPPool + listKind: IPPoolList + plural: ippools + singular: ippool + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec contains the specification for an IPPool resource. + properties: + blockSize: + description: The block size to use for IP address assignments from + this pool. Defaults to 26 for IPv4 and 112 for IPv6. + type: integer + cidr: + description: The pool CIDR. + type: string + disabled: + description: When disabled is true, Calico IPAM will not assign addresses + from this pool. + type: boolean + ipip: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + properties: + enabled: + description: When enabled is true, ipip tunneling will be used + to deliver packets to destinations within this pool. + type: boolean + mode: + description: The IPIP mode. This can be one of "always" or "cross-subnet". A + mode of "always" will also use IPIP tunneling for routing to + destination IP addresses within this pool. A mode of "cross-subnet" + will only use IPIP tunneling when the destination node is on + a different subnet to the originating node. The default value + (if not specified) is "always". + type: string + type: object + ipipMode: + description: Contains configuration for IPIP tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling + is disabled). + type: string + nat-outgoing: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + type: boolean + natOutgoing: + description: When nat-outgoing is true, packets sent from Calico networked + containers in this pool to destinations outside of this pool will + be masqueraded. + type: boolean + nodeSelector: + description: Allows IPPool to allocate for a specific node by label + selector. + type: string + vxlanMode: + description: Contains configuration for VXLAN tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. VXLAN + tunneling is disabled). + type: string + required: + - cidr + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/networkpolicies.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/networkpolicies.crd.yaml new file mode 100755 index 0000000..f729b6e --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/networkpolicies.crd.yaml @@ -0,0 +1,838 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_networkpolicies.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkPolicy + listKind: NetworkPolicyList + plural: networkpolicies + singular: networkpolicy + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress are present in the policy. The default + is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including + the case where there are also no Ingress rules) \n - [ PolicyTypeEgress + ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, + PolicyTypeEgress ], if there are both Ingress and Egress rules. + \n When the policy is read back again, Types will always be one + of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/networksets.crd.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/networksets.crd.yaml new file mode 100755 index 0000000..2e545a1 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/crds/networksets.crd.yaml @@ -0,0 +1,52 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_networksets.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkSet + listKind: NetworkSetList + plural: networksets + singular: networkset + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: NetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/daemonset.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/daemonset.yaml new file mode 100755 index 0000000..8ee8512 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/daemonset.yaml @@ -0,0 +1,266 @@ +--- +# Source: calico/templates/calico-node.yaml +# This manifest installs the canal container, as well +# as the CNI plugins and network config on +# each master and worker node in a Kubernetes cluster. +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: {{ .Release.Name | quote }} + namespace: kube-system + labels: + k8s-app: canal +spec: + selector: + matchLabels: + k8s-app: canal + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + labels: + k8s-app: canal + annotations: + # This, along with the CriticalAddonsOnly toleration below, + # marks the pod as a critical add-on, ensuring it gets + # priority scheduling and that its resources are reserved + # if it ever gets evicted. + scheduler.alpha.kubernetes.io/critical-pod: '' + spec: + nodeSelector: + kubernetes.io/os: linux + hostNetwork: true + tolerations: + # Make sure canal gets scheduled on all nodes. + - effect: NoSchedule + operator: Exists + # Mark the pod as a critical add-on for rescheduling. + - key: CriticalAddonsOnly + operator: Exists + - effect: NoExecute + operator: Exists + serviceAccountName: canal + # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force + # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. + terminationGracePeriodSeconds: 0 + priorityClassName: system-node-critical + initContainers: + # This container installs the CNI binaries + # and CNI network config file on each node. + - name: install-cni + image: {{ template "system_default_registry" . }}{{ .Values.calico.cniImage.repository }}:{{ .Values.calico.cniImage.tag }} + command: ["/opt/cni/bin/install"] + env: + # Name of the CNI config file to create. + - name: CNI_CONF_NAME + value: "10-canal.conflist" + # The CNI network config to install on each node. + - name: CNI_NETWORK_CONFIG + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: cni_network_config + # Set the hostname based on the k8s node name. + - name: KUBERNETES_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # CNI MTU Config variable + - name: CNI_MTU + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: veth_mtu + # Prevents the container from sleeping forever. + - name: SLEEP + value: "false" + volumeMounts: + - mountPath: /host/opt/cni/bin + name: cni-bin-dir + - mountPath: /host/etc/cni/net.d + name: cni-net-dir + securityContext: + privileged: true + # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes + # to communicate with Felix over the Policy Sync API. + - name: flexvol-driver + image: {{ template "system_default_registry" . }}{{ .Values.calico.flexvolImage.repository }}:{{ .Values.calico.flexvolImage.tag }} + command: ['/usr/local/bin/flexvol.sh', '-s', '/usr/local/bin/flexvol', '-i', 'flexvoldriver'] + volumeMounts: + - name: flexvol-driver-host + mountPath: /host/driver + securityContext: + privileged: true + containers: + # Runs canal container on each Kubernetes node. This + # container programs network policy and routes on each + # host. + - name: calico-node + command: + - "start_runit" + image: {{ template "system_default_registry" . }}{{ .Values.calico.nodeImage.repository }}:{{ .Values.calico.nodeImage.tag }} + env: + # Use Kubernetes API as the backing datastore. + - name: DATASTORE_TYPE + value: {{ .Values.calico.datastoreType | quote }} + # Configure route aggregation based on pod CIDR. + - name: USE_POD_CIDR + value: {{ .Values.calico.usePodCIDR | quote }} + # Wait for the datastore. + - name: WAIT_FOR_DATASTORE + value: {{ .Values.calico.waitForDatastore | quote }} + # Set based on the k8s node name. + - name: NODENAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # Don't enable BGP. + - name: CALICO_NETWORKING_BACKEND + value: {{ .Values.calico.networkingBackend | quote }} + # Cluster type to identify the deployment type + - name: CLUSTER_TYPE + value: {{ .Values.calico.clusterType | quote}} + # Period, in seconds, at which felix re-applies all iptables state + - name: FELIX_IPTABLESREFRESHINTERVAL + value: {{ .Values.calico.felixIptablesRefreshInterval | quote}} + - name: FELIX_IPTABLESBACKEND + value: {{ .Values.calico.felixIptablesBackend | quote}} + # No IP address needed. + - name: IP + value: "" + # The default IPv4 pool to create on startup if none exists. Pod IPs will be + # chosen from this range. Changing this value after installation will have + # no effect. This should fall within `--cluster-cidr`. + # - name: CALICO_IPV4POOL_CIDR + # value: "192.168.0.0/16" + # Disable file logging so `kubectl logs` works. + - name: CALICO_DISABLE_FILE_LOGGING + value: "true" + # Set Felix endpoint to host default action to ACCEPT. + - name: FELIX_DEFAULTENDPOINTTOHOSTACTION + value: {{ .Values.calico.felixDefaultEndpointToHostAction | quote }} + # Disable IPv6 on Kubernetes. + - name: FELIX_IPV6SUPPORT + value: {{ .Values.calico.felixIpv6Support | quote }} + # Set Felix logging to "info" + - name: FELIX_LOGSEVERITYSCREEN + value: {{ .Values.calico.felixLogSeverityScreen | quote }} + - name: FELIX_HEALTHENABLED + value: {{ .Values.calico.felixHealthEnabled | quote }} + # enable promentheus metrics + - name: FELIX_PROMETHEUSMETRICSENABLED + value: {{ .Values.calico.felixPrometheusMetricsEnabled | quote }} + - name: FELIX_XDPENABLED + value: {{ .Values.calico.felixXDPEnabled | quote }} + - name: FELIX_FAILSAFEINBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeInboundHostPorts | quote }} + - name: FELIX_FAILSAFEOUTBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeOutboundHostPorts | quote }} + securityContext: + privileged: true + resources: + requests: + cpu: 250m + livenessProbe: + exec: + command: + - /bin/calico-node + - -felix-live + periodSeconds: 10 + initialDelaySeconds: 10 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: 9099 + host: localhost + periodSeconds: 10 + volumeMounts: + - mountPath: /lib/modules + name: lib-modules + readOnly: true + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - mountPath: /var/run/calico + name: var-run-calico + readOnly: false + - mountPath: /var/lib/calico + name: var-lib-calico + readOnly: false + - name: policysync + mountPath: /var/run/nodeagent + # This container runs flannel using the kube-subnet-mgr backend + # for allocating subnets. + - name: kube-flannel + image: {{ template "system_default_registry" . }}{{ .Values.flannel.image.repository }}:{{ .Values.flannel.image.tag }} + command: + - "/opt/bin/flanneld" + {{- range .Values.flannel.args }} + - {{ . | quote }} + {{- end }} + securityContext: + privileged: true + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: FLANNELD_IFACE + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: canal_iface + - name: FLANNELD_IP_MASQ + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: masquerade + volumeMounts: + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - name: flannel-cfg + mountPath: /etc/kube-flannel/ + volumes: + # Used by canal. + - name: lib-modules + hostPath: + path: /lib/modules + - name: var-run-calico + hostPath: + path: /var/run/calico + - name: var-lib-calico + hostPath: + path: /var/lib/calico + - name: xtables-lock + hostPath: + path: /run/xtables.lock + type: FileOrCreate + # Used by flannel. + - name: flannel-cfg + configMap: + name: {{ .Release.Name }}-config + # Used to install CNI. + - name: cni-bin-dir + hostPath: + path: /opt/cni/bin + - name: cni-net-dir + hostPath: + path: /etc/cni/net.d + # Used to create per-pod Unix Domain Sockets + - name: policysync + hostPath: + type: DirectoryOrCreate + path: /var/run/nodeagent + # Used to install Flex Volume Driver + - name: flexvol-driver-host + hostPath: + type: DirectoryOrCreate + path: {{ .Values.calico.flexVolumePluginDir }}/nodeagent~uds diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/rbac.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/rbac.yaml new file mode 100755 index 0000000..cd39730 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/rbac.yaml @@ -0,0 +1,163 @@ +--- +# Source: calico/templates/rbac.yaml + +# Include a clusterrole for the calico-node DaemonSet, +# and bind it to the calico-node serviceaccount. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: calico-node +rules: + # The CNI plugin needs to get pods, nodes, and namespaces. + - apiGroups: [""] + resources: + - pods + - nodes + - namespaces + verbs: + - get + - apiGroups: [""] + resources: + - endpoints + - services + verbs: + # Used to discover service IPs for advertisement. + - watch + - list + # Used to discover Typhas. + - get + # Pod CIDR auto-detection on kubeadm needs access to config maps. + - apiGroups: [""] + resources: + - configmaps + verbs: + - get + - apiGroups: [""] + resources: + - nodes/status + verbs: + # Needed for clearing NodeNetworkUnavailable flag. + - patch + # Calico stores some configuration information in node annotations. + - update + # Watch for changes to Kubernetes NetworkPolicies. + - apiGroups: ["networking.k8s.io"] + resources: + - networkpolicies + verbs: + - watch + - list + # Used by Calico for policy information. + - apiGroups: [""] + resources: + - pods + - namespaces + - serviceaccounts + verbs: + - list + - watch + # The CNI plugin patches pods/status. + - apiGroups: [""] + resources: + - pods/status + verbs: + - patch + # Calico monitors various CRDs for config. + - apiGroups: ["crd.projectcalico.org"] + resources: + - globalfelixconfigs + - felixconfigurations + - bgppeers + - globalbgpconfigs + - bgpconfigurations + - ippools + - ipamblocks + - globalnetworkpolicies + - globalnetworksets + - networkpolicies + - networksets + - clusterinformations + - hostendpoints + - blockaffinities + verbs: + - get + - list + - watch + # Calico must create and update some CRDs on startup. + - apiGroups: ["crd.projectcalico.org"] + resources: + - ippools + - felixconfigurations + - clusterinformations + verbs: + - create + - update + # Calico stores some configuration information on the node. + - apiGroups: [""] + resources: + - nodes + verbs: + - get + - list + - watch + # These permissions are only requried for upgrade from v2.6, and can + # be removed after upgrade or on fresh installations. + - apiGroups: ["crd.projectcalico.org"] + resources: + - bgpconfigurations + - bgppeers + verbs: + - create + - update + +--- +# Flannel ClusterRole +# Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: flannel +rules: + - apiGroups: [""] + resources: + - pods + verbs: + - get + - apiGroups: [""] + resources: + - nodes + verbs: + - list + - watch + - apiGroups: [""] + resources: + - nodes/status + verbs: + - patch +--- +# Bind the flannel ClusterRole to the canal ServiceAccount. +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: canal-flannel +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flannel +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: canal-calico +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-node +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/serviceaccount.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/serviceaccount.yaml new file mode 100755 index 0000000..582d55b --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/templates/serviceaccount.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/values.yaml b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/values.yaml new file mode 100755 index 0000000..443d4c1 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.19.1-build2021061110/values.yaml @@ -0,0 +1,82 @@ +--- + +# The IPv4 cidr pool to create on startup if none exists. Pod IPs will be +# chosen from this range. +podCidr: "10.42.0.0/16" + +flannel: + # kube-flannel image + image: + repository: rancher/hardened-flannel + tag: v0.14.0-build20210611 + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + iface: "" + # kube-flannel command arguments + args: + - "--ip-masq" + - "--kube-subnet-mgr" + # Backend for kube-flannel. Backend should not be changed + # at runtime. + backend: "vxlan" + +calico: + # CNI installation image. + cniImage: + repository: rancher/hardened-calico + tag: v3.19.1-build20210611 + # Canal node image. + nodeImage: + repository: rancher/hardened-calico + tag: v3.19.1-build20210611 + # Flexvol Image. + flexvolImage: + repository: rancher/hardened-calico + tag: v3.19.1-build20210611 + # Datastore type for canal. It can be either kuberentes or etcd. + datastoreType: kubernetes + # Wait for datastore to initialize. + waitForDatastore: true + # Configure route aggregation based on pod CIDR. + usePodCIDR: true + # Disable BGP routing. + networkingBackend: none + # Cluster type to identify the deployment type. + clusterType: "k8s,canal" + # Disable file logging so `kubectl logs` works. + disableFileLogging: true + # Disable IPv6 on Kubernetes. + felixIpv6Support: false + # Period, in seconds, at which felix re-applies all iptables state + felixIptablesRefreshInterval: 60 + # iptables backend to use for felix, defaults to auto but can also be set to nft or legacy + felixIptablesBackend: auto + # Set Felix logging to "info". + felixLogSeverityScreen: info + # Enable felix healthcheck. + felixHealthEnabled: true + # Enable prometheus metrics + felixPrometheusMetricsEnabled: true + # Disable XDP Acceleration as we do not support it with our ubi7 base image + felixXDPEnabled: false + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: true + # Set Felix endpoint to host default action to ACCEPT. + felixDefaultEndpointToHostAction: ACCEPT + # Configure the MTU to use. + vethuMTU: 1450 + # Typha is disabled. + typhaServiceName: none + # Kubelet flex-volume-plugin-dir + flexVolumePluginDir: /var/lib/kubelet/volumeplugins + # calico inbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeInboundHostPorts: "" + # calico outbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeOutboundHostPorts: "" + +global: + systemDefaultRegistry: "" + clusterCIDRv4: "" + clusterCIDRv6: "" diff --git a/index.yaml b/index.yaml index e60650c..3fa10d8 100755 --- a/index.yaml +++ b/index.yaml @@ -289,6 +289,23 @@ entries: - assets/rke2-calico/rke2-calico-crd-v1.0.001.tgz version: v1.0.001 rke2-canal: + - apiVersion: v1 + appVersion: v3.19.1 + created: "2021-09-30T22:22:01.255914599Z" + description: Install Canal Network Plugin. + digest: 721e91bcc5f0935152b74f8c88892da80042226294e31286075e4884e968e8f1 + home: https://www.projectcalico.org/ + keywords: + - canal + maintainers: + - email: charts@rancher.com + name: Rancher Labs + name: rke2-canal + sources: + - https://github.com/rancher/rke2-charts + urls: + - assets/rke2-canal/rke2-canal-v3.19.1-build2021061110.tgz + version: v3.19.1-build2021061110 - apiVersion: v1 appVersion: v3.19.1 created: "2021-09-29T10:45:42.367962095Z"