From f46449165e17ac70b61e52d5ff025d00ddec1072 Mon Sep 17 00:00:00 2001 From: actions Date: Wed, 19 Jan 2022 09:16:56 +0000 Subject: [PATCH] Merge pull request #213 from manuelbuil/update-calico-flannel-images Update flannel and calico to latest in canal --- .../rke2-canal-v3.21.2-build2022011907.tgz | Bin 0 -> 27843 bytes .../v3.21.2-build2022011907/Chart.yaml | 13 + .../templates/NOTES.txt | 3 + .../templates/_helpers.tpl | 7 + .../templates/config.yaml | 84 ++ .../templates/crds/bgpconfigurations.crd.yaml | 144 +++ .../templates/crds/bgppeers.crd.yaml | 115 +++ .../templates/crds/blockaffinities.crd.yaml | 62 ++ .../crds/clusterinformations.crd.yaml | 65 ++ .../crds/felixconfigurations.crd.yaml | 565 ++++++++++++ .../crds/globalnetworkpolicies.crd.yaml | 856 ++++++++++++++++++ .../templates/crds/globalnetworksets.crd.yaml | 55 ++ .../templates/crds/hostendpoints.crd.yaml | 109 +++ .../templates/crds/ipamblocks.crd.yaml | 82 ++ .../templates/crds/ipamconfigs.crd.yaml | 57 ++ .../templates/crds/ipamhandles.crd.yaml | 57 ++ .../templates/crds/ippools.crd.yaml | 100 ++ .../templates/crds/networkpolicies.crd.yaml | 838 +++++++++++++++++ .../templates/crds/networksets.crd.yaml | 52 ++ .../templates/daemonset.yaml | 260 ++++++ .../templates/rbac.yaml | 170 ++++ .../templates/serviceaccount.yaml | 6 + .../v3.21.2-build2022011907/values.yaml | 82 ++ index.yaml | 17 + 24 files changed, 3799 insertions(+) create mode 100755 assets/rke2-canal/rke2-canal-v3.21.2-build2022011907.tgz create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/Chart.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/NOTES.txt create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/_helpers.tpl create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/config.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/bgpconfigurations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/bgppeers.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/blockaffinities.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/clusterinformations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/felixconfigurations.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/globalnetworkpolicies.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/globalnetworksets.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/hostendpoints.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamblocks.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamconfigs.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamhandles.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ippools.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/networkpolicies.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/networksets.crd.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/daemonset.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/rbac.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/serviceaccount.yaml create mode 100755 charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/values.yaml diff --git a/assets/rke2-canal/rke2-canal-v3.21.2-build2022011907.tgz b/assets/rke2-canal/rke2-canal-v3.21.2-build2022011907.tgz new file mode 100755 index 0000000000000000000000000000000000000000..73a6381ac98efb4608504d8805ca3d3c6d9b985d GIT binary patch literal 27843 zcmYhiV{~Rg(=Hs_x?^Kv+qRR5ZQHhOCllM6*tVU_#I}?BoA-IobH39*YE|v7+N=9o zd-d+>x|%2k1_R`O8ju=<)<{Z)$wW$?L(Yqv-I(?%a-EtI$hV^Yx^8=T$JU_2Z*yqCT z#pDIf%-dNLsRSum%vl1vTU}jUc;+(SL|9polzhpem1RD>?Y2%->NN=-P!LQGRHeGu zlaQ*nWU|zX@zSPu%D{l=Xv@)MrsOjulHg5LhC9yt@c1XBZ#B~U`1Hx& z=w#{y_!cvC{TUEt!GwKz=__An5u2NE96|o4ku)n6mN{80T6riEV;F4W5a$4$w8SuU z$Hne3G1gRWRx*40j-14#?SVbYT!mGbQl@Npx`Q%0ni}uglttjEk%zJ;uym*mjKIVWMG|4YPErrb7SA9&>>f-zNcEKxPWddKwAQd+*M#GY_nFz%7jR+89k#`v&v$ont z;o&Ms43$T~p;Fs^j>=*-0;-;++91d1x-f^ei;UW8h(a^x%=0meO>8r5QMDTor06?f zqPY9g7>lg1DP}QcU!r^<+Xb-@_Y4GDgruJLy?pi^xa1{3vWB=;HO$>uxlV~8z}Gwr z((RsRO{ZkSSdC|Dfzg%Gg*#M|&;Y{Anbw%w1Sxyo{6xf&h2rOslD)TQmttH7??yq^ z4}NYEk`ByqZvVV&XsRZ`jT;*H)*{XT-w5FUma0d07tDa=ei@RxjTj?3i^Z*qQ;W?M zA2qxIk&igsUhlhHZ6u>@*^V+Lpi>pext+@@gK1jFfx0$rL8k$Qqx;KHXBcRl-n3jzNO_yc~;}i@UW(??0Tw1%+XzpUNe9HxW;tiS_2BQ8JToKOw=W2 zzZY4#hV3i{XH2yeGi7{~9mrlET8HBNNbJJ!^e>zk`DZ&} zlIb6WR=|S_&j&1nn&$(~=Zt1l?kLi9rm#o__D&P>bRkamYubbGZ6{VT77cQuhYUyj zXj;V4&m&v4SQX=eIaa80Et=CgDPwA%S&TRw=4b^3_!vmh5FwCEIYFn@EgiQen8HrbSS!1EqW#M}fcj*A?dN}No87e#iX ziycXaiFLc%%{h6(ZzU0Q7@}-Hn%aLCKlq%C)+;(%WREjL<|{C^7*&d<%W@oTuH&Kp zJcw-SK|GEK+KbXm=i`t)Yd&#H)on~CMw)?FjjuUSV z!cYydX_P-hL63c>NwYSw#F%jz6Mb;pp}z!gA?AP)II=8dkMpJpMR3|4-vu{}7XkX+ z>o>DNfY$Rsi}d2QzMgB8~0ANOqYZDnQGd20#B3O ze=tiAxO3W=nN6mkF$*7Ep8q>|`Y;!ed_WkzTDhJs8^}soVI1qkYv|{oeJFE{=`7XeG@|~k&IVChw_l3DZ>iczYd3~G@MZ5zlCw#^Zha#3@ z9*`aC_X1v(e5P2lpW|)dE9plGYlKP3vX{NXI1B@-z)O5Z`shP!-_DBkM&d78Hu!$_ zgd@X^QYW(+@fc6}D#`CDce}1Oy`e5<9-TN$Rr@Zt{?F=nb~i56tQ;VpdY7D7w~yowECuCn7Q9MQNlt! zbG}{;*~-L5W6`=tmc78N*m1z6`1(#i!@^Lu>DTZ!Z$k5jmoP`G-Y>CfXA*{Y#m-6X zuC@5KE zqUVmS+9;S%g2q2lZhjU>giqMxt9$}1AmF=s3@|u`y$2F?L?-jKWrBPwDu|nIg zPc$;#bTq!l3NKSPFx%y!-)#=Lq1bX%#rrb8Z#t6;ClC1eS@q0H!oJsY#O(uD7gV#B zWklPq)TqfZ@i&D!i`ncZ=kKJr+Q#vwpKi`jT^?ndvo{s~4t?5)y_uLo?gz>g#*$p7 zGhk9u0R~en{>mLG3UeWIaW{q{*?2aUBwE~==2bAdcc97+8q(S#{T-rcD%!sP=tbBj zZxK>?I$p$C`E0IpI;mZSxj}_UgCB|Cn>T8X?wPJ1ljuZ(rU#&-;G_6(7FcCDiWnnT zw@x_o3R1>^QoHnObA%MSTRXE7$O@kQO2Y^epyS?8+JO0^vK?uVMn=fz?f!mch5b%+ z$ed1;XkXvIVv4>2-_+cvCNlK~( zGmPq?ZlY>-(_yOh^9EwO{cbftWtINEk>15U%KLz`slCs3AaB#a`e_6}LB38)zyo@G`Z?P)07VzxDNh3;}x_;PiUf*E*X!nlDw8suerv|5P7BN^cH zeQaG%=0vGcvyVM<2?Vs=V+mU&oMZejd%Ei)(EPKgqA->2NlfS0?kI-MQ*w9P8rnaN zZ9s@@SU$S_qYBG23FM6pLr+(Tx;TQ?z-ef)9|7;Uc{uvLwsWJ>)o89SOS2vRB5{Y+rrY{o;>)DbX2NrJ6KhB3 zBmNt%$)F;t;!*v|vBLnt&M06(`Pl6q@WNmvpmUEf93RoO^*xzJ93XphX=Gtct{%v+ zf^sguFrUJAdn=Nuqmo2zWlD}d=VdrY;+U)cd5)z2ZB;5RbK{j=K6ZFI5_7`%)4(OD z9=YvTn%)O4x##GqiDLUJ-_0YY7;dJ$*>>!_)?2%Zog4Fg9{`7U~q7}-Zm6irr)4%XE zOgW24B^NFgx-0|5NNZ&pZHip9U*Q=AZtd#Be?iF5GkXa@M#cFUKAs}HrYG5lk$Zc! zvy$gqXlkM!?w_Zl9-bL);0(EOC%EP3C!k7eGaZEmv9C9^AfA_L6qyjgC^%pu}r(FeZXyMSrO3V}*u@^#*owvn2&{ z3+u6R&L|FNJ6qc}>#hhabkD1&1@|Y@TTw@0Dx)$c`T=*~tpN*iE-Wq-(MtSuPJ*HSc+HbSzvhZ0+fF zZpS$|eQq`6?GzGYX(XKYI@a4H+uHT!G%MwAB?M$GesWhtY)#waOzlz&90gMXE_XkF zG_x;xXLyxsebCFv{6>m2d@-kFWjUaWn%IejwSdqmCV|pKgO`h0fl?5kV^Qv@l0bb9 zqM&1;Ya@c-Y1KOw$;c@VRP=V&A6A%Fc-tcE_+Y`+DNMg%lcn5y&gZH=UJ|YI~`q2ca1nSN2k^ZmRxs&S?=w+$+zU|PEf zI|q}-6Ms8+bnglUNna=^rgA7~zl_Wkgk_{i$ax>JnQms40qR-i7YsVC*5RGNt-yu+y%J#Gf^+tbKdX8!+Wp%^+I&y_{{C>cg?V z@3l8e|HqxZ_$z1?va_N*9!Z(lrtYS7asz zp^-_tl&nrrhKme%p;jVX`C~CmvP_}#)UN$?a<@r*OfeMIMPS>`myy;xw0=Z%=^{qE zvE5iAsvwZ5V0^fZA>P%z4SXnV+2&whM$^R*5! z7J|N`4KrjRQJ~_uW_DH@5xf5PGZyeWB8dV;bn9_AFX$%}3fda1TtutWnk22B3ATP= zK>O(82UGHX(89ey8dkye-8*lj|v2V@T~dm3vKCKxIDL3$e!_|Bj#5CeWZ zt6L|kSzIruSTd-z=EV2sTkfE0zTDWGbmdjBWgAa7PJ#{vmS4?MNz zk9mX-7m|t@n;o#{K6m-=0JUtv)ySZfL@ymw#7g5_ZqwxE2q%Ym(GF%&f! zfU}}5utS6~@`%LxW;KUpwec&RYrs4pZF70i7V5_;G#pN0im5U&Pg;D!S2+=C!&duJ zXZ8t3D#u~R4_*T>=vkwI6Tw;OyQWzGOJC=8D3c+Xqu(YDh+FUvQC+9(w!4eWa~KCV zV?k~IE-E7B%J$X0mLNxW_e~7}y}5UQY(q=@t>sxj4=8BaPW5+b9FWypAmeiZ{R0qM zQu5y<|4l3fh-?%)f_0x28c2!Y$0yw1rIkTOCkOV7^nYyI%5%( z3-B^Hsh6dn0b7X9c|LzL9LGp(UqiUjrVH|V=9%VT_eg1(#1<$6HTQTPa^gh<55Gq>{a=d;}ZE~o@S9`{?nT;9NU|~4y+d@UC zA#k=hD{Z=A9b!`nPUo25=vhqBbe#@UTn-@37~^GoqQ+hxt=h;i|3PIdZj42t7IYRS z$qICW^r9^)N;-HLo%n>JM+I7ixA^p)F3|ynvl1jHK-L(5J$$~MeaXP9Q*i+BPCS1s z6)1xJz@vQcByp^WIS#qlpq-l+>2!epI|u~DidWeTK;7lU)Yf57x|d#{0+ofoZW&7{{E zy3JZs?J-|nzy1tVw5@~qpO&IFI$-K#l=?)00Y^9(Z{o3j zn~E9}WP0gB#OCGtyB@3{P-Z+!8NN@VqROa{hB}p*jb*+(*c&OW1cAXV)ZGgeR*{wB zBp!Jp6O14y5~P>~2RRnM#k7EWwNkGWMryMVdj*^9M3&C^mLSZ#%Qn}POlic@e{O;@Y=^ijn{sU^7#^~ia8+sJ6g^Lhgqy#RNN*ocr z{?o}9hkf)qa->0SqViYeC>*|66?XR@QO7dMY;~HXOH8^jM$SKBPuWnJ($z6)Q zn85YaePqWwD_1WW06H~AVBb`ovsTHWB9t|3s3DJ>_(%ozM;t~@2uUA3;}``Gq4J!+ zgoEneLlu3sdwL}S=C^XYn<+U64>BLfe{Jsv)*fK#WEovelh5C({Si?iosE^}ixJT` z!!lJ=ZSYR{*3w7f5~;)~N{0$}^x{%e%sblaPyw4Vq=};G<6TPAQ|C?%TVuM}8BIV% zIUcTA${Yi%`p@vxoWIXdnW#j1Hs$u6J9I^)*s0G}w&8hAQ)-9zOWk@z2yjaVUsdj{ zX@Cv6U3F?NL)evOt>$DArd-~BMcveV!HqOiqasV=s>1tc0(EAr1!qur$T9PTw_(8c zwcd$HLrH`Yvx$`m38{j0@B-#i7RK+IyYxG(61p9SnXk}VK3A); z1MBBQp}eOvWja@VXUB6a(x%FWt+q3+Sh7eJ3}g#{@^DEit?3aGCHikQpw*&NUf;IU zS8hf2F`igm0~KKRuL-=ukVXQc*wN<))mguZ$vqIlrId_d5_8!m{30Xs0QhYP;v}S^ z*e4tCoCI7{iQ>d{CEKFMbCRR$dc)d~Bx2~{W|NXG2J!mnbOZ()Ltmp;4_fFyIp>>F z$tZ3By(sVM#+Ci%hfg017tc3CKDefBG;*(Xlyn5m>u4Ai;TapCxwTR$?^1P}Tkg*- z=YxKoK-DdVIgUQf)kmc+M--%>Ffvn`7v(Z?+@oa3DBB3~u}2KAvN&V5S{YCZS9gz) z10Q>H@@!?K=`YMC9RX?`=00i6MFxRst$IOt69bSNdVmHzYFy?YXWEK2flE#$Wc1W| zT|#RqC}jxJUn+G<)mYs^mAt#P#O8%-Xn~?4yW_lN-7+@Tu=U1Hghq?U!udg)KgHV4 z5`1}RH=*i9KZ@2o6LwQ{m#CZ73~h1Dr_xVwq)P{7+a*?!A6Lo0;&OY9T(Dr;^*7-6 zTA&=Hnh?!iqmz*^>zI6>;jMZ?y`x`_dCM`pII|w#OFWR&zm#x{DdzQyG5)2Nl;Wn; zoMon1mp>#HB9me*YHqF`(z~DtF^|645G}gDEJ+8iwM;?7SZ>E?ApJSBKJ7X%`wtBB z!7X}VMLo40c1uPwrM+}8c?XvV#%%-fTE(d7>`B@klBO!pbNgbFvbNR|18oG`yIA!> zz{&osAdN0!XCd`)9q?(ejl$E?l3T_ou@ubmVex1Y z@Ld1>;lYsPP$;{GYlDOp#xrG>4ihP~b3F~PxR$%~`ca^2BQ?rZz@z*cmzz%wI|7>X z4r2g4KcSN@(~3>aeE^H6%(~@IsKE!hb4M-ziwI-JTu_CXKPxk$X5z)|IOt)%*U*G- z%9%bObu$-4vg5jUo7;*R^jv5l*fq%MiRD)Rc6_f8~nJm;E!p#NudzH7#m-9TR zD+L2mucMg32~bk7$YPf6zCdn;`f8}Jp16_qsN5eqjHb4b%3bt+zw-1k1;2GRaduX{ z@RZn%e0=79#ianx0!L?xq@B)lM-6cGXZ8-*5w(7_W1RspK9H`x8+Oi0*HIpEKU`FQ zbQCCBcV~R)u&a;{k&-O2Pz!m%hcY&k@dj}96$Hf(b%2Ao^n)vFVkj6Yl?EyyWqCR!%V&SOk0(q~`$0N>GOKYu5x*v|}u)5~KI;IA7jp1(9x)-t@ zI>|UDY!ybaP_fP?YzkfCWY&Rrco&=sk|!`LRe_>;`Ct|2AlLXs4bCWQamxjix(wGg z$u6T}Y)@8c(uJAd1QwBNzD>@&G)6+J!;Ms7$C<>WY|pW0*5*mQ_3P|yqx7pxe{TBw zH+(*5??X_c@qX2ZsCT9WxPlD8KSQZcW1FeaeW1j#=9j9g!_dTC9{n2He8u!gyL{FC zYN*CcIoa}i_$qxvY8)%Q+A^l6 zTll4@qbT6Ty-<}JMkD$xHmJ8axqv?6UG5v|R&2lwxB2Bs_kNy0q!@;Ua&QIZC^JY^ zfim=uZJ=_4i+Z%Ud8dkN2liB^M0<#KiNoGeJ)>2_T)AqQ#Np^t9u((8epC}76DdaX zB=ko`V8<=c8h7TCX^+W$6b^FOgvJwz>ODz)A9n4%FwTmoH zJgrNvk2_bj=5w))yJicLAs<4EG0DBhqLG0q!2_bX{EPs<=7azO0zv_gf06(*pa)^Q zBPZQES>m0?GD&W1)(_nF(4O%FB;P;i?f@a6_|G#YGv(vG0>0T`Im$yzodgNI_4+ua z*L{;ANyquvLC)_?EpXPRg)T?8};D zegp~X$ZJjyLPEr-OCL# zl;GHvbzROHs@p#-qnt!1>Y8J!%~*O6QIW0^$)@}YFB$Xy0(n_>lFqPLW-2Byc}>E_ zk9TsZN7l}J4I+A}jlW|dkg1ON@wQ=vby=q?gZ!P-lGIyG$pE3hAOkJam8aQY9*Hb} z!JO3*r!-!pyDKiy8SN$Su8d4PUGPa`WvC6ad^Ia`U-a>Jz89XeO<8B4K{Y^Oah0PO8-M!Vtly3 zXi2QMbMkqpK_2G8EsJh6-KjL`vLP$s)v@ zC`L(}=6h-brhX!^Z9a=XYsZh$7%RgaS~kq+-{!1Syos5$P=-d2eyABEY}WoYib0H3 z0)0uB$^EN5y?jH4B(NY%7NH%rdeG)(g&)GWb}0Ix^m*K600*BgPndh7-=^`nazeMD za89OlUjhp!_dIs3VIWnrZ^=f%eb&m8rsS)#W%}ki`C&m(gM4<0?XXd^rs(ENj)34H zi1*)#8Gt>-S3EVbc*Usu;weW+FM{wgr2- zG-7w4)*!!6x#g-MkB}0W@XpT8*3QT-{u?>#@(}mM+x7J>uq|-?VlFF-;4(Zp3Y_E- zL@27=5kD*rx0xE?FSNCF%~19%-(suunzp~S<3^^Dz;uZ?cl>+fiqf+p+P?ArcGLnq z$LGq@&p{8z`~>mnq8=*ExEc%7aSxJm9S)Rxjdhu=9Q2?BQO;Y6p#=1oP-dnJ1>~xG zIs-B+a75zB1mqWZqR%4Xu5|xaNy;R1tNJ!M?)E2+Awm*=j$-;D zp{kzT*iPiQi#x-G=9?Ucebr{7oA^BYLs4ASch;bG#1S@AJdJ(#)JRTnlN?)gqJ z4QYO78Z#(Trfrp2M=4sRGb1#iNnq6l9&Al2F=RHKL?&k{HmJZ)RAlkj>O=a_0DN8) z7#f=Wv8}cD<5TgQXRL&VBK&RoDV(J}aE!^AP7u8nR7`66quf|Ym6(_FFb#EHhr<$J z|Mi{b-VbvSt@=@^dSCbv4U8gFZzbr>4 zN5V>6(^R#^TklfbEJR{Ls+k-^TrGrWNc#AKbAuS6Jg4tuU-rh@CS zO)gPb%1PNKwXpM;b67x;jpJ(n!?M2^z0|_T7l*kUjRL(@#4pTnE>iWYLzN5Kf;)wZ>P9U1MZ@u>E6Z@HPtL}7+&Agy(FyeiY8chsg%9>Q6o7h-q^`ZRfum; zU7;+jgCjzJ({L!%=DI!B1`qVksZb9udJB8M{zr-2~bJnmSD@kRriZz)|(MLOqJzXTD@DsA`S1PQ<%9$10>%=(6e@v$JxP6YX zO`#Rcbcd6MIWy9MnbEOSi#ff*>Oc1u*W$eHTWra?#aF%vn-O>NKo3pswy{1SzN$3S z+7C?^M8FjdPQzUjw!)VUV*J$`Z(X9&BE<28o@Wnj<(VzU`=BdPi1S*zDfwLrHyx09 z^Nk32>+$%)Jy|N7nl-)(-79|UXMd3WgK+1k5mWmS(2&$9)@|9$eW z3QMU>@)Mb;LE{Qe%6Jk=5=ubfQ4!s_D*g4A#HwyfWw&>1QqjSdJgKWa>sKrP%}8sI zm?dYdXBjMfQGbhQsYoT<)e>_?W@dPi*xgJH#$Ja$ZFqzrx>8s*`kCjra%)?smkAfl zCutvPbxZ~66aId|vRpp`yQ)=JjrX{%uQ4`P(8K4A14nPgR;kkH3835L*0iy}uW2ST zXTSk}+ZzI+din|es8&MiU;?j%TGyZ;Gqu}@3m+6y;KbzGOO@vr&png|Ys%>BbSyyQ zeq#H<oqIdVyuJqJO{zgYw zq(;jQvLKwm_u(2^G4|qpLJDa<%lkrIw~d*wjtg6;XJzKBX7PD0%uO&EGoB- zw)d(}Qct+E!i6~rS$|5s1X~BM^3MD%WK27OgL%2izh;GQHF=w}bv2%rrNS_; zy@V|Y?d6gNKVBHDR7B7Fu%vVUl1n|y^rDbD&PV7tAkQo*MWLZdGZ;24Oz=x701beO zPaS8j+aN*%a8`h3`+FFr_MGk`I2$%0%Kx4YE*MoV>imbGfKp1bKuk@v(wUNt(|0!i z-8#mOK`||tDg9`IH4(_5P{*7&ZzJ^CA@pbK?s$J=>VHUlo(&ZD9jJqpw@h%Ja}j~0Ww5ZLAgkYTV;Kej6Z z{4cB5%aMcmFW@WQ{&=-0frbVqTGuS3G`$IWr?+G&iaFJ(daKECORG~@y5Gb7QOvRB zMmVe0J^iBazrO_#QbjnZrRK!gHw8S5XhNw6lW)(okn?NhQK`ASOZFFQsK zEYI)QlZD#JRcok|1v@KrsP(yTG8#BOHJZlLh7ixE6~ zUdPt(aFO}OUh{dc4?wTDWEsvKa8UTOIMS;*&S6=xu$3&r#`H@Z;X|8C$RJmj*Uyom z8@8AG+h^L`b++_=c)2UWifx)xT)!2LMkks&I4d;9+$;dTZ~$?A_AyzWGxF0jMw@~a%7ot%n%hNPB8HV3>~XhGI;|6LeyM*r*_|*l-P(Q{>yZfxY4f2ut~&aQK>B(9%C$G!SsAeQ=?n@5;U}qEX%xes{V1A zf@?NJU(QUsv+q~vL%Xx602c`Hnu=Dm*@~upDu(EXjb)uZY36=q_o{wrmX__9dEtkE zDQl5=TNW1=oUiIrI02(?D_n(X(lJ;SNqC8u9Bm+g?RV)%th4~NW&!zUdQwU>6nhbT z8Ao)oAB<3{Tvk@2E|7SSrP#B@NaELy^4|>o!nH$at4_U!&eC=A@h}S5cUT_)e~hr% zi$D%W$4SOriyygrb{Nxwl+RPHM^Dx`8I-L*;At($gM!Vy4#xn3Xk zIReZN_Heh;1J-p$$pZ`pu*;)q8s9wiriQ$k_7ui%yhe8|SqTqCbQLF{BelUM7QWs4 zo8ldpPIp)+bt5%5y}CCENyXv9#ayA30cj4VF8e?p;k zt1m+!Um*}(>OAY4$RYMvkB;l_-WkcnnllIcub?hE3wiPZ(d@FikIG_RgLQf1&{8zT z8;2G&ryp2kFfyag{LCJj78C#$_xHVK5}T(0w>Ft}Ks=Qd_wphBKyKUkOD#EUYGEI0 z9qpX~BS01J;OHKjJ;LbY1{2U%rYUhkY38i=u9WK5Qc|^X6Mk6x7di|hB!CHXQS>%C zzG~3;{CAIuY=|1@uZs&#JkgW)clnhUbHhX81DBtkCBZNukA{wbS<_3Qzxx{HPFoBE z#-r(@`&0d#$R5XZXfd`9FqEvg%b`!Vveogj3ylUqq; z2!7_;&F<;yk`sZi(Xc0Eez9;VhQY;BaCT~hFqO2dISBY{bCOgJ7ZP`%kG263@-=R! zf_sG4`{2ukxiAn9gZtFGII<*bd+b_$po!fn5jb-tSfq9`CCF?<+fBGe*a zjD4~gb{c6qk;wh*ks;)*grvyuhMmgz3c)miMlO%X{j(I0HvM0%6vj)^J`N?*5}D=> z;ASIpEO*<>i; zrWs47HSRdoOvVi`r2<`Cox3}68ACO@F%T`e0!A&2ov11rjtBfJ73P}ci}bVf6v=~* zLAy9689c@54UF?=&(fuA30h(+(in}QM!u8b-FNDLGr~?sudnQq!6;tH!Y2F{MyO=0 z_KTYYpq2e7ZbXURrm~bsMo7~-74gpeTtqfaO@CKs&9MWaU2xjY+1J7k<8rN?CDZne zt-U}~Xi=A=;sKe%0F`!ccqIydSQd(T?U_Z=t|2}}2vrPK8i@CN<+y3*X*cqd>9cyd z21oj`@#!ZXHs8PsrM(W90mO1?QQWGwooatAMfwZ$m(gc+CDY9DKi&#w^r9gNR~{4P z=CY$kURF7GmQz#Cy4rTqw7y=&aDX-Rea=2^9^d}p`6q+m_{8}v;%yH)>A z;aAMm@b|P4gMsb#gqZL-|KD7D*VVjr>ulvTyNMXz-OK*$(vAzioCO8_Ct{3u!&o07 z<=5_a1fl!1jbHjP{@BJF6$oxsHOcL1JgslbN6Zp7tV~d+KZV;2(H-oGZ9Kc&R+kQM zd}CVg;?~&w74K}&MwlAloNF8TYfO)qJ5)exck$3B*inoP=4FVe5!*^Q9>I8s_EtZ| zXGAtq+9SxRuerbVF2V}5Q6(%yqsS;c*bt$8Syh7!*mN#>xhunj1LNlK=f+#XVdquO zbNL$$FAO(Hyod?=ZA^((ogad1h;{wfRyJfYxO`}1F zpn4Fjgum+h>5O$BWPoVD^YiA8w{Bxs7l`*&mRkUlNzLt}33F?Wt?>%qITidBz=muin~FwT@O4y+EcHk}WT1tRQwM z{w6XEPSgmC_l;ftxou9zSkl>cd6lhIfQd-U`t01SK@lQ}lN}zz9=bA=rtUS!lxD_^ zZDB!H=)bYD;_cKQQQ@i`8K(z);TPRctX>jLu9So+W8XXNf zyaK$7HBTVdhp~kuN9>%XyD!#+Ty+jN_??S05NfYctWLD*}@M5cZ#|E1;oqjX5vlO z^?BMK_B6%lK5yBDIv13N#C7ECreQtK(6yas_g;OP-^-AU9?u%TQp2P4$sC`8T!Wm*epJz^`v0FDWCtc&CwIJ$#C}rMeRn;QrqNg^s8DqBJqK) z@%RC1SyBQ;X+I>2+l?O`w3g%*Jitaj?840y)yaY&jB6PtR_tk-UDcDG(05>Xl8Zo^ zBV{Ojyg8st6=XKe=)9ZQ4&#^nkI@&3$#k`uQ-`%UiuF@s2V&ID3v*IZ%B69|-0*|+ zN9C;2+lYQ>bz>UxF1qysj?Z<=`leb1i+Z}9=HppSp9p(Li$Je=Ne;ovan$O&zA4#3q(qzLVY9yK zGL+2+ncWN08FicTR%`L=nm|OfgX*vQyv60X#o0#%-^CKVM&>+ik8M5jI}X<>za0w1 z>ZM9N*$VqWl^snLwz>Mde3d0}Co;@`gs&_I2<=q6Jqu5z9gUQ4^Q z8!^p(R7Y~ujf0$m=zg?90PQK!+xf@bUF;`ipXUzCULtT-6cJ zYkjpfG;4m@L0(a5g4j1sgo-oxuSC7T&dUObG^;Us{1-){gOE{$AE-vZxx`1rs#4XT zp!SJ(HN$`V8lGs7s9+VnnQm-CD&~qMO^;y7EvbKXF^=%lqi(G-fXhhAu;2hTssqt! zVd_J~c*RGK+KSdG-}ObTX8|*cc_9(M`3m4H?@o$xH81=V^k^|;U=Su0%<0r$P1_1D5Ek(NrDMoTsOxT1lqx8}Pj5`4<#3yeu?|rCZjYU@B^#8+2*n%t!d#*#|0!X_vf} zB*TgoK_l56D|8YsweDax>zj7I)G7RVLnVJm`p}yYVN`vIywR-O+x4u@f~d^qQsN^R zumd7F;!Se894@LEF;+m`FVO_o^39+l79GF1%6}VQuYXIl8$hmx_i<7JYXqg3cFy-5 zDQ%7C$<=

?di~6Oyb9sdxOnJa^VNh{vt7V_~J-8VB7UySPxcI<{|l*V%56$1A_; z`4Sk}FJNI!xjTmVrf&;SW5CmhS;ooGbuw+yGj>CW39sy!3|}I7J6Lfm zh}|`Kfn{B|rS`fwmv5sL)df6n`g?TRjFeJyt$cag3gNIf&%8KznC1k8U+J{F*i=fo zofsw$8OJ!r`J;1eLyD|BddoqD?ktVtr}RXnDq-R-E+_Rcs~`T^d8#&XoirY-fRtXl zUAke|{bZCR1%x`$%?k?*q7adohx-nr3V0_}Iy$Z12TjFc@o>=58E+8UgS|0KT7c74 z-*ku3m1NbIia>gPm_Fd?iJw66rHxI4_gmdis+5iqZUW7^KCjnL2sec`LZu*Cg9Okj zAgCTXi2Uc5Uvu`Fy;xR4s=o zWQu#JQz1Ne;t8%a#)ZHE-w8sEfy0y+Z@H_)`h&A3$CvWk47z-JDiqH>)jV8{#+F&o zS`E%V*wbA)XK%S*LrNJEsh>1>xfn=%~Wv-FI9ZjX%$eRt(T%V4t0$Kh&EH;+Rr2I1*dak9F$|&y*Ufb`U zV_iSIBwNlT4z^NC8Hni3ICNfEt+61NEZgllfi7Swn(V~9Qp-^yzxw-o+hX9f6iPEU z!53qx{I~cDo6NYd#sTkrdMPDHje##0ZmE%xz>e>TSF0S6x^$Vkn!mN)I+YU4JcQwU zKL-N61?T2%@7C>XWyE4?ic^uQ<;`z128=w@)aub+a7QL#G8zT7aB@89omv6PeDSVS zC5;w#WUd|kZ8qIHh0@icS{_uc9wJ+t{&^n3iK7qF@+ekM;v3WOW@Nw=%st7uzFMaM z*BM-r6@Tlst}edu1&R-LuvQJov%h+0v=XHA^*f~+xi#o{98UbtIbJX!CUixl zG7?lp`nsr0uoiTAJsR8*{g?+LsZW31{_ugD^eXt-c8u44{4Q3|X>#+i@{(`xjO*{*LK78^3q3}D24IxB!La1#|#^*zU$AT2tB zT2MLocPWy&OQ>=+{-0n_s)A2F2P?&ex&|x#{eSFxMS#ydq>NjT$^pecp;x%qYv%+rM3>@&L*w;>%vBZu(+ziYMY2+IIgn^8gFwWQPC0rTp+< zL-Oy|M+rur2iMQ|H5UB-})a6H@&aGO8re5 zq5pyNUm*HmjsGuT|9wWE^3Msc+st%7`Q7X_#hKCMC^ z&@Kg@@l1Ks#Fbyh!nO|b5BRcK4VX7!=HI_(vGg?DR3is55z_=!a1!kA1X++5u)C@# z5XHCAb)u{=pvyB>5>M!-2O*^giblB?#@N;}9qCM8;KWL&qaSt4DU+}*q?}OSFJpp# z1nqLFv((H{oG_2JL3Co{!1%u}4CD)>x1P{_KbCuED~uIfGikCce!6xrvq|TN(&;el z@$l4QSh(Km1*xz}(|9xZkniq47r6q;D4%~E6g|&os>4-%n9frX8IJgfIzw72;%{<3 zWyy?4nUA2?zU3w{OTf}~Gpty(!7icBU`Ls&EsQgTx%h|0uaT(vfn^BEm~f1Y*Q zV9}_L!Khkzi&anuQp){^zEGNBXV8mb879HxM~vL}q?|3JH#%u~jLUDUNL9f?P9}7e zPeJqEaY^%cPD5?Dn8EKg#$MJpUY)*IJ%%^$6AS|?5b=0Ybj73zeRy@n=oMl2GI~(D z-$UtE!F%`-r~m>ua@I>MB(|YrU=M;&)~rKrdwX z=Qp3=kgqFuJ;F`ZS70$^3%RpYGh80^HcWOiMs1qo zTQK+@1D#*`Tt+OKfaQ^!i9pkcIy$zy6XB5kA&EBX85d@=8F3Loxw z zGa?$)de6m4Ld20o{d)p%@np^y+WVXdo}(=N(Vk}XedCg5Yx$M@@fm5M$kkhIKlFP* zqy<18_`D7{lhDj}%-CJ_?-F3WJ88t31bOAcqv zMr;s0M{gD<+wK{=WULeBO=YQ=d#Ok3bT?%Ww3;mlk2NpoAHuEkem-_r;)kimf6Oc! zx}qmUO8Kp4UsfguG^Gt04N3oseYh`LeN4n0W*vv-h~%?Z*xXsQ9nc-yr(2r!=FX+b zaOfpTq-_vq;rA~^Yzhpqcm+C|DP6#v4<$!p#3+t_Uaa3G=~L(uDQW=wZFWwtr=x== z;7k=mu=U?lg4-HyHD6WczYpfI*h!rDzLqT~9N z;d74!wq>FZ-nxVtJd4drHP2UTy;!}MXt7k|X$?T0qe~=^ulp`CI%sE}tz^Y6^V3LL zb%fHBa_I);Y7Vhza+*r#mwPHsW5yX+$;=J$4c=0f=`F^pvxfdBk z{%!}l>>rH*y?i_}yY_R5s$CT3N4sf^$c!C)R0(=bN$WT+#|WurFD5swem=ip^u#Be zyAt}?)IrA%!>Sy0net8{D10>fHxs$$1c2tA%-cV&*j8KV#_Ibx@@EkCaB&lk#{xXh zG6sLfou7IO+j<_{lgXO*(IGm{YSj^ABA88)P$;f@st7!6{H$PK_ozfw^5QRRjx`(; zSgg#JMH_-<6M?IRyRzbdnagd~g`ZO&Aq4Mk6OFei%_`!b+H;&f!d=OvW!Irwi|5oK zOpMgGjSxPsvYq%MJb0F@;8HBUkgK-0Uy#BwMZI9o+nr=I7x&R7{agHc_^Ge?aa_Hb ze0RV-c1@K-$WA8i69=Dxa=2mR>OgY)@|F{lX(a_m5$=wg!PgpjK6+Z&ky0Hfo#kWk z0}NBn_M^AhOx+DFL1}>o65?@O`s)|fTY6r4gt0fwn!hG}BN(B7S{=Z| z-gln~9F~@1Xy#J((MuvaNh~84w~WeLVnHQgJ7sM{r8$&L915cly@q7<&ytgfmiJ)Z zb9F*H>|wehs`BXTsSA)_WaH6=&s7O<5A$?SqK=gSUthKcUxV45NT^Jr$EjUH>e&UCojNQYzX5c96(mVXxG>5smzd{U*eU{`1wt}(mj{a zEg$!LA|*GnB68XAkJ$93_a7Ifh-{EI{E^|=SB=5AJ-|h_U*9awOk^&*OrHm1PUPlBP z3}jQX29wqMso`qe__G;m78)b=`gg$3##n~B*w?1=JqFRPsRiL^QAW|Nh@Js9_z;M$ z-8M`(<{X{-e>}_^Jxr@zj)91lpr&tqPYVh0=QqYwR&L6e22#9WaUpuFW*FYNPEH{* z2i#-))Mzl9-P`s~KWMV(Tz5^U(&B+p5_M{3#N_%AJ{;*0u{CCE)36PBa-WVrnzU86 z0uk~I3)57N9JYDxKlhPa@tHf;>Tvsl)>PV&o;yw77$(iRWsRL*EJil&?m<|S0KW1Q zKV)5kcHZOLPQ7gpnKwIVBmROdKX?X0xhpSzZjYDtGk3`ot=EqH>u<$%g%{s+ok!MX zmsY5~{ANeiw;$~ak1(W-3%wiWZ#0Kzd#sa1EVks#4fke3n8B>R0!)2htsLLZPuG}= z%1}KLrkJk1s4=)C0IV?qXSfMD=>niIn!=%C18j0g-n5*`-3CJ~>Pxr}W!D6S~Wr5@o^}XK2vJly&*Gdf2J77(i}W{Ak*T z6io~p43G~pYi!{`o64+2ox7D*610POkM8OOk18Rt^Jf;n`0>?+Uc!=dd{J_wf~3KTR5qnPGyJ zhdni+Zc^XkeF47`m4|VzhldM@zo<-v;GwQbgz#HYBvSPM*4KsbjXI}tuWNM(ZE!e1 z8(Uv)WpOQOeaDQn$Tx{w|4xHOLB;O#RhV!@w?JBgPfiT?uLpXDpL}l^_=_`bM41>E zagN<}rEwFm*KFg)RJ7W-sc-gx&Ui#U@U#6-_ZPv@wg({jinrC*jmX{u+SiS(n}1HY zH+}?0{45|f(XqijkZ&*m@|Cay?%L0m9sJ#H-|OVDGY0gr*E3lWgU^qh zZ@obWqwgQ>pq+=0oeWpJ^q|nMHyR$DsMLgs7r2rK0JXiR(^zm{WYe0S6O%=e!2=g> z-NA#mlqX)VV~+hR>zz;sXSG+t%*O!{t^6keL8la}CI?%_y?T7;Qaz)XUAybkLSL&$#yDerFvf5AGN zDSKcin>9N`N&QZXW~3!OhhTIv8-lc@rARa5)nZv$WATcbhV91J9EuvMeRjw0a%1Ms zAr#zi;3?alk|B<**fIjx*VnLib7m->p{qt?bG+QC}!Q50`z<4{dYF^t9Z+vO%V2mhKup zZv^Nz#A67Jw~h-2a2e6&(n=N;d&Xq}6=S1*Lr-zD4_?R52XzQ@o7jG^D>02AsaF%E zk1#dX+egO?PU!K~Z(-qq%s`J^j|*>UK7Ep+;27@va& zc#Is^2*2mO@!|edt^r2nFfKY6zfCUNnT^UvT362&y{*{_kP|DZQ!*335b|Ofh=W2e5cZnwz#DXGRodo_*8IYqY ztwfqANh$hlx`}V!T(UYXDyj_%ir!?jbKv}AdYF094HT`=A1N1xaZZ-#Me zYJea40%lT=`iSP2Dq?lAE&C%#nD6ybG$lp!PC+JeKDtoWhD)|oZR z=IoJ7MCI8Xt*FXq6VRGUR97+ZCjjUJ zspw@H3-vUyQbMWjH`Cf8URUPC&y2HFlGNEwx>33HlU=-Ea6QSTXE}2XX}dR;9TZ4MbRB+NZemO|kaw1!Vggo| zNitL3Q6jl`J)UcUqYQPA$;a@D^NL}Wm6X;CYA1!On=YA){PV}xG|BZ4t)kskg68s# z>io%4Wj4t%95nX06W{ds?=)-2td&>&Z1^@SM>?>KtMJEMP}N!X1-zpOtr|9r5nL;=r-Mil1M~?UHU3fkuJ5jA z_Wta+V1e2Wqr#&k26=LZMZ-}O>2hI%l>Q1!%ep5jZ_QVhMp>srF6Up##Vae5YGa&Cy&^?m6Jc;h}g?a!-) z+%2(BiM`()`)N4DHG~uoj1n1@l=EFhfUX*U2%qN=3yABDA&ouzm$co?D%wRjnpjMU zcDU!K5+m?X%FZ?QP+d0>TmOuJsA-C1E<7r6+*y8O&s}Y)IILu23;`l9=Y5|#ipXOA zLai^)>Mb53+`#iDqtVJk<(C#|9MxhajuiPduwN~;g~vq;Bkj(8mXLO}*BnOO4 z!vG!QUL3UrgAW`G`j+zt1GC&*OXvk2(_hP)*&tp>Z0K*zI;e(yN9;%VBdaOFWPi>( zu^zk^lbvr!qB2tE2{~jGlU=O_s1z=wtG*qsb7==W?#n2(7d~R`08+witWv>$k*d?{%PKfD+fX%xccjK;7_>f>I$g@wf|S625I~#)`PeNyAi*}ECJKXr zB5Q%hlM&)mzR73j)ihTt#Js{>%U0Mgx$nOCkPPc ziU3V&bh+qplysGQ%o075X3zHKGXFQ80mIY2$vb#l+0flkwFMvMk0C6|vG2XbyEcHY zfXZ5Y&dV;~+qvUHgtU_B-iBT*5>E#B4~hfp!172nTVc8MZbm= z%NK!^yK3X-0{bY>q048r=_b?d^to?5qHwt!v?~f3*ovh!{jVho)J^c)qR}Y*;1ZqC z9l{Yb_F$MOVr{nc981Z1S~dBJTup|;cn58&Q(qC=61bAa(DXm$GEE`vzO!{Dc!m{x1e;Nvn_Ab*>{!tK&=Zw)oYNufd(e>OP zx(33i#aWFRzCctc^vi_Pj0mBiqed?GOD?>5*{PyMgG%z3x~FU<n@|1pVL`JRE)T~uWN&YF4WMvDp z0)!Y-Um+5l=JRh{&x>uH^n~KZ$b+4qILU8Yy_ii=#(_?-Rtr;DXi;f_^a!za#kpC2 zC)>%E9S&Aia<}O`_Z@mZ7f&Xj8nc#HE8k#0y=>hTJzTHg&+GQRQ;AUsouGA3cwgsT z{maw-NHL%1gC4V6xy3`_{-GPBf?pXoSWo}IJgW&6iXSpHlI^k#xUjFazIVLFzf$*7 z^Dkz(9i=$fe)!TvWXTQ5aa$NSL;gVV4GBVJ!@q|Uk%zM=HUImlv;$GE-X^^<5a zh@jxe%iIk4)KPyJXR7S*O*BWaDJylNHYYsESZ4l5_2D}*t{d{(idX6zU-59`A;qzW zIKP7o>B7{&N#z@3x6{3x<7~kpINJb7^xm&`EAACHl!eBO-@M>5zK_6qRsifH?&-qqSBtD{ zE=DucWv9UVN2tb%_IM$4P*^$D0ZbE%HTvO|9?0@pX1OY7bEWv+MGV6U?^Jo1w;t~_ zI#2SN%vj&SqI23UpR*w70wF11QcOb@e&M)vUeM$kE{=ezds<_VDy!CgRX&2z=5!!7OourjM6JVRPg9{$V>Wjoy@!_u> zf41KyKDi8fUW5UP*^z1DL=J1?MDM_nQlTqQ@i3he;VPGaKiEJwO_wgi(H= z)H>@LHYo~F2FF|PUifkbtxg^O_TJfrpgKcJnoh2QomN^ig~v|Y2#z*|vW6M2!~$Z) zAJz2m5wWkBo1@|@@POiPl{)0X6GZZL6vtZT`Vq>wpfxdVy#6;#5o-v}tyO4BHv9JY z?_(7e%UF&Nh7$svUuy}qP3RD$gqkYEC`(ig$|cj_r37gOAjV^9P4#UG^Og2}r$aLE zHUnVLF!ho&&$Q^bjb=oMOeL$#x8JcP141NyWZs_}@lTWc>9dgiR-cYX`TkR;j+y_G zDS#k@^mx=qs3ZZsc?Pd_)Z53apjYG(^#1;S4a(`{bibPK-s&C=N@V~LE^p+V5#n_` zMw|-V8;ZzPA*tw{`CY4zM!rP<6QPQQX)hxI#WA`LOE!UtVXBPXe&7q+_jeE_qtXlk zrZ-!X<#S#HGp3HKtNDPBHf9Yh-AqQZYNO^e({Erk$pxZN;Wy4sry+K-?4DG5&369)RAeE^&adXM-fzQagCVX&Y zIB&@A_h)xIyOHR@Er}uv`X-Ijfb5J|C(`8g$fYcDuM9a@Wl=_vpX zF!e$zl0kUdJ!-$m{z{>ACU1|%OPK8e#F;U%(Ges#3CUWFBq)_FnQef5!H2=D$+QvT zENU03KMq&u^-YGIVivlaq9ZI;8)%y~!BOG&r9JUhtk)sI)2vbCn|zS~#3BTSSjIC+ z7mAV}v6|88C)*n1_@zdz_&qcGb)oHo3`Z2HPeb^#j>>t@UN`Cw817RaJA(?|4kmft zFQj>0-Y084FeJg=s)M7j9i85WadqE_eG1V=y+tIeXi6ca6@Zi8Cw+#uN&NvGR|nIf*6(L8Tiv`m`j zMD;bBhqN8`bn|r+tBDw-8rA`P8JtBz*LRwhga9WCUJ9)15n$yi?)`g#>&Wgr-vY)U z0#8}d`<0bbx=wa?KjLJ7=8a=0^|77qJKmlhp*M zaB5MMv$u{{0pH2boVgLc3!ze=cSB0fcSKz@Zs>z25Wy=dZr?9s-*mHJ4)+_@F51xn zU5a=Zr8|7bAE>!gois{HP688=qS4;nW4I5GB!|jlXDAh7DhL(D1&{0@HbPBaQTX_D z8hO(;qtWe_$Scg~3J>fKbTG+v1PVX;d|MF?ZZ?2sl1&U+PFQvPqRmNxoZJei6upZW znXCm;ey4QLiC6Ya=W8n%v|qAPteoHX6*DOD!POS?50bC=*lbM{h}@CU%+)h!NQ_oq zSkryMg0r;H*hMB>U9?nV++qumcO9gn4s>vm#%B}B_1N1W>iUr_FqJgE0@?(7=CPcy z6fq+LuVoONpP#r=G?iAF?iw&?{S+|O-Wa(TxllmdvIWxrl0&K1D(asKSt{@m&5h;Ae^E74!v5B;iXhi6|E#itVExP z<;kwVl_e5nfo+9gmW-R;}N|uWp zHY{|ln7(9mSO7Sg6Mf|-LiWN`rxiT)_|+EZlU2yTw@PxR=Q5k-2D!fjw%hJmjb^9U zE>>Nk{>ml*@lg6$?i=Uid-sA;VL_2fzF5|W#0L1tV9`n&=E#7UWsNGIkgj55t*1&F zUz5s~WB9E`GQo~_v8|0I+P`qiC5^_}j35tO=-)kFE#%S->8G8((RQyH4lE}AMm=b@ z$;0&OAfv{svBMcO&KMgmy8t*b{=AL)q8A*6Zj10;eN54D>c*4Bjv0uxUj1?VEicXt zi|{m@P+e?9=@M@*tUvu_-P&DsHj!4H*yMRa-*Ui?zaHz{xaNx-UZf5VT54qr z)fOaIeY@RT%5>_(C_5~U_IFq>Ud|Lp%bi(!CsJu|%_f-;dgB}ugG%A>15I|;8Oy*v zAC|g;r?L8C$}=zwhUurykhI%YT~Ztb6xyun1vttw3O6Lpcr;qt1QZz8bxCGfdqXi- z^Vlps%$Sc0m)O0vC35lo=>)dd{jHImGu=I7Qvpn70vqMkA9%E$2Tt>}7>`#pH6W|4 ziGkHFE=y%I5(2!2irkbjC)W>Gz;M3;2`<<9`?rX%hzJJ=G{wQ6B}l(7P#F^oK|#Rc z@77^BuC{5ZL)UbgFu~W~B1M~|27NxZb7+e9$gfBbEX!8qPeu;`bB=sasUcR{LYj{j zB0v2TsHW`jW;UwWX8z>dFW^Q)M8h-VAkg7LnW&(Xt9#h7{X)oXSLJ)I?MmNjS5>Br zH}%z3z`Y23r3=a^gx^mxwNDP>O6wK7C)%Oh{VOL+w`gP@OC46h@L44b`*Y;Np>`U9 z3UBaO(tt_)HzR$R-AKB~hyKZS-wjtj7Vd;%*!vm|LXUg*P1&s4gCFMQr~^N%#*t^Va7riKTAan5%l@%C%e@~6DKFM3_8Fl|C zhA-d=3^KL~;f>)^{w}^5j+nS5js&On%^jc}HKdARw$>e@pY9u<0AU5dp z;@Sk)9;JF^w(m5Nzgnj5{p2-a{s(t?;?b0u5V>yvg_n!RVv4v(C~Bb(K9vqh&2V9; zh?_ExG2Ls@znAPsjL`PV>Lp39b~u}H>1&zCzW5Q_^H#C+TZyOO0~wjasbfP0-d9rO zdEVyft$0=_x4BcYVOTn%DDnYXxoSKWUnh+gL{V|huW?`k?0oeDtP)&T4Lz^=-N!gO z$>zaozYRiG$ii(U&$KAxZyj$q${Vres-|B?A1-J)f=8OfHnSI24;m~8aM=(J>spP< zf9vuxaB=2Jk9zCLn4rSMhEQ57zIb%G#n0e(tLDkl##NVg&nkSe= z?VK_-y5ndLh|A(i#+`Rb1bS{TCO{EEB3>D(S7xyN&^SeIo0fL4TtWtfFloYaevZyvY*cGGySyv^^~|R>*yW9u+O0)YH*Tojg#zfSAKKSUA}?s;!G7g3c%#c)g)cvM zbvaC5IROptEZ`pOd%Diy#-2^R~)>P zP-PQyP4I0GdFav9Lj8M!!HvdyOH^wNxa4aUePD|j_xmsXOKl%o5mS7tz_E(k;P;<- zBP&3SSj|vpS=v4r6H|Oe2G{_c+m!hZ;YuPcEM3gTPZoj{ZO8$idTERkfFUs+^G@%b z?3aruywxy&5(eLDi5HAylYt36Nj~+Oi6)hsW7tg)J{Z`R6QT1O)8spTwvxdhbnpi=OOwTGYWrB*zA9K_n(sc%&g)h{SsT-Eiu&%6zh$ zyL7r-&7P}ZGM<7wfpUb^Ygwmb<2XEn5eP+^6DV){3~TISQ2aPcq=@L9rW~I-Sm?L@ z%6xAL)nCGG1jiffWI`xf{naMGJYLFtm-|ps9?ty6tX~S=(Y`!tKNW#Q;n4QieqgKV z^z&rjA1&k_6}=oFMc=Wg5Jx5;%sYd*;$ce{MEyvmi?%*`Pw)5|BTq$ic;=aY2R=s( z@UNh~mryP8CbtoS=^OSuAy*E@Ko`Tx5`RQsB`3QZt(&8K<2;VbkUU2)}&VD==yxDT`2}Wx`}%EFzLAM7bm3Dfs-fqu$VU zucE7iZ?(WLNW~8L0=BG%h1g`F`rsYFFNEtWXoL9H1g!!ThIkt#nro7bggO&aRf`q# zv;r8pw=?QuAVGC34WAj#Y!C~LFpI2^X>35DRpF#!g)QvrC9&0*lt)R*iv5mnMj#k| zG8z=lU?dRPBa}9p%lW+fCwbNI>#BQ3JvQkR5?&aLbR6{jZ$b<;%!iarDw5zq49?LX z%0Cl8%0WT}VYPxF!i$t1#TZI|ZJ~gP}v5`WJ(P825dC|}vE<+cghBKZ6=I9^_wv1vJdv|hNwrlgzL?pibH zO40G)EalPnZ5frNPwkN&QC)|gwCXXvx>@z+)A8dCI1ltEBl&T% ybu>qJTflEvB^mMQyxO`pBpXz>q+6AGvgg_Sp0@yk`1rpvkP~l)5*QUE*#80!qoYRv literal 0 HcmV?d00001 diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/Chart.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/Chart.yaml new file mode 100755 index 0000000..826db34 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +appVersion: v3.21.2 +description: Install Canal Network Plugin. +home: https://www.projectcalico.org/ +keywords: +- canal +maintainers: +- email: charts@rancher.com + name: Rancher Labs +name: rke2-canal +sources: +- https://github.com/rancher/rke2-charts +version: v3.21.2-build2022011907 diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/NOTES.txt b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/NOTES.txt new file mode 100755 index 0000000..12a30ff --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/NOTES.txt @@ -0,0 +1,3 @@ +Canal network plugin has been installed. + +NOTE: It may take few minutes until Canal image install CNI files and node become in ready state. diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/_helpers.tpl b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/_helpers.tpl new file mode 100755 index 0000000..b647c75 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/_helpers.tpl @@ -0,0 +1,7 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/config.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/config.yaml new file mode 100755 index 0000000..02e0ac7 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/config.yaml @@ -0,0 +1,84 @@ +--- +# Source: calico/templates/calico-config.yaml +# This ConfigMap is used to configure a self-hosted Canal installation. +kind: ConfigMap +apiVersion: v1 +metadata: + name: {{ .Release.Name }}-config + namespace: kube-system +data: + # Typha is disabled. + typha_service_name: {{ .Values.calico.typhaServiceName | quote }} + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + canal_iface: {{ .Values.flannel.iface | quote }} + + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: {{ .Values.calico.masquerade | quote }} + + # Configure the MTU to use + veth_mtu: {{ .Values.calico.vethuMTU | quote }} + + # The CNI network configuration to install on each node. The special + # values in this config will be automatically populated. + cni_network_config: |- + { + "name": "k8s-pod-network", + "cniVersion": "0.3.1", + "plugins": [ + { + "type": "calico", + "log_level": "info", + "datastore_type": "kubernetes", + "nodename": "__KUBERNETES_NODE_NAME__", + "mtu": __CNI_MTU__, + "ipam": { + "type": "host-local", + "ranges": [ + [ + { + "subnet": "usePodCidr" + } +{{- if coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 }} + ], + [ + { + "subnet": "usePodCidrIPv6" + } +{{- end }} + ] + ] + }, + "policy": { + "type": "k8s" + }, + "kubernetes": { + "kubeconfig": "__KUBECONFIG_FILEPATH__" + } + }, + { + "type": "portmap", + "snat": true, + "capabilities": {"portMappings": true} + }, + { + "type": "bandwidth", + "capabilities": {"bandwidth": true} + } + ] + } + + # Flannel network configuration. Mounted into the flannel container. + net-conf.json: | + { + "Network": {{ coalesce .Values.global.clusterCIDRv4 .Values.podCidr | quote }}, +{{- if coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 }} + "IPv6Network": {{ coalesce .Values.global.clusterCIDRv6 .Values.podCidrv6 | quote }}, + "EnableIPv6": true, +{{- end }} + "Backend": { + "Type": {{ .Values.flannel.backend | quote }} + } + } diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/bgpconfigurations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/bgpconfigurations.crd.yaml new file mode 100755 index 0000000..589c3a2 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/bgpconfigurations.crd.yaml @@ -0,0 +1,144 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_bgpconfigurations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgpconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPConfiguration + listKind: BGPConfigurationList + plural: bgpconfigurations + singular: bgpconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: BGPConfiguration contains the configuration for any BGP routing. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPConfigurationSpec contains the values of the BGP configuration. + properties: + asNumber: + description: 'ASNumber is the default AS number used by a node. [Default: + 64512]' + format: int32 + type: integer + communities: + description: Communities is a list of BGP community values and their + arbitrary names for tagging routes. + items: + description: Community contains standard or large community value + and its name. + properties: + name: + description: Name given to community value. + type: string + value: + description: Value must be of format `aa:nn` or `aa:nn:mm`. + For standard community use `aa:nn` format, where `aa` and + `nn` are 16 bit number. For large community use `aa:nn:mm` + format, where `aa`, `nn` and `mm` are 32 bit number. Where, + `aa` is an AS Number, `nn` and `mm` are per-AS identifier. + pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$ + type: string + type: object + type: array + listenPort: + description: ListenPort is the port where BGP protocol should listen. + Defaults to 179 + maximum: 65535 + minimum: 1 + type: integer + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: INFO]' + type: string + nodeToNodeMeshEnabled: + description: 'NodeToNodeMeshEnabled sets whether full node to node + BGP mesh is enabled. [Default: true]' + type: boolean + prefixAdvertisements: + description: PrefixAdvertisements contains per-prefix advertisement + configuration. + items: + description: PrefixAdvertisement configures advertisement properties + for the specified CIDR. + properties: + cidr: + description: CIDR for which properties should be advertised. + type: string + communities: + description: Communities can be list of either community names + already defined in `Specs.Communities` or community value + of format `aa:nn` or `aa:nn:mm`. For standard community use + `aa:nn` format, where `aa` and `nn` are 16 bit number. For + large community use `aa:nn:mm` format, where `aa`, `nn` and + `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and + `mm` are per-AS identifier. + items: + type: string + type: array + type: object + type: array + serviceClusterIPs: + description: ServiceClusterIPs are the CIDR blocks from which service + cluster IPs are allocated. If specified, Calico will advertise these + blocks, as well as any cluster IPs within them. + items: + description: ServiceClusterIPBlock represents a single allowed ClusterIP + CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceExternalIPs: + description: ServiceExternalIPs are the CIDR blocks for Kubernetes + Service External IPs. Kubernetes Service ExternalIPs will only be + advertised if they are within one of these blocks. + items: + description: ServiceExternalIPBlock represents a single allowed + External IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + serviceLoadBalancerIPs: + description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes + Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress + IPs will only be advertised if they are within one of these blocks. + items: + description: ServiceLoadBalancerIPBlock represents a single allowed + LoadBalancer IP CIDR block. + properties: + cidr: + type: string + type: object + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/bgppeers.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/bgppeers.crd.yaml new file mode 100755 index 0000000..bdbd2ee --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/bgppeers.crd.yaml @@ -0,0 +1,115 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_bgppeers.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bgppeers.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BGPPeer + listKind: BGPPeerList + plural: bgppeers + singular: bgppeer + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BGPPeerSpec contains the specification for a BGPPeer resource. + properties: + asNumber: + description: The AS Number of the peer. + format: int32 + type: integer + keepOriginalNextHop: + description: Option to keep the original nexthop field when routes + are sent to a BGP Peer. Setting "true" configures the selected BGP + Peers node to use the "next hop keep;" instead of "next hop self;"(default) + in the specific branch of the Node on "bird.cfg". + type: boolean + maxRestartTime: + description: Time to allow for software restart. When specified, this + is configured as the graceful restart timeout. When not specified, + the BIRD default of 120s is used. + type: string + node: + description: The node name identifying the Calico node instance that + is targeted by this peer. If this is not set, and no nodeSelector + is specified, then this BGP peer selects all nodes in the cluster. + type: string + nodeSelector: + description: Selector for the nodes that should have this peering. When + this is set, the Node field must be empty. + type: string + password: + description: Optional BGP password for the peerings generated by this + BGPPeer resource. + properties: + secretKeyRef: + description: Selects a key of a secret in the node pod's namespace. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + type: object + peerIP: + description: The IP address of the peer followed by an optional port + number to peer with. If port number is given, format should be `[]:port` + or `:` for IPv4. If optional port number is not set, + and this peer IP and ASNumber belongs to a calico/node with ListenPort + set in BGPConfiguration, then we use that port to peer. + type: string + peerSelector: + description: Selector for the remote nodes to peer with. When this + is set, the PeerIP and ASNumber fields must be empty. For each + peering between the local node and selected remote nodes, we configure + an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, + and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The + remote AS number comes from the remote node's NodeBGPSpec.ASNumber, + or the global default if that is not set. + type: string + sourceAddress: + description: Specifies whether and how to configure a source address + for the peerings generated by this BGPPeer resource. Default value + "UseNodeIP" means to configure the node IP as the source address. "None" + means not to configure a source address. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/blockaffinities.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/blockaffinities.crd.yaml new file mode 100755 index 0000000..dbaaebc --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/blockaffinities.crd.yaml @@ -0,0 +1,62 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_blockaffinities.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BlockAffinity + listKind: BlockAffinityList + plural: blockaffinities + singular: blockaffinity + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BlockAffinitySpec contains the specification for a BlockAffinity + resource. + properties: + cidr: + type: string + deleted: + description: Deleted indicates that this block affinity is being deleted. + This field is a string for compatibility with older releases that + mistakenly treat this field as a string. + type: string + node: + type: string + state: + type: string + required: + - cidr + - deleted + - node + - state + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/clusterinformations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/clusterinformations.crd.yaml new file mode 100755 index 0000000..2f25897 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/clusterinformations.crd.yaml @@ -0,0 +1,65 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_clusterinformations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: ClusterInformation + listKind: ClusterInformationList + plural: clusterinformations + singular: clusterinformation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ClusterInformation contains the cluster specific information. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterInformationSpec contains the values of describing + the cluster. + properties: + calicoVersion: + description: CalicoVersion is the version of Calico that the cluster + is running + type: string + clusterGUID: + description: ClusterGUID is the GUID of the cluster + type: string + clusterType: + description: ClusterType describes the type of the cluster + type: string + datastoreReady: + description: DatastoreReady is used during significant datastore migrations + to signal to components such as Felix that it should wait before + accessing the datastore. + type: boolean + variant: + description: Variant declares which variant of Calico should be active. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/felixconfigurations.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/felixconfigurations.crd.yaml new file mode 100755 index 0000000..a1c3d6d --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/felixconfigurations.crd.yaml @@ -0,0 +1,565 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_felixconfigurations.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: FelixConfiguration + listKind: FelixConfigurationList + plural: felixconfigurations + singular: felixconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Felix Configuration contains the configuration for Felix. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FelixConfigurationSpec contains the values of the Felix configuration. + properties: + allowIPIPPacketsFromWorkloads: + description: 'AllowIPIPPacketsFromWorkloads controls whether Felix + will add a rule to drop IPIP encapsulated traffic from workloads + [Default: false]' + type: boolean + allowVXLANPacketsFromWorkloads: + description: 'AllowVXLANPacketsFromWorkloads controls whether Felix + will add a rule to drop VXLAN encapsulated traffic from workloads + [Default: false]' + type: boolean + awsSrcDstCheck: + description: 'Set source-destination-check on AWS EC2 instances. Accepted + value must be one of "DoNothing", "Enabled" or "Disabled". [Default: + DoNothing]' + enum: + - DoNothing + - Enable + - Disable + type: string + bpfConnectTimeLoadBalancingEnabled: + description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, + controls whether Felix installs the connection-time load balancer. The + connect-time load balancer is required for the host to be able to + reach Kubernetes services and it improves the performance of pod-to-service + connections. The only reason to disable it is for debugging purposes. [Default: + true]' + type: boolean + bpfDataIfacePattern: + description: BPFDataIfacePattern is a regular expression that controls + which interfaces Felix should attach BPF programs to in order to + catch traffic to/from the network. This needs to match the interfaces + that Calico workload traffic flows over as well as any interfaces + that handle incoming traffic to nodeports and services from outside + the cluster. It should not match the workload interfaces (usually + named cali...). + type: string + bpfDisableUnprivileged: + description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled + sysctl to disable unprivileged use of BPF. This ensures that unprivileged + users cannot access Calico''s BPF maps and cannot insert their own + BPF programs to interfere with Calico''s. [Default: true]' + type: boolean + bpfEnabled: + description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. + [Default: false]' + type: boolean + bpfExternalServiceMode: + description: 'BPFExternalServiceMode in BPF mode, controls how connections + from outside the cluster to services (node ports and cluster IPs) + are forwarded to remote workloads. If set to "Tunnel" then both + request and response traffic is tunneled to the remote node. If + set to "DSR", the request traffic is tunneled but the response traffic + is sent directly from the remote node. In "DSR" mode, the remote + node appears to use the IP of the ingress node; this requires a + permissive L2 network. [Default: Tunnel]' + type: string + bpfExtToServiceConnmark: + description: 'BPFExtToServiceConnmark in BPF mode, controls a + 32bit mark that is set on connections from an external client to + a local service. This mark allows us to control how packets of + that connection are routed within the host and how is routing + intepreted by RPF check. [Default: 0]' + type: integer + + bpfKubeProxyEndpointSlicesEnabled: + description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls + whether Felix's embedded kube-proxy accepts EndpointSlices or not. + type: boolean + bpfKubeProxyIptablesCleanupEnabled: + description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF + mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s + iptables chains. Should only be enabled if kube-proxy is not running. [Default: + true]' + type: boolean + bpfKubeProxyMinSyncPeriod: + description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the + minimum time between updates to the dataplane for Felix''s embedded + kube-proxy. Lower values give reduced set-up latency. Higher values + reduce Felix CPU usage by batching up more work. [Default: 1s]' + type: string + bpfLogLevel: + description: 'BPFLogLevel controls the log level of the BPF programs + when in BPF dataplane mode. One of "Off", "Info", or "Debug". The + logs are emitted to the BPF trace pipe, accessible with the command + `tc exec bpf debug`. [Default: Off].' + type: string + chainInsertMode: + description: 'ChainInsertMode controls whether Felix hooks the kernel''s + top-level iptables chains by inserting a rule at the top of the + chain or by appending a rule at the bottom. insert is the safe default + since it prevents Calico''s rules from being bypassed. If you switch + to append mode, be sure that the other rules in the chains signal + acceptance by falling through to the Calico rules, otherwise the + Calico policy will be bypassed. [Default: insert]' + type: string + dataplaneDriver: + type: string + debugDisableLogDropping: + type: boolean + debugMemoryProfilePath: + type: string + debugSimulateCalcGraphHangAfter: + type: string + debugSimulateDataplaneHangAfter: + type: string + defaultEndpointToHostAction: + description: 'DefaultEndpointToHostAction controls what happens to + traffic that goes from a workload endpoint to the host itself (after + the traffic hits the endpoint egress policy). By default Calico + blocks traffic from workload endpoints to the host itself with an + iptables "DROP" action. If you want to allow some or all traffic + from endpoint to host, set this parameter to RETURN or ACCEPT. Use + RETURN if you have your own rules in the iptables "INPUT" chain; + Calico will insert its rules at the top of that chain, then "RETURN" + packets to the "INPUT" chain once it has completed processing workload + endpoint egress policy. Use ACCEPT to unconditionally accept packets + from workloads after processing workload endpoint egress policy. + [Default: Drop]' + type: string + deviceRouteProtocol: + description: This defines the route protocol added to programmed device + routes, by default this will be RTPROT_BOOT when left blank. + type: integer + deviceRouteSourceAddress: + description: This is the source address to use on programmed device + routes. By default the source address is left blank, leaving the + kernel to choose the source address used. + type: string + disableConntrackInvalidCheck: + type: boolean + endpointReportingDelay: + type: string + endpointReportingEnabled: + type: boolean + externalNodesList: + description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes + which may source tunnel traffic and have the tunneled traffic be + accepted at calico nodes. + items: + type: string + type: array + failsafeInboundHostPorts: + description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow incoming traffic to host endpoints + on irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all inbound host ports, use the value + none. The default value allows ssh access and DHCP. [Default: tcp:22, + udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + failsafeOutboundHostPorts: + description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow outgoing traffic from host endpoints + to irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all outbound host ports, use the value + none. The default value opens etcd''s standard ports to ensure that + Felix does not get cut off from etcd as well as allowing DHCP and + DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, + tcp:6667, udp:53, udp:67]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + featureDetectOverride: + description: FeatureDetectOverride is used to override the feature + detection. Values are specified in a comma separated list with no + spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". + "true" or "false" will force the feature, empty or omitted values + are auto-detected. + type: string + genericXDPEnabled: + description: 'GenericXDPEnabled enables Generic XDP so network cards + that don''t support XDP offload or driver modes can use XDP. This + is not recommended since it doesn''t provide better performance + than iptables. [Default: false]' + type: boolean + healthEnabled: + type: boolean + healthHost: + type: string + healthPort: + type: integer + interfaceExclude: + description: 'InterfaceExclude is a comma-separated list of interfaces + that Felix should exclude when monitoring for host endpoints. The + default value ensures that Felix ignores Kubernetes'' IPVS dummy + interface, which is used internally by kube-proxy. If you want to + exclude multiple interface names using a single value, the list + supports regular expressions. For regular expressions you must wrap + the value with ''/''. For example having values ''/^kube/,veth1'' + will exclude all interfaces that begin with ''kube'' and also the + interface ''veth1''. [Default: kube-ipvs0]' + type: string + interfacePrefix: + description: 'InterfacePrefix is the interface name prefix that identifies + workload endpoints and so distinguishes them from host endpoint + interfaces. Note: in environments other than bare metal, the orchestrators + configure this appropriately. For example our Kubernetes and Docker + integrations set the ''cali'' value, and our OpenStack integration + sets the ''tap'' value. [Default: cali]' + type: string + interfaceRefreshInterval: + description: InterfaceRefreshInterval is the period at which Felix + rescans local interfaces to verify their state. The rescan can be + disabled by setting the interval to 0. + type: string + ipipEnabled: + type: boolean + ipipMTU: + description: 'IPIPMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + ipsetsRefreshInterval: + description: 'IpsetsRefreshInterval is the period at which Felix re-checks + all iptables state to ensure that no other process has accidentally + broken Calico''s rules. Set to 0 to disable iptables refresh. [Default: + 90s]' + type: string + iptablesBackend: + description: IptablesBackend specifies which backend of iptables will + be used. The default is legacy. + type: string + iptablesFilterAllowAction: + type: string + iptablesLockFilePath: + description: 'IptablesLockFilePath is the location of the iptables + lock file. You may need to change this if the lock file is not in + its standard location (for example if you have mapped it into Felix''s + container at a different path). [Default: /run/xtables.lock]' + type: string + iptablesLockProbeInterval: + description: 'IptablesLockProbeInterval is the time that Felix will + wait between attempts to acquire the iptables lock if it is not + available. Lower values make Felix more responsive when the lock + is contended, but use more CPU. [Default: 50ms]' + type: string + iptablesLockTimeout: + description: 'IptablesLockTimeout is the time that Felix will wait + for the iptables lock, or 0, to disable. To use this feature, Felix + must share the iptables lock file with all other processes that + also take the lock. When running Felix inside a container, this + requires the /run directory of the host to be mounted into the calico/node + or calico/felix container. [Default: 0s disabled]' + type: string + iptablesMangleAllowAction: + type: string + iptablesMarkMask: + description: 'IptablesMarkMask is the mask that Felix selects its + IPTables Mark bits from. Should be a 32 bit hexadecimal number with + at least 8 bits set, none of which clash with any other mark bits + in use on the system. [Default: 0xff000000]' + format: int32 + type: integer + iptablesNATOutgoingInterfaceFilter: + type: string + iptablesPostWriteCheckInterval: + description: 'IptablesPostWriteCheckInterval is the period after Felix + has done a write to the dataplane that it schedules an extra read + back in order to check the write was not clobbered by another process. + This should only occur if another application on the system doesn''t + respect the iptables lock. [Default: 1s]' + type: string + iptablesRefreshInterval: + description: 'IptablesRefreshInterval is the period at which Felix + re-checks the IP sets in the dataplane to ensure that no other process + has accidentally broken Calico''s rules. Set to 0 to disable IP + sets refresh. Note: the default for this value is lower than the + other refresh intervals as a workaround for a Linux kernel bug that + was fixed in kernel version 4.11. If you are using v4.11 or greater + you may want to set this to, a higher value to reduce Felix CPU + usage. [Default: 10s]' + type: string + ipv6Support: + type: boolean + kubeNodePortRanges: + description: 'KubeNodePortRanges holds list of port ranges used for + service node ports. Only used if felix detects kube-proxy running + in ipvs mode. Felix uses these ranges to separate host and workload + traffic. [Default: 30000:32767].' + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + logFilePath: + description: 'LogFilePath is the full path to the Felix log. Set to + none to disable file logging. [Default: /var/log/calico/felix.log]' + type: string + logPrefix: + description: 'LogPrefix is the log prefix that Felix uses when rendering + LOG rules. [Default: calico-packet]' + type: string + logSeverityFile: + description: 'LogSeverityFile is the log severity above which logs + are sent to the log file. [Default: Info]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + logSeveritySys: + description: 'LogSeveritySys is the log severity above which logs + are sent to the syslog. Set to None for no logging to syslog. [Default: + Info]' + type: string + maxIpsetSize: + type: integer + metadataAddr: + description: 'MetadataAddr is the IP address or domain name of the + server that can answer VM queries for cloud-init metadata. In OpenStack, + this corresponds to the machine running nova-api (or in Ubuntu, + nova-api-metadata). A value of none (case insensitive) means that + Felix should not set up any NAT rule for the metadata path. [Default: + 127.0.0.1]' + type: string + metadataPort: + description: 'MetadataPort is the port of the metadata server. This, + combined with global.MetadataAddr (if not ''None''), is used to + set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. + In most cases this should not need to be changed [Default: 8775].' + type: integer + mtuIfacePattern: + description: MTUIfacePattern is a regular expression that controls + which interfaces Felix should scan in order to calculate the host's + MTU. This should not match workload interfaces (usually named cali...). + type: string + natOutgoingAddress: + description: NATOutgoingAddress specifies an address to use when performing + source NAT for traffic in a natOutgoing pool that is leaving the + network. By default the address used is an address on the interface + the traffic is leaving on (ie it uses the iptables MASQUERADE target) + type: string + natPortRange: + anyOf: + - type: integer + - type: string + description: NATPortRange specifies the range of ports that is used + for port mapping when doing outgoing NAT. When unset the default + behavior of the network stack is used. + pattern: ^.* + x-kubernetes-int-or-string: true + netlinkTimeout: + type: string + openstackRegion: + description: 'OpenstackRegion is the name of the region that a particular + Felix belongs to. In a multi-region Calico/OpenStack deployment, + this must be configured somehow for each Felix (here in the datamodel, + or in felix.cfg or the environment on each compute node), and must + match the [calico] openstack_region value configured in neutron.conf + on each node. [Default: Empty]' + type: string + policySyncPathPrefix: + description: 'PolicySyncPathPrefix is used to by Felix to communicate + policy changes to external services, like Application layer policy. + [Default: Empty]' + type: string + prometheusGoMetricsEnabled: + description: 'PrometheusGoMetricsEnabled disables Go runtime metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + prometheusMetricsEnabled: + description: 'PrometheusMetricsEnabled enables the Prometheus metrics + server in Felix if set to true. [Default: false]' + type: boolean + prometheusMetricsHost: + description: 'PrometheusMetricsHost is the host that the Prometheus + metrics server should bind to. [Default: empty]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. [Default: 9091]' + type: integer + prometheusProcessMetricsEnabled: + description: 'PrometheusProcessMetricsEnabled disables process metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + removeExternalRoutes: + description: Whether or not to remove device routes that have not + been programmed by Felix. Disabling this will allow external applications + to also add device routes. This is enabled by default which means + we will remove externally added routes. + type: boolean + reportingInterval: + description: 'ReportingInterval is the interval at which Felix reports + its status into the datastore or 0 to disable. Must be non-zero + in OpenStack deployments. [Default: 30s]' + type: string + reportingTTL: + description: 'ReportingTTL is the time-to-live setting for process-wide + status reports. [Default: 90s]' + type: string + routeRefreshInterval: + description: 'RouteRefreshInterval is the period at which Felix re-checks + the routes in the dataplane to ensure that no other process has + accidentally broken Calico''s rules. Set to 0 to disable route refresh. + [Default: 90s]' + type: string + routeSource: + description: 'RouteSource configures where Felix gets its routing + information. - WorkloadIPs: use workload endpoints to construct + routes. - CalicoIPAM: the default - use IPAM data to construct routes.' + type: string + routeTableRange: + description: Calico programs additional Linux route tables for various + purposes. RouteTableRange specifies the indices of the route tables + that Calico should use. + properties: + max: + type: integer + min: + type: integer + required: + - max + - min + type: object + serviceLoopPrevention: + description: 'When service IP advertisement is enabled, prevent routing + loops to service IPs that are not in use, by dropping or rejecting + packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled", + in which case such routing loops continue to be allowed. [Default: + Drop]' + type: string + sidecarAccelerationEnabled: + description: 'SidecarAccelerationEnabled enables experimental sidecar + acceleration [Default: false]' + type: boolean + usageReportingEnabled: + description: 'UsageReportingEnabled reports anonymous Calico version + number and cluster size to projectcalico.org. Logs warnings returned + by the usage server. For example, if a significant security vulnerability + has been discovered in the version of Calico being used. [Default: + true]' + type: boolean + usageReportingInitialDelay: + description: 'UsageReportingInitialDelay controls the minimum delay + before Felix makes a report. [Default: 300s]' + type: string + usageReportingInterval: + description: 'UsageReportingInterval controls the interval at which + Felix makes reports. [Default: 86400s]' + type: string + useInternalDataplaneDriver: + type: boolean + vxlanEnabled: + type: boolean + vxlanMTU: + description: 'VXLANMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + vxlanPort: + type: integer + vxlanVNI: + type: integer + wireguardEnabled: + description: 'WireguardEnabled controls whether Wireguard is enabled. + [Default: false]' + type: boolean + wireguardInterfaceName: + description: 'WireguardInterfaceName specifies the name to use for + the Wireguard interface. [Default: wg.calico]' + type: string + wireguardListeningPort: + description: 'WireguardListeningPort controls the listening port used + by Wireguard. [Default: 51820]' + type: integer + wireguardMTU: + description: 'WireguardMTU controls the MTU on the Wireguard interface. + See Configuring MTU [Default: 1420]' + type: integer + wireguardRoutingRulePriority: + description: 'WireguardRoutingRulePriority controls the priority value + to use for the Wireguard routing rule. [Default: 99]' + type: integer + xdpEnabled: + description: 'XDPEnabled enables XDP acceleration for suitable untracked + incoming deny rules. [Default: true]' + type: boolean + xdpRefreshInterval: + description: 'XDPRefreshInterval is the period at which Felix re-checks + all XDP state to ensure that no other process has accidentally broken + Calico''s BPF maps or attached programs. Set to 0 to disable XDP + refresh. [Default: 90s]' + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/globalnetworkpolicies.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/globalnetworkpolicies.crd.yaml new file mode 100755 index 0000000..1cf624f --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/globalnetworkpolicies.crd.yaml @@ -0,0 +1,856 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkPolicy + listKind: GlobalNetworkPolicyList + plural: globalnetworkpolicies + singular: globalnetworkpolicy + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + applyOnForward: + description: ApplyOnForward indicates to apply the rules in this policy + on forward traffic. + type: boolean + doNotTrack: + description: DoNotTrack indicates whether packets matched by the rules + in this policy should go through the data plane's connection tracking, + such as Linux conntrack. If True, the rules in this policy are + applied before any data plane connection tracking, and packets allowed + by this policy are marked as not to be tracked. + type: boolean + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + namespaceSelector: + description: NamespaceSelector is an optional field for an expression + used to select a pod based on namespaces. + type: string + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + preDNAT: + description: PreDNAT indicates to apply the rules in this policy before + any DNAT. + type: boolean + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress rules are present in the policy. The + default is: \n - [ PolicyTypeIngress ], if there are no Egress rules + (including the case where there are also no Ingress rules) \n + - [ PolicyTypeEgress ], if there are Egress rules but no Ingress + rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are + both Ingress and Egress rules. \n When the policy is read back again, + Types will always be one of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/globalnetworksets.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/globalnetworksets.crd.yaml new file mode 100755 index 0000000..6024037 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/globalnetworksets.crd.yaml @@ -0,0 +1,55 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_globalnetworksets.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkSet + listKind: GlobalNetworkSetList + plural: globalnetworksets + singular: globalnetworkset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs + that share labels to allow rules to refer to them via selectors. The labels + of GlobalNetworkSet are not namespaced. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GlobalNetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/hostendpoints.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/hostendpoints.crd.yaml new file mode 100755 index 0000000..797801d --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/hostendpoints.crd.yaml @@ -0,0 +1,109 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_hostendpoints.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: HostEndpoint + listKind: HostEndpointList + plural: hostendpoints + singular: hostendpoint + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HostEndpointSpec contains the specification for a HostEndpoint + resource. + properties: + expectedIPs: + description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. + If \"InterfaceName\" is not present, Calico will look for an interface + matching any of the IPs in the list and apply policy to that. Note: + \tWhen using the selector match criteria in an ingress or egress + security Policy \tor Profile, Calico converts the selector into + a set of IP addresses. For host \tendpoints, the ExpectedIPs field + is used for that purpose. (If only the interface \tname is specified, + Calico does not learn the IPs of the interface for use in match + \tcriteria.)" + items: + type: string + type: array + interfaceName: + description: "Either \"*\", or the name of a specific Linux interface + to apply policy to; or empty. \"*\" indicates that this HostEndpoint + governs all traffic to, from or through the default network namespace + of the host named by the \"Node\" field; entering and leaving that + namespace via any interface, including those from/to non-host-networked + local workloads. \n If InterfaceName is not \"*\", this HostEndpoint + only governs traffic that enters or leaves the host through the + specific interface named by InterfaceName, or - when InterfaceName + is empty - through the specific interface that has one of the IPs + in ExpectedIPs. Therefore, when InterfaceName is empty, at least + one expected IP must be specified. Only external interfaces (such + as \"eth0\") are supported here; it isn't possible for a HostEndpoint + to protect traffic through a specific local workload interface. + \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; + initially just pre-DNAT policy. Please check Calico documentation + for the latest position." + type: string + node: + description: The node name identifying the Calico node instance. + type: string + ports: + description: Ports contains the endpoint's named ports, which may + be referenced in security policy rules. + items: + properties: + name: + type: string + port: + type: integer + protocol: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + required: + - name + - port + - protocol + type: object + type: array + profiles: + description: A list of identifiers of security Profile objects that + apply to this endpoint. Each profile is applied in the order that + they appear in this list. Profile rules are applied after the selector-based + security policy. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamblocks.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamblocks.crd.yaml new file mode 100755 index 0000000..efc9f1f --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamblocks.crd.yaml @@ -0,0 +1,82 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamblocks.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMBlock + listKind: IPAMBlockList + plural: ipamblocks + singular: ipamblock + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMBlockSpec contains the specification for an IPAMBlock + resource. + properties: + affinity: + type: string + allocations: + items: + type: integer + # TODO: This nullable is manually added in. We should update controller-gen + # to handle []*int properly itself. + nullable: true + type: array + attributes: + items: + properties: + handle_id: + type: string + secondary: + additionalProperties: + type: string + type: object + type: object + type: array + cidr: + type: string + deleted: + type: boolean + strictAffinity: + type: boolean + unallocated: + items: + type: integer + type: array + required: + - allocations + - attributes + - cidr + - strictAffinity + - unallocated + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamconfigs.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamconfigs.crd.yaml new file mode 100755 index 0000000..b03a308 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamconfigs.crd.yaml @@ -0,0 +1,57 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamconfigs.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMConfig + listKind: IPAMConfigList + plural: ipamconfigs + singular: ipamconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMConfigSpec contains the specification for an IPAMConfig + resource. + properties: + autoAllocateBlocks: + type: boolean + maxBlocksPerHost: + description: MaxBlocksPerHost, if non-zero, is the max number of blocks + that can be affine to each host. + type: integer + strictAffinity: + type: boolean + required: + - autoAllocateBlocks + - strictAffinity + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamhandles.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamhandles.crd.yaml new file mode 100755 index 0000000..06a6306 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ipamhandles.crd.yaml @@ -0,0 +1,57 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ipamhandles.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMHandle + listKind: IPAMHandleList + plural: ipamhandles + singular: ipamhandle + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMHandleSpec contains the specification for an IPAMHandle + resource. + properties: + block: + additionalProperties: + type: integer + type: object + deleted: + type: boolean + handleID: + type: string + required: + - block + - handleID + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ippools.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ippools.crd.yaml new file mode 100755 index 0000000..6b8c9d1 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/ippools.crd.yaml @@ -0,0 +1,100 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_ippools.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPPool + listKind: IPPoolList + plural: ippools + singular: ippool + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec contains the specification for an IPPool resource. + properties: + blockSize: + description: The block size to use for IP address assignments from + this pool. Defaults to 26 for IPv4 and 112 for IPv6. + type: integer + cidr: + description: The pool CIDR. + type: string + disabled: + description: When disabled is true, Calico IPAM will not assign addresses + from this pool. + type: boolean + ipip: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + properties: + enabled: + description: When enabled is true, ipip tunneling will be used + to deliver packets to destinations within this pool. + type: boolean + mode: + description: The IPIP mode. This can be one of "always" or "cross-subnet". A + mode of "always" will also use IPIP tunneling for routing to + destination IP addresses within this pool. A mode of "cross-subnet" + will only use IPIP tunneling when the destination node is on + a different subnet to the originating node. The default value + (if not specified) is "always". + type: string + type: object + ipipMode: + description: Contains configuration for IPIP tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling + is disabled). + type: string + nat-outgoing: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + type: boolean + natOutgoing: + description: When nat-outgoing is true, packets sent from Calico networked + containers in this pool to destinations outside of this pool will + be masqueraded. + type: boolean + nodeSelector: + description: Allows IPPool to allocate for a specific node by label + selector. + type: string + vxlanMode: + description: Contains configuration for VXLAN tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. VXLAN + tunneling is disabled). + type: string + required: + - cidr + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/networkpolicies.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/networkpolicies.crd.yaml new file mode 100755 index 0000000..f729b6e --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/networkpolicies.crd.yaml @@ -0,0 +1,838 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_networkpolicies.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkPolicy + listKind: NetworkPolicyList + plural: networkpolicies + singular: networkpolicy + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and another selector are defined on the same rule, then + only workload endpoints that are matched by both selectors + will be selected by the rule. \n For NetworkPolicy, an + empty NamespaceSelector implies that the Selector is limited + to selecting only workload endpoints in the same namespace + as the NetworkPolicy. \n For NetworkPolicy, `global()` + NamespaceSelector implies that the Selector is limited + to selecting only GlobalNetworkSet or HostEndpoint. \n + For GlobalNetworkPolicy, an empty NamespaceSelector implies + the Selector applies to workload endpoints across all + namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + services: + description: "Services is an optional field that contains + options for matching Kubernetes Services. If specified, + only traffic that originates from or terminates at endpoints + within the selected service(s) will be matched, and only + to/from each endpoint's port. \n Services cannot be specified + on the same rule as Selector, NotSelector, NamespaceSelector, + Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n + Only valid on egress rules." + properties: + name: + description: Name specifies the name of a Kubernetes + Service to match. + type: string + namespace: + description: Namespace specifies the namespace of the + given Service. If left empty, the rule will match + within this policy's namespace. + type: string + type: object + type: object + required: + - action + type: object + type: array + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress are present in the policy. The default + is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including + the case where there are also no Ingress rules) \n - [ PolicyTypeEgress + ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, + PolicyTypeEgress ], if there are both Ingress and Egress rules. + \n When the policy is read back again, Types will always be one + of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] + diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/networksets.crd.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/networksets.crd.yaml new file mode 100755 index 0000000..2e545a1 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/crds/networksets.crd.yaml @@ -0,0 +1,52 @@ +--- +# Source: calico/_includes/charts/calico/crds/kdd/crd.projectcalico.org_networksets.yaml + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkSet + listKind: NetworkSetList + plural: networksets + singular: networkset + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: NetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/daemonset.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/daemonset.yaml new file mode 100755 index 0000000..cefe527 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/daemonset.yaml @@ -0,0 +1,260 @@ +--- +# Source: calico/templates/calico-node.yaml +# This manifest installs the canal container, as well +# as the CNI plugins and network config on +# each master and worker node in a Kubernetes cluster. +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: {{ .Release.Name | quote }} + namespace: kube-system + labels: + k8s-app: canal +spec: + selector: + matchLabels: + k8s-app: canal + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + labels: + k8s-app: canal + spec: + nodeSelector: + kubernetes.io/os: linux + hostNetwork: true + tolerations: + # Make sure canal gets scheduled on all nodes. + - effect: NoSchedule + operator: Exists + # Mark the pod as a critical add-on for rescheduling. + - key: CriticalAddonsOnly + operator: Exists + - effect: NoExecute + operator: Exists + serviceAccountName: canal + # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force + # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. + terminationGracePeriodSeconds: 0 + priorityClassName: system-node-critical + initContainers: + # This container installs the CNI binaries + # and CNI network config file on each node. + - name: install-cni + image: {{ template "system_default_registry" . }}{{ .Values.calico.cniImage.repository }}:{{ .Values.calico.cniImage.tag }} + command: ["/opt/cni/bin/install"] + env: + # Name of the CNI config file to create. + - name: CNI_CONF_NAME + value: "10-canal.conflist" + # The CNI network config to install on each node. + - name: CNI_NETWORK_CONFIG + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: cni_network_config + # Set the hostname based on the k8s node name. + - name: KUBERNETES_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # CNI MTU Config variable + - name: CNI_MTU + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: veth_mtu + # Prevents the container from sleeping forever. + - name: SLEEP + value: "false" + volumeMounts: + - mountPath: /host/opt/cni/bin + name: cni-bin-dir + - mountPath: /host/etc/cni/net.d + name: cni-net-dir + securityContext: + privileged: true + # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes + # to communicate with Felix over the Policy Sync API. + - name: flexvol-driver + image: {{ template "system_default_registry" . }}{{ .Values.calico.flexvolImage.repository }}:{{ .Values.calico.flexvolImage.tag }} + command: ['/usr/local/bin/flexvol.sh', '-s', '/usr/local/bin/flexvol', '-i', 'flexvoldriver'] + volumeMounts: + - name: flexvol-driver-host + mountPath: /host/driver + securityContext: + privileged: true + containers: + # Runs canal container on each Kubernetes node. This + # container programs network policy and routes on each + # host. + - name: calico-node + command: + - "start_runit" + image: {{ template "system_default_registry" . }}{{ .Values.calico.nodeImage.repository }}:{{ .Values.calico.nodeImage.tag }} + env: + # Use Kubernetes API as the backing datastore. + - name: DATASTORE_TYPE + value: {{ .Values.calico.datastoreType | quote }} + # Configure route aggregation based on pod CIDR. + - name: USE_POD_CIDR + value: {{ .Values.calico.usePodCIDR | quote }} + # Wait for the datastore. + - name: WAIT_FOR_DATASTORE + value: {{ .Values.calico.waitForDatastore | quote }} + # Set based on the k8s node name. + - name: NODENAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # Don't enable BGP. + - name: CALICO_NETWORKING_BACKEND + value: {{ .Values.calico.networkingBackend | quote }} + # Cluster type to identify the deployment type + - name: CLUSTER_TYPE + value: {{ .Values.calico.clusterType | quote}} + # Period, in seconds, at which felix re-applies all iptables state + - name: FELIX_IPTABLESREFRESHINTERVAL + value: {{ .Values.calico.felixIptablesRefreshInterval | quote}} + - name: FELIX_IPTABLESBACKEND + value: {{ .Values.calico.felixIptablesBackend | quote}} + # No IP address needed. + - name: IP + value: "" + # The default IPv4 pool to create on startup if none exists. Pod IPs will be + # chosen from this range. Changing this value after installation will have + # no effect. This should fall within `--cluster-cidr`. + # - name: CALICO_IPV4POOL_CIDR + # value: "192.168.0.0/16" + # Disable file logging so `kubectl logs` works. + - name: CALICO_DISABLE_FILE_LOGGING + value: "true" + # Set Felix endpoint to host default action to ACCEPT. + - name: FELIX_DEFAULTENDPOINTTOHOSTACTION + value: {{ .Values.calico.felixDefaultEndpointToHostAction | quote }} + # Disable IPv6 on Kubernetes. + - name: FELIX_IPV6SUPPORT + value: {{ .Values.calico.felixIpv6Support | quote }} + # Set Felix logging to "info" + - name: FELIX_LOGSEVERITYSCREEN + value: {{ .Values.calico.felixLogSeverityScreen | quote }} + - name: FELIX_HEALTHENABLED + value: {{ .Values.calico.felixHealthEnabled | quote }} + # enable promentheus metrics + - name: FELIX_PROMETHEUSMETRICSENABLED + value: {{ .Values.calico.felixPrometheusMetricsEnabled | quote }} + - name: FELIX_XDPENABLED + value: {{ .Values.calico.felixXDPEnabled | quote }} + - name: FELIX_FAILSAFEINBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeInboundHostPorts | quote }} + - name: FELIX_FAILSAFEOUTBOUNDHOSTPORTS + value: {{ .Values.calico.felixFailsafeOutboundHostPorts | quote }} + securityContext: + privileged: true + resources: + requests: + cpu: 250m + livenessProbe: + exec: + command: + - /bin/calico-node + - -felix-live + periodSeconds: 10 + initialDelaySeconds: 10 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: 9099 + host: localhost + periodSeconds: 10 + volumeMounts: + - mountPath: /lib/modules + name: lib-modules + readOnly: true + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - mountPath: /var/run/calico + name: var-run-calico + readOnly: false + - mountPath: /var/lib/calico + name: var-lib-calico + readOnly: false + - name: policysync + mountPath: /var/run/nodeagent + # This container runs flannel using the kube-subnet-mgr backend + # for allocating subnets. + - name: kube-flannel + image: {{ template "system_default_registry" . }}{{ .Values.flannel.image.repository }}:{{ .Values.flannel.image.tag }} + command: + - "/opt/bin/flanneld" + {{- range .Values.flannel.args }} + - {{ . | quote }} + {{- end }} + securityContext: + privileged: true + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: FLANNELD_IFACE + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: canal_iface + - name: FLANNELD_IP_MASQ + valueFrom: + configMapKeyRef: + name: {{ .Release.Name }}-config + key: masquerade + volumeMounts: + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - name: flannel-cfg + mountPath: /etc/kube-flannel/ + volumes: + # Used by canal. + - name: lib-modules + hostPath: + path: /lib/modules + - name: var-run-calico + hostPath: + path: /var/run/calico + - name: var-lib-calico + hostPath: + path: /var/lib/calico + - name: xtables-lock + hostPath: + path: /run/xtables.lock + type: FileOrCreate + # Used by flannel. + - name: flannel-cfg + configMap: + name: {{ .Release.Name }}-config + # Used to install CNI. + - name: cni-bin-dir + hostPath: + path: /opt/cni/bin + - name: cni-net-dir + hostPath: + path: /etc/cni/net.d + # Used to create per-pod Unix Domain Sockets + - name: policysync + hostPath: + type: DirectoryOrCreate + path: /var/run/nodeagent + # Used to install Flex Volume Driver + - name: flexvol-driver-host + hostPath: + type: DirectoryOrCreate + path: {{ .Values.calico.flexVolumePluginDir }}/nodeagent~uds diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/rbac.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/rbac.yaml new file mode 100755 index 0000000..2936532 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/rbac.yaml @@ -0,0 +1,170 @@ +--- +# Source: calico/templates/calico-node-rbac.yaml +# Include a clusterrole for the calico-node DaemonSet, +# and bind it to the calico-node serviceaccount. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: calico-node +rules: + # The CNI plugin needs to get pods, nodes, and namespaces. + - apiGroups: [""] + resources: + - pods + - nodes + - namespaces + verbs: + - get + # EndpointSlices are used for Service-based network policy rule + # enforcement. + - apiGroups: ["discovery.k8s.io"] + resources: + - endpointslices + verbs: + - watch + - list + - apiGroups: [""] + resources: + - endpoints + - services + verbs: + # Used to discover service IPs for advertisement. + - watch + - list + # Used to discover Typhas. + - get + # Pod CIDR auto-detection on kubeadm needs access to config maps. + - apiGroups: [""] + resources: + - configmaps + verbs: + - get + - apiGroups: [""] + resources: + - nodes/status + verbs: + # Needed for clearing NodeNetworkUnavailable flag. + - patch + # Calico stores some configuration information in node annotations. + - update + # Watch for changes to Kubernetes NetworkPolicies. + - apiGroups: ["networking.k8s.io"] + resources: + - networkpolicies + verbs: + - watch + - list + # Used by Calico for policy information. + - apiGroups: [""] + resources: + - pods + - namespaces + - serviceaccounts + verbs: + - list + - watch + # The CNI plugin patches pods/status. + - apiGroups: [""] + resources: + - pods/status + verbs: + - patch + # Calico monitors various CRDs for config. + - apiGroups: ["crd.projectcalico.org"] + resources: + - globalfelixconfigs + - felixconfigurations + - bgppeers + - globalbgpconfigs + - bgpconfigurations + - ippools + - ipamblocks + - globalnetworkpolicies + - globalnetworksets + - networkpolicies + - networksets + - clusterinformations + - hostendpoints + - blockaffinities + verbs: + - get + - list + - watch + # Calico must create and update some CRDs on startup. + - apiGroups: ["crd.projectcalico.org"] + resources: + - ippools + - felixconfigurations + - clusterinformations + verbs: + - create + - update + # Calico stores some configuration information on the node. + - apiGroups: [""] + resources: + - nodes + verbs: + - get + - list + - watch + # These permissions are only required for upgrade from v2.6, and can + # be removed after upgrade or on fresh installations. + - apiGroups: ["crd.projectcalico.org"] + resources: + - bgpconfigurations + - bgppeers + verbs: + - create + - update + +--- +# Flannel ClusterRole +# Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: flannel +rules: + - apiGroups: [""] + resources: + - pods + verbs: + - get + - apiGroups: [""] + resources: + - nodes + verbs: + - list + - watch + - apiGroups: [""] + resources: + - nodes/status + verbs: + - patch +--- +# Bind the flannel ClusterRole to the canal ServiceAccount. +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: canal-flannel +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flannel +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: canal-calico +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-node +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/serviceaccount.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/serviceaccount.yaml new file mode 100755 index 0000000..582d55b --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/templates/serviceaccount.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: canal + namespace: kube-system diff --git a/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/values.yaml b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/values.yaml new file mode 100755 index 0000000..ebea683 --- /dev/null +++ b/charts/rke2-canal/rke2-canal/v3.21.2-build2022011907/values.yaml @@ -0,0 +1,82 @@ +--- + +# The IPv4 cidr pool to create on startup if none exists. Pod IPs will be +# chosen from this range. +podCidr: "10.42.0.0/16" + +flannel: + # kube-flannel image + image: + repository: rancher/hardened-flannel + tag: v0.16.1-build20220119 + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + iface: "" + # kube-flannel command arguments + args: + - "--ip-masq" + - "--kube-subnet-mgr" + # Backend for kube-flannel. Backend should not be changed + # at runtime. + backend: "vxlan" + +calico: + # CNI installation image. + cniImage: + repository: rancher/hardened-calico + tag: v3.21.2-build20220119 + # Canal node image. + nodeImage: + repository: rancher/hardened-calico + tag: v3.21.2-build20220119 + # Flexvol Image. + flexvolImage: + repository: rancher/hardened-calico + tag: v3.21.2-build20220119 + # Datastore type for canal. It can be either kuberentes or etcd. + datastoreType: kubernetes + # Wait for datastore to initialize. + waitForDatastore: true + # Configure route aggregation based on pod CIDR. + usePodCIDR: true + # Disable BGP routing. + networkingBackend: none + # Cluster type to identify the deployment type. + clusterType: "k8s,canal" + # Disable file logging so `kubectl logs` works. + disableFileLogging: true + # Disable IPv6 on Kubernetes. + felixIpv6Support: false + # Period, in seconds, at which felix re-applies all iptables state + felixIptablesRefreshInterval: 60 + # iptables backend to use for felix, defaults to auto but can also be set to nft or legacy + felixIptablesBackend: auto + # Set Felix logging to "info". + felixLogSeverityScreen: info + # Enable felix healthcheck. + felixHealthEnabled: true + # Enable prometheus metrics + felixPrometheusMetricsEnabled: true + # Disable XDP Acceleration as we do not support it with our ubi7 base image + felixXDPEnabled: false + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: true + # Set Felix endpoint to host default action to ACCEPT. + felixDefaultEndpointToHostAction: ACCEPT + # Configure the MTU to use. + vethuMTU: 1450 + # Typha is disabled. + typhaServiceName: none + # Kubelet flex-volume-plugin-dir + flexVolumePluginDir: /var/lib/kubelet/volumeplugins + # calico inbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeInboundHostPorts: "" + # calico outbound failsafe ports. Empty string means defaults. Use 'none' to disable failsafe if you have your own rules. + felixFailsafeOutboundHostPorts: "" + +global: + systemDefaultRegistry: "" + clusterCIDRv4: "" + clusterCIDRv6: "" diff --git a/index.yaml b/index.yaml index d26d9e8..e43d6e6 100755 --- a/index.yaml +++ b/index.yaml @@ -434,6 +434,23 @@ entries: - assets/rke2-calico/rke2-calico-crd-v1.0.001.tgz version: v1.0.001 rke2-canal: + - apiVersion: v1 + appVersion: v3.21.2 + created: "2022-01-19T09:16:55.80007309Z" + description: Install Canal Network Plugin. + digest: 3f3803d57b711ef9bee7135d1e5ca9c31ab74937f79b8f8c5bfa52da6f587522 + home: https://www.projectcalico.org/ + keywords: + - canal + maintainers: + - email: charts@rancher.com + name: Rancher Labs + name: rke2-canal + sources: + - https://github.com/rancher/rke2-charts + urls: + - assets/rke2-canal/rke2-canal-v3.21.2-build2022011907.tgz + version: v3.21.2-build2022011907 - apiVersion: v1 appVersion: v3.20.3 created: "2022-01-14T18:03:06.403443347Z"