From f5de5bbc49c97a7de94ef5691b1601bf18e76602 Mon Sep 17 00:00:00 2001 From: actions Date: Mon, 23 Aug 2021 15:25:01 +0000 Subject: [PATCH] Merge pull request #136 from manuelbuil/checksum-off Pass featureDetectOverride --- .../rke2-calico/rke2-calico-crd-v1.0.103.tgz | Bin 0 -> 36052 bytes .../rke2-calico/rke2-calico-v3.19.2-203.tgz | Bin 0 -> 4855 bytes .../rke2-calico-crd/v1.0.103/Chart.yaml | 5 + ...d.projectcalico.org_bgpconfigurations.yaml | 141 ++ .../kdd/crd.projectcalico.org_bgppeers.yaml | 106 ++ ...crd.projectcalico.org_blockaffinities.yaml | 59 + ...projectcalico.org_clusterinformations.yaml | 62 + ...projectcalico.org_felixconfigurations.yaml | 561 ++++++++ ...ojectcalico.org_globalnetworkpolicies.yaml | 769 ++++++++++ ...d.projectcalico.org_globalnetworksets.yaml | 51 + .../crd.projectcalico.org_hostendpoints.yaml | 106 ++ .../kdd/crd.projectcalico.org_ipamblocks.yaml | 79 ++ .../crd.projectcalico.org_ipamconfigs.yaml | 54 + .../crd.projectcalico.org_ipamhandles.yaml | 54 + .../kdd/crd.projectcalico.org_ippools.yaml | 97 ++ ...ico.org_kubecontrollersconfigurations.yaml | 230 +++ ...crd.projectcalico.org_networkpolicies.yaml | 750 ++++++++++ .../crd.projectcalico.org_networksets.yaml | 49 + .../operator.tigera.io_imagesets_crd.yaml | 75 + .../operator.tigera.io_installations_crd.yaml | 1242 +++++++++++++++++ ...operator.tigera.io_tigerastatuses_crd.yaml | 104 ++ .../rke2-calico/v3.19.2-203/Chart.yaml | 7 + .../v3.19.2-203/templates/_helpers.tpl | 10 + .../templates/certs/certs-node.yaml | 13 + .../templates/certs/certs-typha.yaml | 23 + .../templates/crs/custom-resources.yaml | 24 + .../v3.19.2-203/templates/felixconfig.yaml | 6 + .../v3.19.2-203/templates/ipamconfig.yaml | 7 + .../00-namespace-tigera-operator.yaml | 13 + .../tigera-operator/01-imagepullsecret.yaml | 15 + .../02-configmap-calico-resources.yaml | 27 + .../02-podsecuritypolicy-tigera-operator.yaml | 47 + .../02-role-tigera-operator.yaml | 253 ++++ .../02-rolebinding-tigera-operator.yaml | 12 + .../02-serviceaccount-tigera-operator.yaml | 5 + .../tigera-operator/02-tigera-operator.yaml | 85 ++ .../templates/validate-install-crd.yaml | 31 + .../rke2-calico/v3.19.2-203/values.yaml | 53 + index.yaml | 20 + 39 files changed, 5245 insertions(+) create mode 100755 assets/rke2-calico/rke2-calico-crd-v1.0.103.tgz create mode 100755 assets/rke2-calico/rke2-calico-v3.19.2-203.tgz create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_bgpconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_bgppeers.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ippools.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_networksets.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_imagesets_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_installations_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_tigerastatuses_crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/Chart.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/_helpers.tpl create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/certs/certs-node.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/certs/certs-typha.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/crs/custom-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/felixconfig.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/ipamconfig.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/00-namespace-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/01-imagepullsecret.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-configmap-calico-resources.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-role-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-rolebinding-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-tigera-operator.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/templates/validate-install-crd.yaml create mode 100755 charts/rke2-calico/rke2-calico/v3.19.2-203/values.yaml diff --git a/assets/rke2-calico/rke2-calico-crd-v1.0.103.tgz b/assets/rke2-calico/rke2-calico-crd-v1.0.103.tgz new file mode 100755 index 0000000000000000000000000000000000000000..6a559ae631669d04c5d92ca72525616893e42d88 GIT binary patch literal 36052 zcmZ6yV~{4n5-vQpjUC&zt#@pDX2-T|+qQRX+t?l3JGSS&d(L-Hd=WQ)RCi})MQ1$` z-Bp#94^a#Z2FQN|NCQG=EUm(9DlN|m@Z#YxVbfqXQ{}MIQRU%O)X?CR*R-`Zwm0)q zQ+5!LHn+6{x%{&6z~}l!jd1GX4=MSfPxjG6>ej?Sl`Y^!DB;YiV>->B?#yGuP6gF1 zf+i(j2raB?GPeW#(yj!1mwXIMzLc@(5+cXKkCQ7>s`RPSb!U(MIYh=2t=1FJRyY;A z>YC+yXEs0hPwu8OZh;{oA@4wBBts%!r`P-2+r6il!_|lg!yiBT_&uFoA$dHzXxN3a zIMw`|ZqJ(j#(d=QvmXnwmUUuKnYq21&$yO)TJPP!7a_`{$q=F=tS)9&qK~`B+k$KIy*gue7l5z1=#T5IE{|xCw|z`Iy0)uf zb*G{7kXa0JDATJ0*o>p~sR?<=)KGX@H+d*E0qgdW1{3sASHT(p++r>A(_mosOI=hF zGc^i{>O~6taB3l}_9D5dPiS-|{dqREg%n8^^%J!GV`fiEG%BOTeJFjb%+uuecP@Uy zPLduY+u*GCE|}h(l||{&2a9f#nc>4*WcANM#27&NnxOm}OgSS;UB+DiwFmK|y?MPS zv~@{GW`+UCciUy4gwYU3(Y30c1nAF?l(4x7F3r^uWW*fh2*H8gS0!v+BhazYSemVo ztYo>flql{rJ)Dt_P&Q@g{<(5F`^!Ecnd!z_FJ1~8Z793hlyv&oN~0%$5rU^gEd}e$1m_PTgm2;#AQ0tTZwXQK)H=*R3Zz0N`Ibd%4|L?kN?}>+q0W) zd@w?H*Fgqq9Ng!|Ru7d5BlgWzZ*%PGfO^AY%siPE5&^r_lPC&+Kx`MdP^08d;pBz>3Y(%GqP| z?Hbw?u4OfBIt|COtN;n{V_p6e7~l^E`~rSyzA?RQ4kwlb)u$V(l$~`w&k?#)QmR0n zsX!L(oFEEJ%3bxNo}{al%HrWpj<^u6xxoC0M*)L&eto})!;4C1zBs%9wy%YyspZweI3%vhUd@jn}0VZz>lgtC2kl`|h*GD*zk<~;S zeBQ|leR?L<9>Uq_ZTkb{&0*cyr$TR94!79@z_bIyE3dWHT0FfVCC*lIC72DVYL-p` z>uOJB10>Q)*uJ7zhKENE&r8KNRU5;@W=mr=ZkZb@kDh(~va;1yuU}ufS0;$bf)J#! zhxVawQWc$+2dl9%Mwh;Ur)AFRG4-+0Fu=$F+*S^^S}l^BCsEL_@N{znZxc6Z51ay% zU;(>GAcv%c*kA9%{N|&02hfIwbpV;4Iuw7%i-+ch*r;N`yRbYU8-K(d* zWjcxo>JX|V$e9k*twqETQ@gbqR555;Zk8=Om$m8V#p$;hR@G@*KCtUHtUTv5cQ5a7 zSszZ0RG{N;)=S*q;;XZ@9-z9w#m2~BlXO?NLsJJ*uH{czk(TIE@gJPKf`>}uK8yHL zvCEhpk&kMNC_Yc%{`8w5P)t71+hhruh*Di6Q%m8q=wB$rq)BiepAClJ9KJ6iZ$XN1 zxT>V++=%|GH-oPCCyyeg&&tsU{!D=5{F6O5bMp_^OQqL&9CsP=P$n7Xn+>PAEHip( zVm;9T-!FV#M!#Q+AYA-1krYQ9ua*uu30G)d6rg%7Fc_0 ztE+y^5idHcPX_tQ$hJb>)&#-`;o~{HBx!tWRsqI#0>j8o6W$d!g5QFCChDM%%tzIO z#~$HEg9)7eEz%PvX5V+vWSDtuFYwo0d7N>i>3CR%f9w$X_%N42KXGMHL$1UM68pct z%as9f*-vvo-kSUw2HszX96pfbfV;w^7?3nvnZ3ofucP|HbTRM57SZTGV{SJLM z^Ve?OdyT?$26aE^^VZGE2<`d1&FTFbUUT8I^?vz0U}w1lE(AVz^Q}J^0J2?3kwz~T zB&w{3^ih-B!LXKy7fP7m^ih!Iqt@URCgaYkeCEGNFTv%s%(QHUU|g-c7dlnA#AFIC z*St{qSon^Gu22|TjM>|S8FsAFXTDn=X0o^npuMGQfoYa z%%1S&;QubiZEL;`LTlvqN%HJn+*n4b_!|i29+nPIWg#L~ZB!psWIczVV;|%QVxI)> zf$az{CC1Jsoeufz3yF`SHteLY(Sy_dv4EZlxD*+jUDgN=>}!drTy9_=tXZVrqgti` zHEGt{jSbOVc>S;u(X0&w!+u~P5n|BtOE6ME;swd_Jw!e3#Y|>UZQilwq51u;P|Y|D zl`oi0thCMb*0r_8k;OKM!C+^<*0w0xCtcxNu3eh>MyDHK)ZCbgwFcpXzVnNN8ND7l z0V1%yD%NAsqD~brTlJ*}Cb8A6xy$uXx)YYfFNg;BJQ34=nT6!W(G>rKJanTbZ@e!; z7i%p5_^7njmbJ?jtDlb70ZGki8V!ryQ|{nG5!PE}ifiQ~qf4WHGmWWAH+TJfQ`&WG zBG`3k!7>D|b~7A*36$zS4@$gvIlWPwu=;@xD;Wc5)=uBsUpPct?Sjr-CY<#A1lr;) zv<0TPLKjoj)&~mLxsVk?u47(js_iiuCmFAIZq9Wru{4ni}J>#x>LF_&* z*g_cUY&f!myx53I?llU-# zb|>=NnJ_6k5&}NvV_$jzQMrNDYftx4XsJi zA^82b2tXWBSSGg%%ITBR+rat{*l~rMFE?Zrz(rJG)#|S|ju|KUPPj3x9e*MH+}tKg zxAWU`t6Wpb{?w?w#L)|u=aPOy%LVaPCkY?#bEhe;KrC4#EkzxHj|F6PngY0qLL+&_ zdanddL8hB`nuTYyNB91KSsa1i;%3P&^OVV4&qK>vSj$?P(Lsn) z4l&fhgKrPPTOzHbnJ9wJwyb!)l11Q6nV1LLVt(P6y)0bO%Y+YnP@9s4`4qNfBkspRb|>d!dX$-btckxfHw**R zx=u(BCObny&n&hv<~&SW({l>A<<%-;!z1dPu@NxhwEcrW80ZmB?Bi8wt_u~&_zish ztsDmo_&PX_3Hr}ysP=(knRhL$fiF#rl9jMvIf$I4K?C$QXoD6p^NFxVE+?&eAanf! z?Y0@^T&18m>AvSVKhC=Y zBWbkEz~eu_OPmG{i)fG4@pOrWcfz^Btqb4u0?%jxiwxTLUOaj7b|z?j#ZfUIie-V) zpm`GTbg6#hX#O|0vYmD>@y@8Hm5+te&45qV<=z%`w{S+{(mTa3MJOG z{V@86(JSyDMxVfc7!3f)D0XOZaeP^Czrk+|!@dVT0-$yRQWjh(K!?G<8`+IyNN*S^ zu~T5)?)-V4Ap`25O> zUF_zt=)10hhcVgaYOFBW>^eY3en>p)l0x!)ok#cZ@J)qaK4#|fVsSA)sB_F?j|tu6 zPRm(g>CJdNPsC3@G>esz@}24(8eYMk-y?w)8jq{Zyln+C`x!)6LPjP3`(8vDja1zXM2|ZjR;Pjo092I7L z3c8UejK8iKpejUj#A?}^cOc>5p3}Cng_9y(s4!vINhQ12-vPNwK0xgQr0MYplAFW1 z(vyP4%9``DI6@J=~M)Xn^xHK zv|)iJl4P7txN93phntfgPfUq2N(hRGjTWYi=dC1MfQd-F~u_uF%rsh`! zB-ov3qt23}CJ!8`13>y^T=`@rn4mODlZE@Z@xxPH?HPu65@+DQ7&Q5f9}L*3Z+{c+ zvlXb?&6mKlc~UxDP0EjHSA8)pyFSP8=@eavG`N{1-@nlXAQC=1TPQD-Afj)CVXCNF z;h*s@r;o-ZQb|yx4Hs_f$EBu}ceK}|VsFTjCJLucbSoiDoH#XZj_buI6a%F!a&yX? zzcWVh`$s&wtS6lYPX518Hl_ zmvNI)xAn3=KV)(a-&8rr-HS~!JLN?Wrr^UlW=o^QxH||nz|m*PlQmAr?B?#EgnA!X zv_>Uj)e*{pTAli=iNau3)zo!3vw<*fygev~E7=B|fI6HIfqG)QP!5 zM|91RsD_?8uLoxWcAtejEtaNNuQtmQB@_G00}Z4+LPu1@Cy60m9IN`KtJT$ zTS5<6Ru^fz+<*H<>VRKb{w&sTlm98qDt|g-;HEmwxQWj!H>pBfx{g`xSlM0<<8b`R zpxY#TdpBnAT8`-{=6?*~|GfSw$8Y?4dHTy6^ob&Q`$d7`-k)=Gos19Lgwo?#3De|w zK2H*tKgne#Vmy5-^Ps+|1V@5QQYHVFfJ0tu4~JtV^%GOZzF7s4y!e_x41J*z*teDi z?asVK0FeWvBX=hDfac3S)m-&#jw=p4jl;C4R3FU*8MwHXKwMF7avYm zmmi|DHpY=*WQBq%<-sgc`4Ud&42VY^#P2eN`j@)bpynP(zIO+W3uQKWQ=w8eJ(T6OEi+)CsFj;}Z=W-HbbWBhDFn1;b8ud$SiFVW>O{YorC zd07#)lP_-9K@SUkMyCAJ&I~}(RvyUjzKhBNt^ggu=fdJ9?%H9z3Oz$p-MKO$nwEt| zj4^ucNbRkk=`#~-yzt$epfry9OdZRPM*=KI_Nc}M36t#?{G|9!JPRdqns{pOrveuX z(VGCV;O3EL$R|nB|ZYKX>r7H+9?h%HZhpGz6jeAm?IKwqmL9 zM)mzM#-eXn2uJpG%aLOBq4;%$_VoGzs&=n8Gp{WQex1UQvVK;qjAfq} zx$L1om3iK-=kZ40N7F9!FD+rzUzPsrSO0bJ-vtjrG!;(|e(Ch3pMBa(t-BOz$j4j= zKhanu@aU>aw>BLOTrDSCA=qhIm+ex@x;Va6UD9uHkE4#0m`2nrNZWb_#H;66>AH70 zd^I6&kxx^;E}CI!5ydXBv_?m8v1I?k_3(=QA?YZ3@Znpi!U&}sb)6F4Ri4sF7qKD? z0QW53ySHEe@TTxOLn=~+cmvbYLUhAYCB~^7{u&NwpDOilA}|uCro=#gRt9s*VuE8J=%uB{{N;Mn)rg~P1Y-1p z3fDO4)2Z@{#xOP!jQvBxiQiSj5zoI4d*`QF)8QwRWlFR>m8@cXyr{(sy@FzV|3(N_ zL__~rz>i+)@2B6O-xsgP)7aOBOaKnY`rOfvQY0r;HT(qd)@#xQwN6%zP+D(?xAJ-OwL!S&9KO0c?aHd0 zt;&MdWLaBXnZZ;kH*62gyq$OZ%V@G$S)KIgvU`erGG$5NRiA)T6ZRX)qHYm7@Y*&@nlIwS)3CwC$S7W>LSuKr%?RLh$v z`wK`szj~lkzkb7i0)@+=S+_;YaXGR~PG=e?dJI|0JS(n0x)->-MlzE2c1wGVx8hJn zIEHia&ZIOkG}CIHoJ6Q~Kq4(@MtgjOfkBkfiPv!V?|%h`uFqNJ*9s=)ejlGdd1xos z3MrvZ9~Z<;t?hI#*8sJ@QMaU@1(_pFx~5bL;T_CfKTd_S?GBnFB{V=^X^I(J0RS~SjnVd(iuiIr2!Kq1@lw_v*o+1LXKF{@>}@#4{xDA&*its zi)qj9;a6?wN3ZKi@JOHwrq&TwcvO;bR@MvG$KONJqk+DHgEp+C46YW679IsrnWJIb zgDS>2^y<#$Nw!l6mC0~Y)3@{z_09M~OF=&ef0|_5gt-S;du7*QfW2yWblKuJP5C|V zY)Q%dvHRUs*(#L}Ket!u4s~1`F>f-en9?aIQqYDa~r#o&)Qhq%bUa0WO&I22Ln^K39 z`V;Q<>bfgwS_ec4HizZh&)Qkg`{ zzU}OxXxgD_5%U2kT zWF$#}HJVWGD1XJGY)E8#4u9MYOqXo0C5-6;-HEZj&?~&zib+SH|k01po@ zjTQy9Rd>N-m3h`0_TXm$h#(lIyoe+i)c(BJFY%Ei*yQY|p}m#r6gOIMsU zpcCsfn#w1WH4z-{q98A`xa;x7ysQCS?(%gG%)J{|S_SbbJ5RkY2Zkem{RxyallQF-rNDp_7pvTwYUv`O;e?L>HP0uGcoXRCYP1IfvBJ&STzT5eMFZyZwN4 zYbkoUg`3|;zKq8i*=w^%KxEF!u)1eOnI_elhAjxzD6c`bsz+u5ugW(hD}itPTrF7A zb*`TuL4QY?&RZZIslVj!Gr{k?CNb>RXTt6D=UsD|^|Yn~5zNogBRr=;cd_zxZxhg} z8qz2fFDJ9zM9A(6mYCOM%D%3M(HsQwqkpK}t9u8)!kuYMXIJ9lW9% zJolB<;lA!!ZpyjESG};v5O?xI4=?Ssu{|KZsx;Br56>8e${G&MIA0UC!k3R=9O_TB zE>md};(9_aaD=w<&XwSQ%#!UJmvKoDI>T4>ff}ntj9s*TdyY=zxYyfp;9G#fuV>|*@J<)RtJ{=6A(R< zhIDJsh}IaNQ)|j=@yn4f`d$#HeHe7U&f|RRxAzsnVvTaEhlQ%^AL1$$$b-CEVq{Im za7r@0-${m9>6l{!#(PahE`2d0>d|$3%Z(upy8$;*PU=Fqlc>C^ z4!zO;Jp*gq4kfgq;bLl#?%svXlTEz4R8ODq((E(`3jBqOme7yP^1aomCmq$YEFIf? zhgNJQv@^-ds?eS7N;&GQYw`c(R_k^?lO%UuOdIwH4NqNW^SgXx)Bj7(8##KO?%T#R zD~6foaeZFlP$?*xc55eX!@DxgCY}~;n&KF&jw9~QC6PnDGZ29m26N*Vn@}Gaa3b>n zf$c^-YUThHd+W$0RNT3;8?c`o<3dU4BpC0n<=Kc{69JUu~ zBmthhkH7&b!5{&74Ek`GA!$4gg)=BZdBBGeRL&lFrH1}y>y)wxPm-Hq&2v0d*5?Sx zFpde~GiC{ryRGk&>h4i+llEyeWXlf10=-X|{fv~*Pe|13&EpOfdV}M>zgMC=?8>!Iq#AV}M-ClIDwNGlz3V0?i&%hJYq2Wcig*(~x5cyMQAG9T`X zve1(bu{=-mK@=UYC#g-5&ucCdW~NvUS3-WIhBzBt#GLcq2}Rf^8fd7bztTvHW~~F-m-@Im3!6LX5HEeP*>(q~R$q7vgsn12P7wTE z&@$#;Mn&61#Nu|+F^Ypw8BEqzw?NPqV>0Mr?BJ$AYeT@Xb30rzsEwH~RXn-6Q3fUHPaiBB(uj?1qKgm!W&@>!BPS~x%O z8sSB`pGWT^h_n9te^Hv*lP)OG2eS`^PkQO>u8UE{Ag)ArK*5B&M1Op&2aD)z>J6HO zos$f~be&aepk9vv5uc=BgHJ!dIp(v#Nbt5G z-^gS4KZo>|@5@Nvgv{AQ%Yo=@Bo`4fzA3h3sXW`Ek_LbIB+Yk6j>@wj0kESH2yM3} zyz_c=ENYQj`pb%oU{J=qH0rCPSZUa+raxgbowV|)GS@VG7-T~5M!^!%G)QFCvP6slOSHdf%Ir-SDiRf`i# zBVEroaaon=`XZzu$GnjlTb15ExI7|))bjQrnBJ4AEQm6dXf)k<)Hjh+{LupzQK(Z- zJTq&y0z;4Gl;kw{!Owdg)8-Z?i&X>m`Gsp^%{)&sYQU0dV4>mjgckP$Z)j>jC}_;d zO+x}9PccqoDs7K+3K#L&Yuu62zR90AX^wzPx^euZ>;$n7FIYe-oc~b=6_I zkBf{<3f8b`iwsj7rxd!R+mX-|8V|akHg3}$7K^Qo9V!6E_rcL}j=yQ*Io#-1p$NgP z7~){&?g+l$znYE+P(1YH$6zK-h9j`XT51QWY_`X&yQrTbIEE{^MKaW^%A3L$CamBcUC@oF>P#QRPG6jvE=QM_~1 z@y;VqOyQS^*~J_(zKn$i(3jQpNO`KO-Za)cqwHS7spx{lRuOoO$Jjl z6>*P!JS29ktlP&U>)F65z3@8g(N-2Oy3_0}Wr~hWU4sELSqQh{We&=_u$8(UFtupI zU;u23N)zk+b>kG;AjW7aTu>jj8d>uX7lKJlmv=gJdfjLmR<`Z1aAXwBYJ3lpj(v73 zX|dmJKF3ToRpx#NJ8OM#(Fkl=hVydX(+hj1A9Zglwv*f|8GjO_YM7>-tkNj#Zja+= z_4E`2cR&BW9)n|r)&qknPrvR1I9Dio6@Rj|o`3$5dd0*De~%kA9NcP8hzXzf@99~) zuHma+<1eATmVpbXZruf-<+f9A&np_gweDjaB?1rg2?Y3D>vdT=e3!3kMnW17D~>u{t(8uX3)#sVs~b(j4Xd9wLAR{X%|z5SkhO z#i^@o?C|tqG6kwZv^)uVw2s$L@+^J5wtzg14l}&UQG^=FM$lgn`E9@fs@=Zk<@Kd@ z?W<*;>~BB`bjE`gNC=JPAlzQvQ$Mod4+4VT%2lACptryZ@cZAPUlovGEViN!uk0MfU4_I)`Ol<2QJvRijV*EWOh?Zm&Mu z+ee?ZBelqm+fYnPNKYq?3c*ENEyO9D6YM=hU!N8TEfH zq)%7yhYmtlG(;P9(7;|Z6px+uPgxXXMVJf+fpD%xx6GY3E`ewVt{J1-HK?j&?pf1z zxk**{Ts9bjesj|^mRZs`8nQwxiNnv9feA3fI6(+vAPeKV7p7!1emVE3o=Mp&+(gR> z@yUW;4EbFeFFb^`vWtAvp3ODLd z`6YLB$eiJst+4)6(lg(d(b>5&b}l|s=WKFD{_-uSMpezC74^<3wi%US4swi9X_Iy+ z!$mKEf<9p%vl1wN)h*6>vCNh=!%riU=Y-_w0+ZdiJ&4Q*sN$g2A|o$YO-1ZpV9jBPhDN`okQfHT+m>BP>H{JbGBdp+cT1J`H8Mub#PAhr>g zb9BE;&E@EE>KZ`>OdqvsDKc@V;=mO;@5)HfCa)8ktpz^zZHk02T|qX$2h6cLQ}|Bm z$BE}shIh5(Vx!GbOv)9`zN{F4KCe!RX3t>>?w19Kqdu%ZB;>@rz}sHAcaLgP9M%+m zSlmfVe3QBvG%)P;1$ye+n%E@7+0-(EYI7OYw2v6z(NqO_(Gd&~@6Us-NesbCPPL$n zd9R?la9{;L&cX#s-c7KlIWrIj_zceRyoquqwdaPmmdK^`V1o8esEetPx^ibfV4`by zw%9m`T}h@luv-)1v{T4a6OzmxYvcr7Jw%q!HXmX8;4-#q@HYnZ(@?XofY9Xg;@oc# zF*s(jbI)NRg9Yn}U^xi`s9Dd@|Jt|)xJytHt1osnwMgHs-2cw8HfiZO17#J7C)I^5 zCfGq^qR~A5vJH+p3E(b(a9RAQ7+2u5Af?H_&Lz*W<5MnSQ% zCl8JH-1SXB8GOufgMChq2UMA89D{`NZNdgBnBuuXLWKKg1hBWc#E?!Bmq ztw@rBu$E+ub-P|uJ|9ZZy;2jY*HP}1$rSh3Zw79C6wGA&elq5UZ$VrY3PxL<&f&e4*4{*5_-| zgn1?95D1OteqTIaZ_ZqZei{ zzBZ^pb@?obMkgfzg_kLzp1CDP0o4>W7f{(Y0Bq#TPfGD(%&wMz07x1u~`u9ku)0r>_EEn_?4==+&7Y!$Z#yO25(Ve~aW*1{3V z!1ZO5Ob9-RClPlF*q`(f>(ioXm#{)}olRtKrt8>8O@ze!OQiG3`@~uF-;+DuKqrKy!Yk0oHOumQ(@v*;ksNmGX`u- z=RRdzT*w%=ShW~y*EY)IS6umN5}Nkuur?<;0Y8oj+5(n*AT{B~2N^n#(oMTZ%x*Ml zuP@PkFHA2-=AUr!=f{sexK@44?uVZUjVbYjsBZM$THK#^-HcJ6z9RIeiDw2Sj@nC} z09D$LyZzfycHgjV4K}B|Pw&ThAu{m~3_~36@@Jj!p^bN+p|LRC6-hiKA8a&56EtS} zq#vr)6UQGHTvTT!1EI<`zb-pOb`1Nz4C77eU=K4L@_j=|1cTwZ-y+F;AD@Aab%O`m zi=pG}8MG{leVBoru%Qmvipcae*F9nMX7crB&)}XPTa(n&Zu^!|VVLf2NzN`~nB65Z%vnZv z#OjV{>rx`9)TP5 z9N`i*v&eL2UTD-=6|}k+e6XLz?1IF^M7>M~)RGBHgo`3|A?!x2mT`g>`rH}s{tXX% zyPTxZtR=;lrQre?Oq9AAClsRW4aBcEZZNlGZkL|=tv<|E@rGlkI0b=J?)REA{z@)Q ztr`2VKWcicplM%;0N_o_I`5;-m+V4cT5J9TPr%q@7a@S1-O{Cm;4$P#)lzrW?nMP- z#b2-jk)&~9Bh+of6mt>Yo^ZO$`@>(aSyH;SV8b5#CIrxZ?tog!XPzjyoz_=`1=;X& z4|!9>0!4mWJsLI2qt`j>2hO-lL@Ye$vt3d#*-R7jvpf%6yxY)La4?eQjP#|*6RDiH zfTHODammTAIAbE}#eMCe59yic8GsGcAvo-Bn5(~Ph!YTncIY%d;{$zyHv;zd5u*1I z#m5`;TDNHX(fa;De0#gC`n&h==_}w19ByTqGDWfn))64v14A}}d(VbGQ0)Og1bg7D z{y)8$;|I~!x6OQi2i4Wyvrxy^|L1lStcCc0{r{&6m^OoM2M)0P*9G{_$KUbguvpru zm5_$Stf;Z4ZqqR9d39fDR{%Tj$6Y#vud|4cY~DQ4gJIay4FyN z(e{vF67v7|vXcnsARQJ_g8bjN{ZkFFl?uFnRS4kyH-f48|Ju2>V1rI~&lGU}7uJ9K z8aOii7nA>u@gF=u>E-#oXGN%X;NTUo;7W$?e~|n$brWm+zwW!N>w{N9xBuY$XX*b& z`Ujsb`&&=dt+!Slr>*j21U z0h6zvzxP@=61I(0Z-ifzh13Jm;Po=pk;UnXgx#DCmz+_pHtMR*Dqocby)Efy)0<>f z^xUes6@qdHdCD7E+Wi?8kgORcuBoQ_ZmVq8LvXsxj}7g&z$}^=3#_~atIQFBD14bX z6)(vkusMz9_Vzp3aTr71Uexv)5!cW3&OJ+Iv=ze#qS(HNIPhzxlw7si-u?a>xX|r$ zwmU_CNrWr^9lB%joqfROA>@Q;*AqR1j7|;%%-FhAaxKj~0Fr+6-+2PQ@gvx1O?O`S zJX(hc11Lq96e^$)Tyy6~=l<;i7s2(P3y@t2vPEDD?G-fiLJ9qw*gttBCYkZqi7@_ErNy$pDCyQ?=`0>6|J4Ef|_Gs}b#-7Uc*%b}GKLJIzs zoz_Z#$P*#%Rg$66=!dB@(p{iIZrMg&m_@c@s|WSI#9{$Vjtr|$(dzQdQ4d`sI;%d z>a0*R!GiR~yO%Sm7~xTC#-*68S42R0d%z;e+i*dMCtfq=;|sLP@NaqE#UX1oii`Zu zW%b(<#ZmE28gEHoJ`FfEm%JC$vzzFc2YXOs*R+~nM-F>S&*2jh0)k7&SKBTD+U@~> zg(7H}CqHXkl$2Vzt#7so?jQFHw5S{+q@%g`jqa9ew4|Q*zVjdV|0Ub}437CFtm>4x z&6T{Rt>V6qCb~(}LvtJs1vQ`2&JWAf(UcheD!|3NkEbvb`8j(h;Lhov+keAjV)rJs z(4iiVm?y(nOdivF!c&}H5qcA20At`MdU6r8lb@1)DDZqSjmXMk2j3dN{bEj!4Od7!B=qnREoWLVO{x;{-W( zD!bBRmlOZR@N9&=AUqu`LoDkSUB(0SUm?PP6u{!h7p_cDI*Om@_wx%=lO|U88u8~{ z%>J8iLYKKz$;5f9dXK{zYuMw%$Lry@-H#h7TEYrhovi`Gah2Hskqm*LYlm!H0fS|8 zG@Qe|fAV@P_X->w6!`)&#T)+c`+sP81pWSB@9@sIJRpfyV!yGW69{YiI(8?;RIi6$ zVdQzbxc~#oKX(7eh8sEbO}8S;Ai~L3pTj*Pr*BY2%4nWhhg~0uC5G~|(gy#)yuG9% z->NJw9It}tsnr>Vd6UPq=Sta{E3Ltb<#MWUrlIU+TaM!uP!6_bwM|K+`9 zNg+@D|FpMN#`yQ#8pa(X$};PzxMFL0MoMwZ<)nhW@Ac8Qh_25NpOQrqHx0stN{I!FMQ(PrnMK^5uAQIqo_z!#bwwxDVu0V0T9i z(XyWL6bh8Q@6Z0`xD$&Y)kD1=jp$kfgJ)*6FhBsEmef8D%XJ*$GFQlx&)7OsnM38F zv_t{7dF!E%t1`aJ)Pr%B%%JBf$@aTP1QD?{1Ko6h9|{^ngaT8f$A7NzXJwGnj?2Cy zQIp_irHCWE^%twrvuu{(xWw&KE+6mi&<8|T7)aOstMA7uDqWWR6{y^l1WB~E2QBok zx*1Ca`{z`;{zHMpAukE!95I*pAVqN{e5tEZ{A zvn%{@OkuF8Y2NPNKB7AcamzU6d2>;_%We*)oCT zc}5FH%#&bDT~Yg3k4_u;g#$aX% z85WM1Zhfg!#B!pZ^*16eKA)XJc%y2I7|&@5_uc57PH>s{&Hyla-Es>7N^a5hT?l>V z4*L?^=d6Ep5-_{T&WeI97sey^Az2F-SJ`_k3Mw?rsnoWFFh#&HDC`&{_ZQ6bCdFT(ltZ6;wSOR z_0cj7SrW|3mQ49Wk4=#+!NI2qv=<3VWX%XCD?>6W_yqABv#pU~NDo0hNami(zL8E{ zL}0DwGH;DVL&Krxbc(Qhl{XVV6=rW;GB<0NVu>*QDei5mY@IwF0KpRa)C(YXG)77dvDG?q1e z@Y^t_D`#8Q!#h;N;QGeyy8W+(KzO@K7|;%LD8&6Dj+E-&dOG^tem9R+z7j_N#fosm zw@^iG8jYJC=={4?`FIeMnNzIJe+Z5WvT{9ZPh7nyYdFrJqvwZYzxH0cs%o zXED$5D!5;(swSWtyjd|O(vV;4hkgCJq`Ey<$e3%Cgmh3ZuM5o}=7PH)2IG9bn^eY5 zxZon4kUXw>rxe48ccQOG7-Yb97^?|-|&x860O<;ZjRHc@&- zg4-3@|LE3uJsI!MXwzJokiN66xoBOg2wVSG(=$}EFfvt+=+(uSnQxK*DKzo)@$f>G z=^$w)BU&->z)&?I{9fvWP`jJ?Ir8}?rAFc<+>JM@Exq-LEQf@pHUdi)@bLj`T#HhY z`NP;CE?xh;{B!Rp=gra@1zhaMW5_W}?l%)ZHCLjbXqH8KN(pV_uKkYgvBnLFu$y?H zpb~$S=Z{GLpIHhsXcnSinl^<$AfyZ2e171i6D0p|Gt`L*onZT8@qobR1!xNuz+1rVwFIK(g8FEn*6%aftd-_@rfWU+&zWO zj%|wG@p($Xm&D(|{R$1y@{J#)^kEn!hFQrzf@PP_rsL*2- z5@pnqMX=Zt`9D3(DPNB1{YkL9Aa()Y-h0J9{0T=urAmMDf21KJF(B}-;~r3O`eE`_ zC;?Y-9{2_6jdUCEN;(1TT!(n=54*A3144Z}>;e6EKZ*WD_}c%U2<_g4jOsZ%^ZGXS z1g)nF<6lIqwM#v)Pj#sSb26LH!(q)+J%k)h`V&r-KMiTkmySOd34k7suD)7_K!ZL( zoO>bP^i%Y^fJj`$*$?^Bhb6iPzvpp~d1$t^y%&{B@io zy=_cjYeEcv3q>{%Zlf7sN-c)UAzAsymoXiSBzx(&TillwH^rr3cTU>b_43^rG$O11_s>Q{)891hMi81k?xxJ46&9wfU9hRl!|L}E>L9(n{xTxEYN&$jJ8z1BWE4&vVPt1>GyDl+m%Rn~aMc)w&of|HpRP?h5G$X)J-hfuZINU##b!%!wx$iZD3|$r%Vz&&=*ST86!#Wx zRfFi(r_Pnek8pk@U^0b>7QBgx?6_VlyP@;fC^b@^IKZC}x_50$nNg_7oYGJmNRdU? z9auj&3k|t!vNhi-Elcd|?eNMQX!s6<{%j;CIF!~x0c~_?=7Bqu&Q<>%4ev|@!&s}W z(MK78`}WSdAQ zPzk5yctu$>OQ=LP4voL3>b#9#^X%ee(=n%vQlg+{NAa%sbLFR{e`0=Nx`s8H4QP{bMv>5NGsUifL^A3a?YH%M-vg0sh938nH4jye$k<#3`^i{2g}OSb*3G!?%CGeU&4fPxL0`{31!9NMEj6R$R(}T z(F~PJf$&Y&ozJF`ewY^DEQyxsvAvm!{V(8>?@9Fyt4aXg4{0A$6e)6}m4A2GNcFy* z!Ae|$i$m_mt*O7}BfV^}t#`h`o?I2iZx)>NCL{trkn#pK4^?#Sfdw@yh!iX*N^-oC zUxC%u?1~3Dm~tsZ2Q1#PmOH#M{8TQ?O%D^W@K8a0jMcVgDf#(lo9A!WEg+#k9&dhn z!{%Gi%wr|s~;%83wobB2a`zRrB^Q5qWpFj(N&-&DN39@LarA5 z1Svy3EIel!Qf=!)653#tdH^+_u0uv~xwQX4uNak9vh1z9c6Qy=)3s;|h8vvooiD!+ z`d>bKsub$I7ume~Jj33bu`KKJ`_DuJ(9oqv?BnZYjhRHEc4q3Ugv@2`sIYy#G%p(hf_Fvs%R@(BOoO5!Nn=p}TbT%9(7lRoMZ&Ju7~ zEPZ%n^-lxT9hr7``lc;Qd4kjguE`rNQ>2(D(&US}&K$`@yx!8|8i*qfno2>`QGf_d z9eCqmS!WV6y1H;X@Od}y%bUqTpwN|A%u^{?h+tv~85=cAZ<&f3Fn(&Ii7ne@O{S&H zY^(|j(_#OG;N6u*O5P=-Zs0Qbc%x81?ynmtR4&LEY0-02=?jFGlix>}m_BEU$FB8B z464%En$3JK04%OBx znP+j2%rybUVV^RA6X3s`7^E1b-=HX$q#6nyzc@Q8{EE4h!6vdO0Bm3tn4eZ}v?OHPy$j9|pU;oE z$l*L)mb9hT=bAEx27d_7((6f1_`}{C6Y_iv#HGxwf>(!5zB*?_l`Ebj54~8mLXs=q zB7s+fOwd(Vn49BdRIYWx$;Dc)?D$Rbko~D9+dS)KTh)_$)zBcf%aNn`E%9c^cj^W- z$}h~>yDH|?4w*{6kdsilnD?aX3O{MFP-5GA0LfBu=%hHiXU+{J_I6@4RyzNan^Blb z3Vi2{cX(PlN17{NDa9LanhNvlfkVEmP(ZJX{#Cf$;I8Ox4^Q7}1=)`F-okmvn9Ii@ z*5zRq+m6=MYRh3j5s703eg*$oT}O`R?g%PZF;yC`QqK0IL103fGqHp@6~c0vJ&_gb zh7KF`7UJ6vy&9y7-EIPK`iF+cCq_2{76zPF9D;c-8M&wTbdeY0J)?HFzc_s{V#>htSxN8PG_ zVD>mY5<;RaHTWI6cE$Nj`9=42KNc*@(`5=PQj{opbwzPFM0eGQb&3ddT3Q?`-Sx@- zjtDQ|3^LM`CTEVVwZ$rBB0JQwKx=aJ#V&5P;d?9yF%V^_={v0e|NYacuYyJwF$t6J zTHj4g#9DXPzbM;}3J5Q!Ht1V8PH=1pM;ca#M5HXCQ^$#d)|f9xw2EVT^y>mo0yXp2 z3$0MwtHFt4YHB(yi!4H_UHgiCwOne6A2H-kvSZO6mdr0Y!qti%sRJibskMw%5tTC! zh*fcqVZK~^>p$!a--1M)xTXAp-3LhzFE{%HA9REa^EdfKQIjB&h2c9}(TC!yt2}mm zjGd0OrY!By>I8rhKC92vM3D3>N8Qp4h`bpeLwpTx3rA_Ewj%pSo$dJ`iIkj|>^Tsz z#=X(x;E*&Ihs>UzJm>i#^4J}V7n|h{<_zNfp)b;huu4)^bL8(kjgQ9{QeWEhW5$du zXXicoF;|7WS_Jk%`L|$u8=ou~c*F9NSK|jFyPRT5qy|0EC*dJ!Jk3F*Ol86}D06Aj zs~sxvc85GY`}$OTTN;2UpR<)!;8q>=tASo!XLl!<_e9#fM8`*yZ%EzNpzSlB-s*46 zFBxlwbb5nQ`L%+b6u6Uybhw8+^DjC@R^oe(P~wVctQ=U zDOabx4NLnL!h*JC9me`PIh4h8jBc6Lq6h!t>$4<}9x}CcGW(`sC1%={HB%xdy{p3==B*mOB6x^&Sw-K66RM^yvO!&(NVpwt($ ze};gLMBn$k=i`E)bMd&=G&AvXeNoRUZMXMio2-%H7XY^OkV(RQ5k3~J7I z42aqci!*^wt4zLKSXm$&aA?K_eg;@*ozO~Q`8+RG+Lul@$7W1dvgi7sYkA#7N?gbwDd zrSdsdUU3*n(V8oNazSUVk}S2Q&Tj{lbTN`xnv$h@W<;pO8wVs#eadKaZ&m&gvUQGg@D{ z4rJ&Q><-!{HkN!A?l2xh@_6>H;oLz=L(HjuYG}D=830g`&r|Hwr8m4HA;2(}yuFTt zSluwuA%VBqX?*Ud+w$^2jg(bIVs)TF(x&`>5p?g$-RsnE@@-u3mA{>j?Ew5#Su5!c z1D?<>(zeokAVJ%PkQU$pZv_#i<4BGT2c_-}Ov5S+SBEYH2kE zHlR9@{^#7oV3>sD{p9>~I&iwR-N#fXS&eaqhnuNcG!dILX@;^242hOwXYGJ19xaB} z$V4I7AB8686=EiSCFN(zuWPNPSamj+jCt}!B*}HLg@RIovhE$(d`{0ZtSIN$a`KFt zY|RxQfUp zgjnU2$ye^_+6PeUN@jftEoPM75~8X%`HPDFCq7FxO)Nh>PxH#r&A17*#a7O!o)xRI z{hcO*HUct%yeS{n(b1EGDwHXNoiGfsS!ci8Ong8*s{CmI#eDA3+ctP7?^3gGvd7s> zkn%-nmYRH>YOj~~02(y>|KsQS!J9@Qt)pJx@VBplY7>Mbgw6YnInRbL8it3lRp zkd2ilr)|#=PGsLn?V!FoxnZ|Lo5Pds z{0a=jPXTP(WL$|-M8EV*(7!efDEg$8N{ysM<4h1=vNf^P3R=|(Bjj%pdDv1IqS8&U zr6z+p!5eepFv&;2bnIj??{vu+UDPO9T|5^dLWa36?&dmp$JNLcZPX=JUvaq z`LFXAS~hvU)E@L7ye`=0R0hBmKv($oX}DqvLA~iwwUa3D%Ao3PVQ2~7-J$bwg(B@q zm&)bF8O@FvA1r5ITmPYM?-Yf-rqSXumZfl8^VI}z zaU?f*7M+8lKUFp@c`tCsI+YbSn$e_lZXImKebP3cKNDowgdE78ZEoH<$|fkf^;Sd{ z*8EfRc~RX(U5&lXo8xzG|Kc!(MY!Z^*#X-L&v;qVBa(NOB=F{}_7-WfKG z5tmhoMviuD|CjX{w$1rLYIhqd&6MnopaT1l}YEr$|d@{o3o?2hxG{pxASjk{xt}y?>`pJEjGG$aZkZ`L^a*e+i)OH-PA?dOCl%XhTKzyBrIo~Mr}ulXOC z{x7tC(}pko_x%69*COp|{|?Xn@9y_MCcN>DCX;c$q{zK(~R+yV#Kf>O3>G!Y6|7?n7`2JWu5u4tKf1ZwzwZ=`9m|A(Ltb$r?REV~b8Yj@7Ynb6Zkm(G45YL;*hSkV za?;!_2FH_jZtbqq1l%RR9an8nwMm{HX9Ic%ASaL>`Q2}dEXcRKB(jnSZAT;ZPBT*J z2QIh=Oo@CBvTq?s$FL|&^vzmaMxxzMdClYJ#shzM z=cw;^4Tz;nZL2Ch$dYN7W)L`Hh4b0TR}tCoIDmzKw6C1ghW$bgm?gD`W4o*Aw>QWb9VWE zqvO7G{D0|~H}wBa$Euz#7#5_w?<0PR*hP9;na_Y~q*`V2Yy#N8Y@i1!1Md!;9@eg0oPCO&zDXPvS9F@qwL#QNITXb4jw zgF9Q~qzx?-c-TbvPcP!Bysk5!CT-IU0zF6si_hgC)84B0aTw>F~+Wx|Uf5hzaE zW$W1r<>9+y_dM5%SPhs{NQIEJ<3KV)2GtAVj%E^TArn&8r8mQ$3wX3*t9R73yJ7+3 zY;2NwO4WN+(W5&!#0JNEVlVGG#0x2ez{#=r2*?k-2Sk$fC8x9)5oIRxyYB_)fvGuh zuabE!$C>x;3rSBcymjMM)E4D#+pWV0s*B{c3^)*E0XDtTbNL5!2)PxTwT6p1nI|c; z9DfaG_5jYR5`IK^8k9b`ZCf>1w19_bHL@Hk0d!H~lTiZwoE*m7x7u2!c-cGSMFCo= z<#U(PL_r>^--IROQ!C^TnE}}^K${N;W-p2UI>GXGzpU^vh@CpbGZ;cZN+qQ7I zQ8*w58AcK0XEPGeiv35(*NvT?L0yfDK&6`zy3k{`m$H8%U9-Schu%YJl*E&|WBIOj zhHrg~_8lsUM2J3IsFyy_186n>W6JaF!~bX0t6rzO%g4~(#K1t%%8xJOi}D1|Yre2hP-PbTV{q>65()YXx-NZpO8daSx8 z9j+PE{E=|o?8yJ7r|yyL%DQ@^z?N+v!myjR>J9g*G8K275hWN7B@sr7IR12AdhD!g zSqIE7rqk2HD5ZRdQn|pdMv&?t4_*8sK`#F46dL8Cl6GK7B#&be&b_#vX}e{|8T-qK zyjk_!H#%6F9xr)4Vm*}LGj&W{Q2@$D&6sZZ&it1+t=%8nrZf6mh@)zyBY?{7AO}p@ zW(_c^j@B2RROIlt6TcVJ>wj`maU>ThZ~)456ueThlx+0U9?zPYJhm0HvM=^Ek52G!g#@GOg^8SrRg#gcF{T0E(V7Xee51{E= zjm5MFY#ynvtXZlsbkI^ie#e5n*zeniEuz^Ov@k?MZeF&RUN5YvoFEH13Pe^c`sKDO z@J*9r`ZZ%n%Ayzpo696JqW#sM>O6hH^A^=rtL4#sx6t>Ei;s)H_|k(;2M-7K^`kCw zlixPM6UVx^mds{`-kCCM%m)&aD9%@5y13DL(eRF7jAD(qWN6DCBm7YS2kr)5o5t9m zGuYBbyg^tKCw_Do!wn=0VAK+FlQeH_8mfe9^zG6T^sq?x9GkPb` z^K4E)sYknWbC$z+7%;PZEL*6)_8Oe`iwxvtPbFBDTP%B46rWUM5`q-6P~PtD;QPI< zPK-bpPI4(B4F53@uZxrSbu|aMe8>z6ZJlloIS}L`5h7>G$3?9p+u^{nbvATvl}IUN zN5VaSO)F;_xXjSu4^7&ljcy1e#UP0lhm8qCK8GG456k0h-O8n|O>5F_ zB^d_K=+33Ypi|(Ah%eV0DM#H;N5VHA$;-}6L-vQ>{(Q?UVB`3=SeO`{URTxFH=Q0% zC*I*tb?!s-?>A!sPc~fMqLmK3yk}E6^skwcYWT9J*D)8M;yr3>v!AT!NiOZ2h_0P% zu9yb_l_G@f37Cm;LaFk(E`)afxMgh^XGe&YZG6}wfW!u2R}qFahbv|-m$?qcorSTG z++wo$WZbN7EbjAsW~Pr*TtT8X>Ec=<*){SZ)}K_e+cXPCvp@=QNXV_4WG zqccGt+5uk#e12fBuN8(EPEgGi7Z;$RocR?2%>-JgNGocaqT9o3hnz)M4UQX%+F}vX zD&|p6sIU=R4c;7?^9CKe+}Ug-U)9o&8`tC}Z`ZiI#XyMYjE?gb`vDyrDBmDkvq`cZ z{g=W01=PrEjNGM&9>52|q(9vw$L+5!VUve2f24J!yA#iT2cnz9&tBw&@WKd0mAd9? z2Z2F&Gy(S`Zw1_^|Go7zOGR(83d=f3UM1P~8VznZ{&phhj%%m6m;3V;V7D0FtU;}F;`9Etdf$bKw> z&Q!!66O@d@V6~1sC>irJiX9A7lJuj2f+Njj7 z($@6Eg4MTz1=DM^c8=}}NANN(Xjc<0JLIX?)Oq@w9BX*d0UeFs9%nuSw#9|CgF!P)!h>2xpfVh^t>a|g}t|d|N8m19@=qW*I zbKzZ9)L#lba@VZg6_Ns9ts&@9l#skS(gYsrm}q%Pt@si-!Op@S$X zF&9JaJeq8}BgDU$(?V{$fGcTKI7GT{n3)*Ge&g#st)@;4$5yhunP*T+U^o2IG)%^9 zD~ih^(m=ilXTS1!tRJ<)VF$K}1i9JZFI$P%V=|(rC?;VB3N$aZ471|o(UnYu8e-+@ zx#2iPOCzG>U6swSyUM75$>gdQ6RJNBU4ZeB)3ntpt$dttIMz!tZwQG9+>?}j{)00y z1maE;2bmG#kN4c!HKbKE2@83AMnRxhG(`&t9F(C`>`%m1!4^75?=9uHHtns@)!KQ5 zqrg<%_$q7a;^Rxa+C9P7>nZr zI39;72Xj7ZrF?-Sl`!`w&aF6SZhkeydQDt1A zcr|N_@9g75D@WJ5t+n!wO$XXqBO3)9+Ifs6$1@uj#^<2e^&?H{@OQ;sb3rx#=$}EO$@t*3s`kFn}qXQCbcQmyE*a4517-)6_DKcP_c=C8~ zHwE-id9*;YfEuLWgr4?o+pghN1r^xxzP6quG8IReOnQFUbjPR(1oOPeZrpi`+R_YA zmk>t)W+9nURhDxuR(%R)dSK6(rfK9Vva9Q3fO!_ZdByIw4(PdkiKJ+nI0d{4&`+4O zWTHq5$+SMeO=%(IH_Pr0Kd0S9xTgD)KDng+b7O|7DIqGGRqAZQOm;wtLsSL?F1qpE zkxu39P^EQ=74kBkbKWD3RxX(n*Oo|-X+cFrn%8#CER%5)pm_p#T1DY6L!dMO|vTNjKxOks*EUec+L-Pdu`JwmzU6@E>xvSzU#O4N zCAHkde13^FkEpNrz>jRrYOMSBxupa3XgHeRpDV)GBEWjg!1eJQiZ=`g2Om|~^$xzQ z_D*p2@$x2H=;Gp{Y?|E#3>60#`!6zKrOD#B(%cDbri#0^4MRN%`b@(cXX_dUVq>K*Dr!@Fc|xjSSec%V|md!WOoIw@c?rbZytd zq&?`6Q>+Eyy6w#&CD?i8#yhi9r*sAGez*N{D~%8#gK@0M!VqBytrbG$;u?^>f#lfjL=g3q(m#oJzA~#_R7?lz0mtS%A`!zJc zO>Et5eVP_*I2(DI6LvJaoF5;RDL68fauAsrRv^cN+2*`x4H`fv3D5es$p@LGOn~d| z+M~(t_xhV7@t+gI)06Q$Q5ak=pbYy0)!5_A+AHh@FRhK?pmtj0j|`Glx2@pwBa4mx zF8s6%=A&t%0BPAT=ml~_Yt~trEqGEB*`$EK=1^)%@Q!-QC7p*w4@VO9StHmJc-~Z(*bqZ2~Ii^~7R?EhV%rBg1m9VjRfiLLR zXe=E8LJI(kultK?FQN5@H&19}2-I-$iA1*Ye)-~^$PS#(N3Jly%$y#+EU&@PLSYUd zd)!l?aA$S@Og}}gw^Xk|h+2MTT;6D3U%@bt@VDTBvL%fg^pL{%7gmx~hK{gc%_knc zhMV8V-OAW@OGgJj9J${2!{4h|rI&-KF1u%6mhV?bJ3F`MfpfMRS~^+3eXkzhUuPd! z-_Pe);I3~(i=(tUzbX^7jW!CQ6p2Ci778J=TJ-Arq}_H;Q^AB`RT_z|<*`CwEso zZm#N~kv@5TGQ$l{o1zo?(1bSXuQ9qgo^ohm9pmQ$v%#Ij3|%Dc_uM8c_uSx(Ma@|u zjgetGQG)cPUtk77mWEGHl4@u39y^KD`dbeVx2C>T}ShqMYpXI_(OTX-GjA zttq6*cb&N}aFnCm0k)M=?1}HEShTKlsEaq`a+? zaD6In3uppS9)R0R^NWhX{$?gDc$0ok&u7gQ%*Rt(qUjJVp$Pb8c_Ri@g?>Ty*yu7k z(wbUYo<(0KMkUawuXzJ4zqGM;nMly^Fx(&>$5}Q1#;RViwuwYF{H|VWFCSeI?*ZJp z>yQn>lbdPPXv zMe!=93Z?UW7Afg#Brq6#taj!Tt9lrB(LeLyeZ(Qf!LIc@DH<{Doa@it<|OAsA$l-E ztIr|nxE*BGS)m(#LEI<$RvpdhNcK8JJ^4xsZeYm46tUkRaf}*5%o( zZJ?Dg6cxSIjjoa108I%Fw6h^F{%07ieV&7o!X+Yy-eps#LIZ!dDW556am{;!DvYV6 z(%d|08tq8e4O|fhTp~UAr5t*)%+wj==(XL=t_iW0Oj$JsV}E8^TIfLCIw9`wyzVG- zh{urqpCs4pBwo#qd&Ee)bKL~E6<1ahyQ#&3upFbugDYXA{5^zc7ZzH45YtTgsCWtv z(LiP)YN@W4Px(6JN|`Ws8}Bd0hu8BXW!r73gmmoGdI@}MQSr)d)$$wnt4StLRWIn)QG!1LU_)|L9LVi^p9JgN!h2K*>>MA{Jd*m54_F(k|6x!WP! zzv^K5nmc?Tapx0z=+Z^*suw+zW^{_1r|U7L#vQUM8)Th)h{4`V6V%w@>WTW!UY2`U zPmmXq2i06s;w2LY#=&cWRl?0T97I>=-v=%_Nzne$OE`xEw3x8ocf5~of;x>j-e=iq!`e%-EnrrODE^Ae9(Q~(p7MbcQtJnG0~ zJJ!C-CphOWa(^x#mweh#_jVgF)pLRoxoh9ga4=U-K5vs=qU>v#C<_9@SB(U|%7*q2 z^6$KkU$VxsE_Xb|xR~^|*lDE!D@#7=&{??HlS-%_b@Io{o+(PCm^fj%bLpqQ%Yymj zP@Xz2%f79HN81>0aaMw_$q08BgnwEg z>dk=h;zs7D#~t)F+o@Hh(YzY|dV2@S!vq4A2AU{GpzsD-+E>2soB%o5tZ+)JxOjtzQ7EB z{5<|U=@jMqN54`T=0vf%ZwsegDaB*c*91FCja>Unj7CF_q^Z^P0lk zMiq@Q>8j&4(qNL@UVsPE;Xs2y4lE^UXXlnd)Zc;3AYZ9oFS6h7W=f11(@!qp`2+!z z0;z-R!6V9~=9A){ykf$Ct!@nQCUF3Tt%$JDk0KGo;QA;)up1-_G$oGXLJ=5Tv{7`u1i!HARhwW2(3*#JFm4j6fw+reXT{WLVo+F5juuQDO8Mzi&;vpxNM zfIK(wQivx$uCFcUHm*o#(D0$o!2^su^?3n(L(KEAJ%0N{sda^ecZsG&&H&dWi&i^& zUImGXgdP9!9g^9f1j8mqM8c4CdP;)^A@qR5w&(ue<`|Hbr4|%aEFApkNVOe7#FWhe z@~G=ZfE3%Pl+;&kQEjS{eJ9)noOp^s%gd1qcql?GW;(+9c z0PAgh7pHYAjSNhdtFYuG7)7Zhz5;;>C4GmY`0v1Ptzyw;=ruIJ7L+Ym5DCtHA^2HO zr~=C7lA#|ub^-Ae4e9>jFTB>xD>?sJ_(L{4!TYJ1-2gM_&tuW8W{WQ`H8tYudeA3x zcN7EP4%flKuF8Z|2$=f;P#s)_{73B+xIbowv-l?7yB(MI+Gu0a%HnQY|*A4%oS{NZry@-D3ZR(*J|11@M^6qbfau@93;@!)?tUS?QUER7ffWHs+ zR}Sj?p|<#AETj}CVihO)9ZH{@?${@Rtkd_auks~3?z%T)?T(i0P@NORDDX`24WTP&t!#91XN8MI_|KSQkJ&toXV-(@-W?C2drnVv_z3Xk2LChbY!|Gv9WX5Kf4Abju+2L?r0EJF3(+l!!&Z0Z)K(w;*Px!% zg@5weVxA^N-a9~^Gickx^mD`#3kL=mBBDTvN$32F926NHJ|g=}+2;v+oF}tlB6^!m z*7u+Yd4FBiFK}a^f;ajl*0$m`T@sG~pxZYxeolK?o7xJg6^mO|11jTVW_j23R&hneOE~eS#Tw*fRlj@0u%>Khp~Sz8=-zxlG(;Ek!Z0H_ZAU)l zPcg-7&%DrOZlzp*Onp>o34dQ4;%1DukQfam!{i6;1w}Zwf|-LwnES^KjYoiG2$4}C z6R`TefT{a2)kKn-rE_~ry3Wwr;$2@R7KXv^U6*?07ib=`ak>(aY={oP6-NnpNR~vuE2t=o+7zg{In1| z(=;9dwe2zlcIl)ck%I^1HRPV59Tql+@yI2(dLCLEic(Zws>(s{Ge0c(G%tMqzWu!Q z(5{r(z65o$%`xx$RpzZVL50|ua&t-&fv1;&&nei4e)#cHZ}lBLUHHq!0&-H5A<0An z9XiLleq$e*?c9i~#)7T=dmowatPjicvXtq<7PRxp(0WTDhECKCS55I%ceU0wFMKae z$x)R(qBkxgZnk}X0cQ^|S@2TMH4732{*SZm4J@4qpjzr~Vu1AC?dODqbn_=x1>b-g zlEhJXH|M;Y*!c7VT}w+LYzTj1k4|T26m0ecr=sw-_SdXN4jHm^N@JNL97AvsEdeYY zw`57=v}DmRGz0U)^x7yvGS~?vn9oW5uA%4!<+~tVIXg1VFgvh6HT1@-XwlsHt;}`m zB~y`t%hSN@X@9RX%S{y(7>AKhn;Tg#RztvNg~AP#mEM~DKhX`F;^!`H6@IGAf0mP=U7Rpt8%udSU7C?m8WQw_pYPiq=*)8iR1f`o_9#MRo zm}fE7g>BF@kDv!gN9N!*s@O)YLrXD(`nItb_jUXH_br&FDljnZ824xjc* z*NrcltM0Rrds)bw_pW)5tLO3et~=iv>z_TxqK5B*=ka(jIPMp0=nEWVOvVSUmASn8 zKN2c4PPAPHd2rd7J(TVa#ql0MFMq+=#GJ@Z>2r8@(^_uEhO`xR<0h`nYz#44+x5c( zYjA^gso7altrU#LP#@JK7BhSpyufdE5zaJ=%;`2~VWf(cm)u|7Fn*nTr?@!U2%35H zk(Q>125zt#gDFfAPZ61MPVx#`wV{xvaxw_GsOmMmmCzoZ9D=s7`!IPHo8eg8yX=bc z7zSuJJUX}*uj+w)2-$$IPf{dFO~uk6bi|)isqzzk#u)+6bEqbzqM=w4q-K7MJdEwF zRGa_SMz59R^sRGiIOuU|%evKD9T*tVv$-b1E~{GgUh|OBo)`(!Sph2raQX}@_{S}HgXitcLAirm41Q!|O+o~WNJ|t7iqS!h!N3GUzKIIYpGVlBG~mrj zt7xWAHP(qN0m~V?J<6mo3ZXuH*Vk6{_m?t(hW^M6aYJ<0y}%^U;A%hWKhvfScNw`q@V4?ZvFHL$K7 zL1XZRyTE_(IjF4H6@-29xu$Y+o&_w8+6ZMl!z&ETp`EcGyeCde#pc{XS)gQgxDRfn1)M)i;!#)QT@5CEN_7ytcDNOe-)>t8 z;K}^nX%6VC9L~B6pEU!QR(1tKdg{ipdm$k@35xP`yLh)Ek8aO3f(_S0?<~UWRiqA~ z9h(Urj6!}|%$ZpD(=7aZfb=oRAj(b0Ul<*aj&RbQ3+%%aM44iYo{K9R0@dI##!)v5 ze5w6)gW^h94${(C1kV&aWbqo8H3^kk>gk2bY2bLPvbk#D5gr*>OKb*K6nJ?$<4bV4 zK4Q#Q4L(ASHXO3C3gxb?kG)(@(h%(=XS$i%+!;(e3gs!~d@IU<|%cI~U~Qq0~}oPni^;XSl%{tAJBfE^YVuRuJ?n~9@(evt*uXc_Sd&k zIyb+petf+PpN{9s*O^o=ub;xKZjXnHhr=84&ikW~!tu&WkDeP}?Lsb5#Koo0yIo30go;BjODUg&)t$?gF2TjSs7 z%yJn0rAn`yrM&qj_ggSxm)w<8rz?=J6iA$~nV7eHWRv)PH(RAl+Pd ze!dua1LJFl0!i;UOwV3s_9w`?tJA;iCiP}~SRJByqH%#8uaK*}$TU0}qQM{W?*_jVRsq5i;q>wcV!y{295DZD0OViKVL()`XS&u_fZWDL`aLEIXsA_7Mfn=@CzVqX5fT8tcstiZ1a6Erj)Z$gW4uqL+lRaZaZO_%xHakEbN+SY?%qlt(atjmDww>DPe0H_f;9l!T951@><4+~fE$BJ0VJyH*-H0_ zup^%I5xEYnKzGiu^wvWVhO{nSc~ zK#-PfRtOMmZB7U{FSTRX;EXO%qrcgw>Pix^s0H1cfzN7F0%hS@C?rN{zd?$jWE%ZT z(k-LHZwmG)d^P5@OHr$V^k*5W(+m?kZg5+HSBOe5ld#|0hG41e*x%jrqTu9s9ow?Z z!$*Kmmilt{a`R|BU!M*ynH;l9IMqw5R|}?LOyTmWzH*XL(T8~3jzrq!EOUIZ9n-&` z&@6XmBh^(tAsSOW&XQ_0Lx>k2Iys7s)G(7Jd0jrKCzF|#$=+xrv`O`RR!`P7mmh(5 zG|3^%O(=`srtLN#k#8rm&|5(g+Lh`ImbH3z}>?&q{9&>U$x^IX4WJc?r+5S@* z?N9XxDBC6$DG^OEAyh;Q#wQROA~HmTfbwgE?ML!fL;&($-#yx$Quv8pmB-EdZ`reV z>8YaMEG&N@v|6Uku%((lEgJY!e#!v%Wky%lyHh)*_U~gG_SK2IOA`ZrR0fW4YcAoU zGN_EXJagBvY!uFRM* ziU8IX_MJ z=o)p51|iDe942oN5=>jR!InK98$r+&u zS)mMSwxiqVu1^|bj? z_C~D^$dy_BYJ4Th7_B7v3l54X`4ullQn`py0OTxzDf#5S#2GH_h~b_ zF4Yb#7G?pdRckcr3)H2Z%{#O=m*lgz#RO12l z(${9j2Z%?D#))K{*dC^vJOlkhbR$hW#(3jkvVKK$Ciy&z2rmIZipa=-H`RJ<4ez?G zKMdo)#jDzI)p`GqJ}vdTa-!NdTMw%Lmj2UtPyxN}c(LFGmoc(@>9+57#N`1Xxg7Cr+(if4tgCiLLOfX@x}&BfWDGg63R(t`BgkZ3=M zQt{}{_$GRdxPjbVRzDS+ucTt}d%53x)rLfYF>s_=1WJZ!aV8RYG)A}o%ry+ns$@EH zS65`dVx@LyZo?}awZY+)8ea}I*E2jJIV-(!Rla96o>|i4VzccSpDma2Cg}dn6N6ON zekMv2Z_qjd&8z)HXB~Hc65n$$_+CPU$nVM4(=jXew%)z1cW>+6+j`#4-P?M@eY>~y z?rpt$ThIIa|7h!N^aAuSZtV2@JNk&bC;&EVK6XjB-JLFi@+G)Yb-`BzWIvi59UjI= z=q3R3WFwIIc!`=gKIPG-I16L9BC+!tBQAG^TY;;n&4N!aJ3k3VpUOZfx8ErI^zKoa zfV~`rIr6|cIzhWhwv7|1UQ-HQpA9FaCBNQne zc<;pX(#`LR17Zdj;4?Nboc+|B8M8xKIEfneyE%hk&l)6Fjj*w)jfD>JqQqGRkDN?GFuZdhb3bo=@+7OVW$T; zeslSQHcoQ7#&AS8M#2ew)*%<7Z1QTgybYZ;3QTXexd6i<(&2>|T7=#O*hw~Ttv%0J zHHBw2)q(zW)~J6q_I^9O@VtvIdck=GXmFwRKE%E|@mrM?CB0(qC-uDSmWst_#AoFH z{ND%q&j$dh!B&!`=QKAhuX&L^GbtFWtS)J$|C=Zi0Lvhe4?jJ?7qe97G2w@Q`XBg| z*X-d0_q<6`rU#PcEAaaq*h)(hW`4@Wf8k#^!mRqQq)ex4nrCD0I6OQ&eERq?{CjwK z*!lP9@aXX2pN<|M9UcDV(bK;i9sTL>;p4|o9{-6P{woHct|Tr0ba>}?bvyS5d750k zXN0aeyOpfK&=Cs}_W)PT3&_ndMPpAG1j2ApJjj`(DU}q~Tu}(=mJ>^CvD?WNE2h`= zoXu;VrK|+v=G8Zc(?`?82RbQ|v;}S27sUt4c2jS-Dn-3|Mh03St=7WVIt<9d#~H8W z>)u!2^GdcfM4KJdLcDvd^zC2&x^ry8b9eTB znpVwlnBlkIKkz8^C_Z^*u=^CZ$x@x6s!dtFD8*HYBs|PIE$+&0%C1V9HuiZelPCIj z9uCddk?dVASyQIS^0!kp)1vn~lF>@)f!&zrmJBFDmnAJKXm`nNst zJ#27;fNxc@WH~jPvRJX=_~PvSqgm_Y?y1aKc-@jt9?MAgz8zBBSU_|D4P#Lk2`)Qz z7IR`4hwmL6t=KYR+Gi-$Ic!C+JSlRm7rYKV%PAfPxYN6#q;xDkfu_)u%v4Xy%H(Q5 zzE%liA+8Gki=|x|v@zJTdnXt*0IJX0N`|u9bWKVIS?zV<&@(RkfsFDiF3oO`h&-Hs~B`GPe=haEbiU3{VG^FZ^li{<{-7hOLVlA0vVSAB(p>58z6>qzXn!RGbk4KB*dQtizzX;ua5Op22H zPyo99)@+Az+WNAsv)cOXHcF$VB0`+|RYw%-p(~Hczycm@R`s>G`N{)b6ug1(-Ej=_ kI`L`md#~92bN}2w_s{+F-}3yw00030{~#IYb^r(j0Pp?Ak^lez literal 0 HcmV?d00001 diff --git a/assets/rke2-calico/rke2-calico-v3.19.2-203.tgz b/assets/rke2-calico/rke2-calico-v3.19.2-203.tgz new file mode 100755 index 0000000000000000000000000000000000000000..c899b91a40c11567a128889c7c63bd1585241f7d GIT binary patch literal 4855 zcmVDc zVQyr3R8em|NM&qo0PKBhZyUGLaKFC#6$2$el7nh3$+FxdARko6ZH?2|f}OW{&ZmId z9Z5Xql3S8%M|JYwAMmnQtuDUQ&FLeeXtX3}IK0e-!yzrNvEK;^qoFuBSrDm%C5hR0 zPnx>jZg)5s*nhj-ZvEeG|M>8`-k{g(9v=>md%f?vy~FD(oY?&rUP+FO-n;PCu zzkAsFtB3Ayk;?pkLs*LH=>@vo#ZiH|PKrfR8*|Dw}tRGVz zF&wp8FW^M*8J(wYu~-3b1i!8d{+9c`$mTBV#|V7S4(c7rApr`#&pl zjvx}@HOhdBmIDkm+W~v1ndvo|7fP%(XJSe$uv#jO@jIN6l@~-w!eJsEMd5_CS`wj50ITx7GauTGIF`of$dYKCqoX zSZQ<(7B|$LuU|(SDtR5Z(wV23|7QNThJyQl$EdEy?FqKigg|2dN7 ze>wxgmmmt(uu~tHsRtozxz-{CYK$5UoHFoo!JxUNdLdE`uS3B@qT#jMQ#Rmzv!={q zfAhv7{`$4*W9YT6DUU|r_A0FyHHnC})~WLu*gb;9`(Xt)8PPl2v&|<<1(;2n5|f^aoLFU8kaSk&g|~E zPH(3+H`1GF&WkIp+}&AG^JJ1{pT5PkUH)5!e3Sy%CjSqIy}JA#c87cU{~YOCm;X-S zyRGbdlGOFVstU01oseu+0J+T1{1xz}wMmXTCdg{n#b~t@z5wMBat(v8Ut66{r*%&) z=DYBxsxeP;gB~kN9-_z`bb}_#3m&SP9$dd%$)Esoc?m zfnro?pDhWWBfPYZhS6IiT?$oDKb7#CUwBD1#-?^eLk(?i#ehRmYwInLBrzq6sds2qbp+k>>>3(Tm@CpE)(a`x^rACX!s?T|*YIv`o~b%PPIRB4p9TBV7V z?l-qpYUS(Ksyfb{S5CPGR2<|Q`m8hn4SL$Q)lvzDqZJY(mnY9Y%+fD_;d%p zuODug7``|K5304?hOp`UyBT`5=3YkJH#PHr&Czhs?RIiEM5li0w^c%H(~u(k}~GD!S}HX zw(P&m@c-eBi9uZEGEgU@m8xT5Dv(-T*3k+0^yO3dJ6^D7DUYKcZM8NZaQtUEL7lVDb-L8 zky?n9ML-yXDMG_G>d=9{x86xsfmLE(w^7^sGs6tU}%kbq3t%vM5cATTO z!<~P)qr8PMf-kljKzW@sjgGJ8*3Zutn|C%}q4tI4#q9#lMk- zRAqvM3+)7j5tzNdQr+u6)Ix|+QoHZ1o3BmBDm6$P$QBJ5RxdU z=o+^O4{mx>)Fjh86A@*2Cbs=jC4hF%#h`I~Fsp17q6OqWiDxuvO!)}9c7kH^c?83wqr)R#?QC*V455WPdsiCMl#kW_S18@|%G79pSMO7$ zFHOn0;Fm(!F;Ms`<>}{2JzHnYm$p1j5{5ByP1w&;q={-q`O4**9g?qMM)M~jr_@>^ zl+T@+A%upxK@|8}zMnn+S?lXe*;b#oQHdnF;B09I=_kt29ZhG$`)!?P?$iC!&idb& zP4{>G+O%2!_j-eV?f!57a3BBqOsT9=<&=a0N%cZV`iD0Feo&Q&h!ZE{F9qAhH*5ry z7v3bHWqE0`+U|O8z7Hx&^8KL7vyAy!{>ayAo~cmY&@u?}C=tehC~|JF{F%En%1ErU zs*aR|p-3~(8wu=IILbhvoHNZEU(D^$IJbH6!s zt=f8iF9f#>p;-_rb;nlT-_1 z+E6|(Aa65Fja^*3_SW^>TN_3!siw>+|su8 zBRQ*~U+Y>lX8qGGlInQwI)I(#^Z6!{J5UPX@R?oZB42DckGRedPf z`oXfrUpMqjhSUA za#S?hO#Upy?I0GY5E7IzRc4c@@@IVVH+6t=s_pq1p&aFUDY2_bVNKAv2z@9ewX|rmR;+oQmeQm~Zb(2}Phf30B1#cbWIzC+;%zKU{O-O8CklLg$ zt)CFaAFuK?DSQkf5f!3HIstp8JlHNP4qOVbbGwU6lRKT9Jy0m zk|a_jk{bP$h^Xj`Glt3w`N3vWeu7{hr{lk|DPk3`JW_-Dvo;J z<)6e7LADTszR{^uLO<>H3CL?`q`K3>Vw+Z&Ln%bI)Ak~FDt)v?H;;r1j`=L z-VUcK^8S3oP&9>U0XQEXRbZd&nW7C0vpc?0eY4Fo5P4*AIc6+#>BFtyue9CPv6~Ee z#FdNY%Wb@$s8sqR)r(&oeqS+nLRAKG^VH@KLf_rxOJ?oMra^WctOPkp8Oz8!o1F_i zk*JXCQoT^bG2zjulm(^p$5OWQ5x%#<2KDN$A2&pH7@cN+838IOi`1&jO_pMV)x8>i za6{w)qtk;GEXZ$~+xu^DB73U%1Y#XAex1oV>>@u*e+ zFr&yKZ{0VRxqf6^9hi0+o4%NwUXDLpT&`_@v@+SvefV(p^XcXIQ;zTK{OrT0v-jhl zPe1*3dUT#Gep)>B>7 z=(xXda^L2UkB=Lg--4ZTs!uiuIp@Xem}-=;#<9tzUH*Dn=E!$K&OS!GTBgaozEYdz z#Jll_@zsZm%hOLE{yka4am8eB7m_&%rFzyJF@>4lfe za}BQR@Db~lX zE2HrVzJoJkjXV^#WLiE1-u-d9D|@iH3hy312+Fs!g7M_c`%zS>CY`~8sDI%yYwxud zS6Wg&hv1E`_y1}nRjSwxbAc~=f}rWkKgaOtdwA*W9V2@^&I(1Z@%Oxn?OKJB;{Dyr z?AOWVJ9m}Zo&fWC023SZmRYO*0=1N=5@An|3]:port` + or `:` for IPv4. If optional port number is not set, + and this peer IP and ASNumber belongs to a calico/node with ListenPort + set in BGPConfiguration, then we use that port to peer. + type: string + peerSelector: + description: Selector for the remote nodes to peer with. When this + is set, the PeerIP and ASNumber fields must be empty. For each + peering between the local node and selected remote nodes, we configure + an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified, + and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified. The + remote AS number comes from the remote node's NodeBGPSpec.ASNumber, + or the global default if that is not set. + type: string + sourceAddress: + description: Specifies whether and how to configure a source address + for the peerings generated by this BGPPeer resource. Default value + "UseNodeIP" means to configure the node IP as the source address. "None" + means not to configure a source address. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml new file mode 100755 index 0000000..4f03208 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_blockaffinities.yaml @@ -0,0 +1,59 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: blockaffinities.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: BlockAffinity + listKind: BlockAffinityList + plural: blockaffinities + singular: blockaffinity + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BlockAffinitySpec contains the specification for a BlockAffinity + resource. + properties: + cidr: + type: string + deleted: + description: Deleted indicates that this block affinity is being deleted. + This field is a string for compatibility with older releases that + mistakenly treat this field as a string. + type: string + node: + type: string + state: + type: string + required: + - cidr + - deleted + - node + - state + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml new file mode 100755 index 0000000..c0c4149 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_clusterinformations.yaml @@ -0,0 +1,62 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: ClusterInformation + listKind: ClusterInformationList + plural: clusterinformations + singular: clusterinformation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ClusterInformation contains the cluster specific information. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterInformationSpec contains the values of describing + the cluster. + properties: + calicoVersion: + description: CalicoVersion is the version of Calico that the cluster + is running + type: string + clusterGUID: + description: ClusterGUID is the GUID of the cluster + type: string + clusterType: + description: ClusterType describes the type of the cluster + type: string + datastoreReady: + description: DatastoreReady is used during significant datastore migrations + to signal to components such as Felix that it should wait before + accessing the datastore. + type: boolean + variant: + description: Variant declares which variant of Calico should be active. + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml new file mode 100755 index 0000000..1756e24 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_felixconfigurations.yaml @@ -0,0 +1,561 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: FelixConfiguration + listKind: FelixConfigurationList + plural: felixconfigurations + singular: felixconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Felix Configuration contains the configuration for Felix. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FelixConfigurationSpec contains the values of the Felix configuration. + properties: + allowIPIPPacketsFromWorkloads: + description: 'AllowIPIPPacketsFromWorkloads controls whether Felix + will add a rule to drop IPIP encapsulated traffic from workloads + [Default: false]' + type: boolean + allowVXLANPacketsFromWorkloads: + description: 'AllowVXLANPacketsFromWorkloads controls whether Felix + will add a rule to drop VXLAN encapsulated traffic from workloads + [Default: false]' + type: boolean + awsSrcDstCheck: + description: 'Set source-destination-check on AWS EC2 instances. Accepted + value must be one of "DoNothing", "Enabled" or "Disabled". [Default: + DoNothing]' + enum: + - DoNothing + - Enable + - Disable + type: string + bpfConnectTimeLoadBalancingEnabled: + description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode, + controls whether Felix installs the connection-time load balancer. The + connect-time load balancer is required for the host to be able to + reach Kubernetes services and it improves the performance of pod-to-service + connections. The only reason to disable it is for debugging purposes. [Default: + true]' + type: boolean + bpfDataIfacePattern: + description: BPFDataIfacePattern is a regular expression that controls + which interfaces Felix should attach BPF programs to in order to + catch traffic to/from the network. This needs to match the interfaces + that Calico workload traffic flows over as well as any interfaces + that handle incoming traffic to nodeports and services from outside + the cluster. It should not match the workload interfaces (usually + named cali...). + type: string + bpfDisableUnprivileged: + description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled + sysctl to disable unprivileged use of BPF. This ensures that unprivileged + users cannot access Calico''s BPF maps and cannot insert their own + BPF programs to interfere with Calico''s. [Default: true]' + type: boolean + bpfEnabled: + description: 'BPFEnabled, if enabled Felix will use the BPF dataplane. + [Default: false]' + type: boolean + bpfExtToServiceConnmark: + description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit + mark that is set on connections from an external client to a local + service. This mark allows us to control how packets of that connection + are routed within the host and how is routing intepreted by RPF + check. [Default: 0]' + type: integer + bpfExternalServiceMode: + description: 'BPFExternalServiceMode in BPF mode, controls how connections + from outside the cluster to services (node ports and cluster IPs) + are forwarded to remote workloads. If set to "Tunnel" then both + request and response traffic is tunneled to the remote node. If + set to "DSR", the request traffic is tunneled but the response traffic + is sent directly from the remote node. In "DSR" mode, the remote + node appears to use the IP of the ingress node; this requires a + permissive L2 network. [Default: Tunnel]' + type: string + bpfKubeProxyEndpointSlicesEnabled: + description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls + whether Felix's embedded kube-proxy accepts EndpointSlices or not. + type: boolean + bpfKubeProxyIptablesCleanupEnabled: + description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF + mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s + iptables chains. Should only be enabled if kube-proxy is not running. [Default: + true]' + type: boolean + bpfKubeProxyMinSyncPeriod: + description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the + minimum time between updates to the dataplane for Felix''s embedded + kube-proxy. Lower values give reduced set-up latency. Higher values + reduce Felix CPU usage by batching up more work. [Default: 1s]' + type: string + bpfLogLevel: + description: 'BPFLogLevel controls the log level of the BPF programs + when in BPF dataplane mode. One of "Off", "Info", or "Debug". The + logs are emitted to the BPF trace pipe, accessible with the command + `tc exec bpf debug`. [Default: Off].' + type: string + chainInsertMode: + description: 'ChainInsertMode controls whether Felix hooks the kernel''s + top-level iptables chains by inserting a rule at the top of the + chain or by appending a rule at the bottom. insert is the safe default + since it prevents Calico''s rules from being bypassed. If you switch + to append mode, be sure that the other rules in the chains signal + acceptance by falling through to the Calico rules, otherwise the + Calico policy will be bypassed. [Default: insert]' + type: string + dataplaneDriver: + type: string + debugDisableLogDropping: + type: boolean + debugMemoryProfilePath: + type: string + debugSimulateCalcGraphHangAfter: + type: string + debugSimulateDataplaneHangAfter: + type: string + defaultEndpointToHostAction: + description: 'DefaultEndpointToHostAction controls what happens to + traffic that goes from a workload endpoint to the host itself (after + the traffic hits the endpoint egress policy). By default Calico + blocks traffic from workload endpoints to the host itself with an + iptables "DROP" action. If you want to allow some or all traffic + from endpoint to host, set this parameter to RETURN or ACCEPT. Use + RETURN if you have your own rules in the iptables "INPUT" chain; + Calico will insert its rules at the top of that chain, then "RETURN" + packets to the "INPUT" chain once it has completed processing workload + endpoint egress policy. Use ACCEPT to unconditionally accept packets + from workloads after processing workload endpoint egress policy. + [Default: Drop]' + type: string + deviceRouteProtocol: + description: This defines the route protocol added to programmed device + routes, by default this will be RTPROT_BOOT when left blank. + type: integer + deviceRouteSourceAddress: + description: This is the source address to use on programmed device + routes. By default the source address is left blank, leaving the + kernel to choose the source address used. + type: string + disableConntrackInvalidCheck: + type: boolean + endpointReportingDelay: + type: string + endpointReportingEnabled: + type: boolean + externalNodesList: + description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes + which may source tunnel traffic and have the tunneled traffic be + accepted at calico nodes. + items: + type: string + type: array + failsafeInboundHostPorts: + description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow incoming traffic to host endpoints + on irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all inbound host ports, use the value + none. The default value allows ssh access and DHCP. [Default: tcp:22, + udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + failsafeOutboundHostPorts: + description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports + and CIDRs that Felix will allow outgoing traffic from host endpoints + to irrespective of the security policy. This is useful to avoid + accidentally cutting off a host with incorrect configuration. For + back-compatibility, if the protocol is not specified, it defaults + to "tcp". If a CIDR is not specified, it will allow traffic from + all addresses. To disable all outbound host ports, use the value + none. The default value opens etcd''s standard ports to ensure that + Felix does not get cut off from etcd as well as allowing DHCP and + DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, + tcp:6667, udp:53, udp:67]' + items: + description: ProtoPort is combination of protocol, port, and CIDR. + Protocol and port must be specified. + properties: + net: + type: string + port: + type: integer + protocol: + type: string + required: + - port + - protocol + type: object + type: array + featureDetectOverride: + description: FeatureDetectOverride is used to override the feature + detection. Values are specified in a comma separated list with no + spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". + "true" or "false" will force the feature, empty or omitted values + are auto-detected. + type: string + genericXDPEnabled: + description: 'GenericXDPEnabled enables Generic XDP so network cards + that don''t support XDP offload or driver modes can use XDP. This + is not recommended since it doesn''t provide better performance + than iptables. [Default: false]' + type: boolean + healthEnabled: + type: boolean + healthHost: + type: string + healthPort: + type: integer + interfaceExclude: + description: 'InterfaceExclude is a comma-separated list of interfaces + that Felix should exclude when monitoring for host endpoints. The + default value ensures that Felix ignores Kubernetes'' IPVS dummy + interface, which is used internally by kube-proxy. If you want to + exclude multiple interface names using a single value, the list + supports regular expressions. For regular expressions you must wrap + the value with ''/''. For example having values ''/^kube/,veth1'' + will exclude all interfaces that begin with ''kube'' and also the + interface ''veth1''. [Default: kube-ipvs0]' + type: string + interfacePrefix: + description: 'InterfacePrefix is the interface name prefix that identifies + workload endpoints and so distinguishes them from host endpoint + interfaces. Note: in environments other than bare metal, the orchestrators + configure this appropriately. For example our Kubernetes and Docker + integrations set the ''cali'' value, and our OpenStack integration + sets the ''tap'' value. [Default: cali]' + type: string + interfaceRefreshInterval: + description: InterfaceRefreshInterval is the period at which Felix + rescans local interfaces to verify their state. The rescan can be + disabled by setting the interval to 0. + type: string + ipipEnabled: + type: boolean + ipipMTU: + description: 'IPIPMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + ipsetsRefreshInterval: + description: 'IpsetsRefreshInterval is the period at which Felix re-checks + all iptables state to ensure that no other process has accidentally + broken Calico''s rules. Set to 0 to disable iptables refresh. [Default: + 90s]' + type: string + iptablesBackend: + description: IptablesBackend specifies which backend of iptables will + be used. The default is legacy. + type: string + iptablesFilterAllowAction: + type: string + iptablesLockFilePath: + description: 'IptablesLockFilePath is the location of the iptables + lock file. You may need to change this if the lock file is not in + its standard location (for example if you have mapped it into Felix''s + container at a different path). [Default: /run/xtables.lock]' + type: string + iptablesLockProbeInterval: + description: 'IptablesLockProbeInterval is the time that Felix will + wait between attempts to acquire the iptables lock if it is not + available. Lower values make Felix more responsive when the lock + is contended, but use more CPU. [Default: 50ms]' + type: string + iptablesLockTimeout: + description: 'IptablesLockTimeout is the time that Felix will wait + for the iptables lock, or 0, to disable. To use this feature, Felix + must share the iptables lock file with all other processes that + also take the lock. When running Felix inside a container, this + requires the /run directory of the host to be mounted into the calico/node + or calico/felix container. [Default: 0s disabled]' + type: string + iptablesMangleAllowAction: + type: string + iptablesMarkMask: + description: 'IptablesMarkMask is the mask that Felix selects its + IPTables Mark bits from. Should be a 32 bit hexadecimal number with + at least 8 bits set, none of which clash with any other mark bits + in use on the system. [Default: 0xff000000]' + format: int32 + type: integer + iptablesNATOutgoingInterfaceFilter: + type: string + iptablesPostWriteCheckInterval: + description: 'IptablesPostWriteCheckInterval is the period after Felix + has done a write to the dataplane that it schedules an extra read + back in order to check the write was not clobbered by another process. + This should only occur if another application on the system doesn''t + respect the iptables lock. [Default: 1s]' + type: string + iptablesRefreshInterval: + description: 'IptablesRefreshInterval is the period at which Felix + re-checks the IP sets in the dataplane to ensure that no other process + has accidentally broken Calico''s rules. Set to 0 to disable IP + sets refresh. Note: the default for this value is lower than the + other refresh intervals as a workaround for a Linux kernel bug that + was fixed in kernel version 4.11. If you are using v4.11 or greater + you may want to set this to, a higher value to reduce Felix CPU + usage. [Default: 10s]' + type: string + ipv6Support: + type: boolean + kubeNodePortRanges: + description: 'KubeNodePortRanges holds list of port ranges used for + service node ports. Only used if felix detects kube-proxy running + in ipvs mode. Felix uses these ranges to separate host and workload + traffic. [Default: 30000:32767].' + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + logFilePath: + description: 'LogFilePath is the full path to the Felix log. Set to + none to disable file logging. [Default: /var/log/calico/felix.log]' + type: string + logPrefix: + description: 'LogPrefix is the log prefix that Felix uses when rendering + LOG rules. [Default: calico-packet]' + type: string + logSeverityFile: + description: 'LogSeverityFile is the log severity above which logs + are sent to the log file. [Default: Info]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + logSeveritySys: + description: 'LogSeveritySys is the log severity above which logs + are sent to the syslog. Set to None for no logging to syslog. [Default: + Info]' + type: string + maxIpsetSize: + type: integer + metadataAddr: + description: 'MetadataAddr is the IP address or domain name of the + server that can answer VM queries for cloud-init metadata. In OpenStack, + this corresponds to the machine running nova-api (or in Ubuntu, + nova-api-metadata). A value of none (case insensitive) means that + Felix should not set up any NAT rule for the metadata path. [Default: + 127.0.0.1]' + type: string + metadataPort: + description: 'MetadataPort is the port of the metadata server. This, + combined with global.MetadataAddr (if not ''None''), is used to + set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. + In most cases this should not need to be changed [Default: 8775].' + type: integer + mtuIfacePattern: + description: MTUIfacePattern is a regular expression that controls + which interfaces Felix should scan in order to calculate the host's + MTU. This should not match workload interfaces (usually named cali...). + type: string + natOutgoingAddress: + description: NATOutgoingAddress specifies an address to use when performing + source NAT for traffic in a natOutgoing pool that is leaving the + network. By default the address used is an address on the interface + the traffic is leaving on (ie it uses the iptables MASQUERADE target) + type: string + natPortRange: + anyOf: + - type: integer + - type: string + description: NATPortRange specifies the range of ports that is used + for port mapping when doing outgoing NAT. When unset the default + behavior of the network stack is used. + pattern: ^.* + x-kubernetes-int-or-string: true + netlinkTimeout: + type: string + openstackRegion: + description: 'OpenstackRegion is the name of the region that a particular + Felix belongs to. In a multi-region Calico/OpenStack deployment, + this must be configured somehow for each Felix (here in the datamodel, + or in felix.cfg or the environment on each compute node), and must + match the [calico] openstack_region value configured in neutron.conf + on each node. [Default: Empty]' + type: string + policySyncPathPrefix: + description: 'PolicySyncPathPrefix is used to by Felix to communicate + policy changes to external services, like Application layer policy. + [Default: Empty]' + type: string + prometheusGoMetricsEnabled: + description: 'PrometheusGoMetricsEnabled disables Go runtime metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + prometheusMetricsEnabled: + description: 'PrometheusMetricsEnabled enables the Prometheus metrics + server in Felix if set to true. [Default: false]' + type: boolean + prometheusMetricsHost: + description: 'PrometheusMetricsHost is the host that the Prometheus + metrics server should bind to. [Default: empty]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. [Default: 9091]' + type: integer + prometheusProcessMetricsEnabled: + description: 'PrometheusProcessMetricsEnabled disables process metrics + collection, which the Prometheus client does by default, when set + to false. This reduces the number of metrics reported, reducing + Prometheus load. [Default: true]' + type: boolean + removeExternalRoutes: + description: Whether or not to remove device routes that have not + been programmed by Felix. Disabling this will allow external applications + to also add device routes. This is enabled by default which means + we will remove externally added routes. + type: boolean + reportingInterval: + description: 'ReportingInterval is the interval at which Felix reports + its status into the datastore or 0 to disable. Must be non-zero + in OpenStack deployments. [Default: 30s]' + type: string + reportingTTL: + description: 'ReportingTTL is the time-to-live setting for process-wide + status reports. [Default: 90s]' + type: string + routeRefreshInterval: + description: 'RouteRefreshInterval is the period at which Felix re-checks + the routes in the dataplane to ensure that no other process has + accidentally broken Calico''s rules. Set to 0 to disable route refresh. + [Default: 90s]' + type: string + routeSource: + description: 'RouteSource configures where Felix gets its routing + information. - WorkloadIPs: use workload endpoints to construct + routes. - CalicoIPAM: the default - use IPAM data to construct routes.' + type: string + routeTableRange: + description: Calico programs additional Linux route tables for various + purposes. RouteTableRange specifies the indices of the route tables + that Calico should use. + properties: + max: + type: integer + min: + type: integer + required: + - max + - min + type: object + serviceLoopPrevention: + description: 'When service IP advertisement is enabled, prevent routing + loops to service IPs that are not in use, by dropping or rejecting + packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled", + in which case such routing loops continue to be allowed. [Default: + Drop]' + type: string + sidecarAccelerationEnabled: + description: 'SidecarAccelerationEnabled enables experimental sidecar + acceleration [Default: false]' + type: boolean + usageReportingEnabled: + description: 'UsageReportingEnabled reports anonymous Calico version + number and cluster size to projectcalico.org. Logs warnings returned + by the usage server. For example, if a significant security vulnerability + has been discovered in the version of Calico being used. [Default: + true]' + type: boolean + usageReportingInitialDelay: + description: 'UsageReportingInitialDelay controls the minimum delay + before Felix makes a report. [Default: 300s]' + type: string + usageReportingInterval: + description: 'UsageReportingInterval controls the interval at which + Felix makes reports. [Default: 86400s]' + type: string + useInternalDataplaneDriver: + type: boolean + vxlanEnabled: + type: boolean + vxlanMTU: + description: 'VXLANMTU is the MTU to set on the tunnel device. See + Configuring MTU [Default: 1440]' + type: integer + vxlanPort: + type: integer + vxlanVNI: + type: integer + wireguardEnabled: + description: 'WireguardEnabled controls whether Wireguard is enabled. + [Default: false]' + type: boolean + wireguardInterfaceName: + description: 'WireguardInterfaceName specifies the name to use for + the Wireguard interface. [Default: wg.calico]' + type: string + wireguardListeningPort: + description: 'WireguardListeningPort controls the listening port used + by Wireguard. [Default: 51820]' + type: integer + wireguardMTU: + description: 'WireguardMTU controls the MTU on the Wireguard interface. + See Configuring MTU [Default: 1420]' + type: integer + wireguardRoutingRulePriority: + description: 'WireguardRoutingRulePriority controls the priority value + to use for the Wireguard routing rule. [Default: 99]' + type: integer + xdpEnabled: + description: 'XDPEnabled enables XDP acceleration for suitable untracked + incoming deny rules. [Default: true]' + type: boolean + xdpRefreshInterval: + description: 'XDPRefreshInterval is the period at which Felix re-checks + all XDP state to ensure that no other process has accidentally broken + Calico''s BPF maps or attached programs. Set to 0 to disable XDP + refresh. [Default: 90s]' + type: string + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml new file mode 100755 index 0000000..4360dda --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_globalnetworkpolicies.yaml @@ -0,0 +1,769 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkPolicy + listKind: GlobalNetworkPolicyList + plural: globalnetworkpolicies + singular: globalnetworkpolicy + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + applyOnForward: + description: ApplyOnForward indicates to apply the rules in this policy + on forward traffic. + type: boolean + doNotTrack: + description: DoNotTrack indicates whether packets matched by the rules + in this policy should go through the data plane's connection tracking, + such as Linux conntrack. If True, the rules in this policy are + applied before any data plane connection tracking, and packets allowed + by this policy are marked as not to be tracked. + type: boolean + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + namespaceSelector: + description: NamespaceSelector is an optional field for an expression + used to select a pod based on namespaces. + type: string + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + preDNAT: + description: PreDNAT indicates to apply the rules in this policy before + any DNAT. + type: boolean + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress rules are present in the policy. The + default is: \n - [ PolicyTypeIngress ], if there are no Egress rules + (including the case where there are also no Ingress rules) \n + - [ PolicyTypeEgress ], if there are Egress rules but no Ingress + rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are + both Ingress and Egress rules. \n When the policy is read back again, + Types will always be one of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml new file mode 100755 index 0000000..00a2980 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_globalnetworksets.yaml @@ -0,0 +1,51 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: GlobalNetworkSet + listKind: GlobalNetworkSetList + plural: globalnetworksets + singular: globalnetworkset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs + that share labels to allow rules to refer to them via selectors. The labels + of GlobalNetworkSet are not namespaced. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GlobalNetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml new file mode 100755 index 0000000..4824531 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_hostendpoints.yaml @@ -0,0 +1,106 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: HostEndpoint + listKind: HostEndpointList + plural: hostendpoints + singular: hostendpoint + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HostEndpointSpec contains the specification for a HostEndpoint + resource. + properties: + expectedIPs: + description: "The expected IP addresses (IPv4 and IPv6) of the endpoint. + If \"InterfaceName\" is not present, Calico will look for an interface + matching any of the IPs in the list and apply policy to that. Note: + \tWhen using the selector match criteria in an ingress or egress + security Policy \tor Profile, Calico converts the selector into + a set of IP addresses. For host \tendpoints, the ExpectedIPs field + is used for that purpose. (If only the interface \tname is specified, + Calico does not learn the IPs of the interface for use in match + \tcriteria.)" + items: + type: string + type: array + interfaceName: + description: "Either \"*\", or the name of a specific Linux interface + to apply policy to; or empty. \"*\" indicates that this HostEndpoint + governs all traffic to, from or through the default network namespace + of the host named by the \"Node\" field; entering and leaving that + namespace via any interface, including those from/to non-host-networked + local workloads. \n If InterfaceName is not \"*\", this HostEndpoint + only governs traffic that enters or leaves the host through the + specific interface named by InterfaceName, or - when InterfaceName + is empty - through the specific interface that has one of the IPs + in ExpectedIPs. Therefore, when InterfaceName is empty, at least + one expected IP must be specified. Only external interfaces (such + as \"eth0\") are supported here; it isn't possible for a HostEndpoint + to protect traffic through a specific local workload interface. + \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; + initially just pre-DNAT policy. Please check Calico documentation + for the latest position." + type: string + node: + description: The node name identifying the Calico node instance. + type: string + ports: + description: Ports contains the endpoint's named ports, which may + be referenced in security policy rules. + items: + properties: + name: + type: string + port: + type: integer + protocol: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + required: + - name + - port + - protocol + type: object + type: array + profiles: + description: A list of identifiers of security Profile objects that + apply to this endpoint. Each profile is applied in the order that + they appear in this list. Profile rules are applied after the selector-based + security policy. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml new file mode 100755 index 0000000..6c333a0 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamblocks.yaml @@ -0,0 +1,79 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamblocks.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMBlock + listKind: IPAMBlockList + plural: ipamblocks + singular: ipamblock + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMBlockSpec contains the specification for an IPAMBlock + resource. + properties: + affinity: + type: string + allocations: + items: + type: integer + # TODO: This nullable is manually added in. We should update controller-gen + # to handle []*int properly itself. + nullable: true + type: array + attributes: + items: + properties: + handle_id: + type: string + secondary: + additionalProperties: + type: string + type: object + type: object + type: array + cidr: + type: string + deleted: + type: boolean + strictAffinity: + type: boolean + unallocated: + items: + type: integer + type: array + required: + - allocations + - attributes + - cidr + - strictAffinity + - unallocated + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml new file mode 100755 index 0000000..3d85b16 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamconfigs.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamconfigs.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMConfig + listKind: IPAMConfigList + plural: ipamconfigs + singular: ipamconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMConfigSpec contains the specification for an IPAMConfig + resource. + properties: + autoAllocateBlocks: + type: boolean + maxBlocksPerHost: + description: MaxBlocksPerHost, if non-zero, is the max number of blocks + that can be affine to each host. + type: integer + strictAffinity: + type: boolean + required: + - autoAllocateBlocks + - strictAffinity + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml new file mode 100755 index 0000000..5c875cc --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ipamhandles.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ipamhandles.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPAMHandle + listKind: IPAMHandleList + plural: ipamhandles + singular: ipamhandle + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAMHandleSpec contains the specification for an IPAMHandle + resource. + properties: + block: + additionalProperties: + type: integer + type: object + deleted: + type: boolean + handleID: + type: string + required: + - block + - handleID + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ippools.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ippools.yaml new file mode 100755 index 0000000..7e41753 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_ippools.yaml @@ -0,0 +1,97 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: IPPool + listKind: IPPoolList + plural: ippools + singular: ippool + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec contains the specification for an IPPool resource. + properties: + blockSize: + description: The block size to use for IP address assignments from + this pool. Defaults to 26 for IPv4 and 112 for IPv6. + type: integer + cidr: + description: The pool CIDR. + type: string + disabled: + description: When disabled is true, Calico IPAM will not assign addresses + from this pool. + type: boolean + ipip: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + properties: + enabled: + description: When enabled is true, ipip tunneling will be used + to deliver packets to destinations within this pool. + type: boolean + mode: + description: The IPIP mode. This can be one of "always" or "cross-subnet". A + mode of "always" will also use IPIP tunneling for routing to + destination IP addresses within this pool. A mode of "cross-subnet" + will only use IPIP tunneling when the destination node is on + a different subnet to the originating node. The default value + (if not specified) is "always". + type: string + type: object + ipipMode: + description: Contains configuration for IPIP tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling + is disabled). + type: string + nat-outgoing: + description: 'Deprecated: this field is only used for APIv1 backwards + compatibility. Setting this field is not allowed, this field is + for internal use only.' + type: boolean + natOutgoing: + description: When nat-outgoing is true, packets sent from Calico networked + containers in this pool to destinations outside of this pool will + be masqueraded. + type: boolean + nodeSelector: + description: Allows IPPool to allocate for a specific node by label + selector. + type: string + vxlanMode: + description: Contains configuration for VXLAN tunneling for this pool. + If not specified, then this is defaulted to "Never" (i.e. VXLAN + tunneling is disabled). + type: string + required: + - cidr + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml new file mode 100755 index 0000000..aa23fd9 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_kubecontrollersconfigurations.yaml @@ -0,0 +1,230 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: kubecontrollersconfigurations.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: KubeControllersConfiguration + listKind: KubeControllersConfigurationList + plural: kubecontrollersconfigurations + singular: kubecontrollersconfiguration + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: KubeControllersConfigurationSpec contains the values of the + Kubernetes controllers configuration. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host endpoints. + Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation of + host endpoints for every node. [Default: Disabled]' + type: string + type: object + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform reconciliation + with the Calico datastore. [Default: 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which logs + are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: 9094]' + type: integer + required: + - controllers + type: object + status: + description: KubeControllersConfigurationStatus represents the status + of the configuration. It's useful for admins to be able to see the actual + config that was applied, which can be modified by environment variables + on the kube-controllers process. + properties: + environmentVars: + additionalProperties: + type: string + description: EnvironmentVars contains the environment variables on + the kube-controllers that influenced the RunningConfig. + type: object + runningConfig: + description: RunningConfig contains the effective config that is running + in the kube-controllers pod, after merging the API resource with + any environment variables. + properties: + controllers: + description: Controllers enables and configures individual Kubernetes + controllers + properties: + namespace: + description: Namespace enables and configures the namespace + controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + node: + description: Node enables and configures the node controller. + Enabled by default, set to nil to disable. + properties: + hostEndpoint: + description: HostEndpoint controls syncing nodes to host + endpoints. Disabled by default, set to nil to disable. + properties: + autoCreate: + description: 'AutoCreate enables automatic creation + of host endpoints for every node. [Default: Disabled]' + type: string + type: object + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + syncLabels: + description: 'SyncLabels controls whether to copy Kubernetes + node labels to Calico nodes. [Default: Enabled]' + type: string + type: object + policy: + description: Policy enables and configures the policy controller. + Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + serviceAccount: + description: ServiceAccount enables and configures the service + account controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + workloadEndpoint: + description: WorkloadEndpoint enables and configures the workload + endpoint controller. Enabled by default, set to nil to disable. + properties: + reconcilerPeriod: + description: 'ReconcilerPeriod is the period to perform + reconciliation with the Calico datastore. [Default: + 5m]' + type: string + type: object + type: object + etcdV3CompactionPeriod: + description: 'EtcdV3CompactionPeriod is the period between etcdv3 + compaction requests. Set to 0 to disable. [Default: 10m]' + type: string + healthChecks: + description: 'HealthChecks enables or disables support for health + checks [Default: Enabled]' + type: string + logSeverityScreen: + description: 'LogSeverityScreen is the log severity above which + logs are sent to the stdout. [Default: Info]' + type: string + prometheusMetricsPort: + description: 'PrometheusMetricsPort is the TCP port that the Prometheus + metrics server should bind to. Set to 0 to disable. [Default: + 9094]' + type: integer + required: + - controllers + type: object + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml new file mode 100755 index 0000000..8e4bd8b --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_networkpolicies.yaml @@ -0,0 +1,750 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkPolicy + listKind: NetworkPolicyList + plural: networkpolicies + singular: networkpolicy + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + egress: + description: The ordered set of egress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + ingress: + description: The ordered set of ingress rules. Each rule contains + a set of packet match criteria and a corresponding action to apply. + items: + description: "A Rule encapsulates a set of match criteria and an + action. Both selector-based security Policy and security Profiles + reference rules - separated out as a list of rules for both ingress + and egress packet matching. \n Each positive match criteria has + a negated version, prefixed with \"Not\". All the match criteria + within a rule must be satisfied for a packet to match. A single + rule can contain the positive and negative version of a match + and both must be satisfied for the rule to match." + properties: + action: + type: string + destination: + description: Destination contains the match criteria that apply + to destination entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + http: + description: HTTP contains match criteria that apply to HTTP + requests. + properties: + methods: + description: Methods is an optional field that restricts + the rule to apply only to HTTP requests that use one of + the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple + methods are OR'd together. + items: + type: string + type: array + paths: + description: 'Paths is an optional field that restricts + the rule to apply to HTTP requests that use one of the + listed HTTP Paths. Multiple paths are OR''d together. + e.g: - exact: /foo - prefix: /bar NOTE: Each entry may + ONLY specify either a `exact` or a `prefix` match. The + validator will check for it.' + items: + description: 'HTTPPath specifies an HTTP path to match. + It may be either of the form: exact: : which matches + the path exactly or prefix: : which matches + the path prefix' + properties: + exact: + type: string + prefix: + type: string + type: object + type: array + type: object + icmp: + description: ICMP is an optional field that restricts the rule + to apply to a specific type and code of ICMP traffic. This + should only be specified if the Protocol field is set to "ICMP" + or "ICMPv6". + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + ipVersion: + description: IPVersion is an optional field that restricts the + rule to only match a specific IP version. + type: integer + metadata: + description: Metadata contains additional information for this + rule + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a set of key value pairs that + give extra information about the rule + type: object + type: object + notICMP: + description: NotICMP is the negated version of the ICMP field. + properties: + code: + description: Match on a specific ICMP code. If specified, + the Type value must also be specified. This is a technical + limitation imposed by the kernel's iptables firewall, + which Calico uses to enforce the rule. + type: integer + type: + description: Match on a specific ICMP type. For example + a value of 8 refers to ICMP Echo Request (i.e. pings). + type: integer + type: object + notProtocol: + anyOf: + - type: integer + - type: string + description: NotProtocol is the negated version of the Protocol + field. + pattern: ^.* + x-kubernetes-int-or-string: true + protocol: + anyOf: + - type: integer + - type: string + description: "Protocol is an optional field that restricts the + rule to only apply to traffic of a specific IP protocol. Required + if any of the EntityRules contain Ports (because ports only + apply to certain protocols). \n Must be one of these string + values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\", + \"UDPLite\" or an integer in the range 1-255." + pattern: ^.* + x-kubernetes-int-or-string: true + source: + description: Source contains the match criteria that apply to + source entity. + properties: + namespaceSelector: + description: "NamespaceSelector is an optional field that + contains a selector expression. Only traffic that originates + from (or terminates at) endpoints within the selected + namespaces will be matched. When both NamespaceSelector + and Selector are defined on the same rule, then only workload + endpoints that are matched by both selectors will be selected + by the rule. \n For NetworkPolicy, an empty NamespaceSelector + implies that the Selector is limited to selecting only + workload endpoints in the same namespace as the NetworkPolicy. + \n For NetworkPolicy, `global()` NamespaceSelector implies + that the Selector is limited to selecting only GlobalNetworkSet + or HostEndpoint. \n For GlobalNetworkPolicy, an empty + NamespaceSelector implies the Selector applies to workload + endpoints across all namespaces." + type: string + nets: + description: Nets is an optional field that restricts the + rule to only apply to traffic that originates from (or + terminates at) IP addresses in any of the given subnets. + items: + type: string + type: array + notNets: + description: NotNets is the negated version of the Nets + field. + items: + type: string + type: array + notPorts: + description: NotPorts is the negated version of the Ports + field. Since only some protocols have ports, if any ports + are specified it requires the Protocol match in the Rule + to be set to "TCP" or "UDP". + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + notSelector: + description: NotSelector is the negated version of the Selector + field. See Selector field for subtleties with negated + selectors. + type: string + ports: + description: "Ports is an optional field that restricts + the rule to only apply to traffic that has a source (destination) + port that matches one of these ranges/values. This value + is a list of integers or strings that represent ranges + of ports. \n Since only some protocols have ports, if + any ports are specified it requires the Protocol match + in the Rule to be set to \"TCP\" or \"UDP\"." + items: + anyOf: + - type: integer + - type: string + pattern: ^.* + x-kubernetes-int-or-string: true + type: array + selector: + description: "Selector is an optional field that contains + a selector expression (see Policy for sample syntax). + \ Only traffic that originates from (terminates at) endpoints + matching the selector will be matched. \n Note that: in + addition to the negated version of the Selector (see NotSelector + below), the selector expression syntax itself supports + negation. The two types of negation are subtly different. + One negates the set of matched endpoints, the other negates + the whole match: \n \tSelector = \"!has(my_label)\" matches + packets that are from other Calico-controlled \tendpoints + that do not have the label \"my_label\". \n \tNotSelector + = \"has(my_label)\" matches packets that are not from + Calico-controlled \tendpoints that do have the label \"my_label\". + \n The effect is that the latter will accept packets from + non-Calico sources whereas the former is limited to packets + from Calico-controlled endpoints." + type: string + serviceAccounts: + description: ServiceAccounts is an optional field that restricts + the rule to only apply to traffic that originates from + (or terminates at) a pod running as a matching service + account. + properties: + names: + description: Names is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account whose name is in the list. + items: + type: string + type: array + selector: + description: Selector is an optional field that restricts + the rule to only apply to traffic that originates + from (or terminates at) a pod running as a service + account that matches the given label selector. If + both Names and Selector are specified then they are + AND'ed. + type: string + type: object + type: object + required: + - action + type: object + type: array + order: + description: Order is an optional field that specifies the order in + which the policy is applied. Policies with higher "order" are applied + after those with lower order. If the order is omitted, it may be + considered to be "infinite" - i.e. the policy will be applied last. Policies + with identical order will be applied in alphanumerical order based + on the Policy "Name". + type: number + selector: + description: "The selector is an expression used to pick pick out + the endpoints that the policy should be applied to. \n Selector + expressions follow this syntax: \n \tlabel == \"string_literal\" + \ -> comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\" + \ -> not equal; also matches if label is not present \tlabel in + { \"a\", \"b\", \"c\", ... } -> true if the value of label X is + one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\", + ... } -> true if the value of label X is not one of \"a\", \"b\", + \"c\" \thas(label_name) -> True if that label is present \t! expr + -> negation of expr \texpr && expr -> Short-circuit and \texpr + || expr -> Short-circuit or \t( expr ) -> parens for grouping \tall() + or the empty selector -> matches all endpoints. \n Label names are + allowed to contain alphanumerics, -, _ and /. String literals are + more permissive but they do not support escape characters. \n Examples + (with made-up labels): \n \ttype == \"webserver\" && deployment + == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment != + \"dev\" \t! has(label_name)" + type: string + serviceAccountSelector: + description: ServiceAccountSelector is an optional field for an expression + used to select a pod based on service accounts. + type: string + types: + description: "Types indicates whether this policy applies to ingress, + or to egress, or to both. When not explicitly specified (and so + the value on creation is empty or nil), Calico defaults Types according + to what Ingress and Egress are present in the policy. The default + is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including + the case where there are also no Ingress rules) \n - [ PolicyTypeEgress + ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress, + PolicyTypeEgress ], if there are both Ingress and Egress rules. + \n When the policy is read back again, Types will always be one + of these values, never empty or nil." + items: + description: PolicyType enumerates the possible values of the PolicySpec + Types field. + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_networksets.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_networksets.yaml new file mode 100755 index 0000000..4bb0e21 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/calico/kdd/crd.projectcalico.org_networksets.yaml @@ -0,0 +1,49 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: networksets.crd.projectcalico.org +spec: + group: crd.projectcalico.org + names: + kind: NetworkSet + listKind: NetworkSetList + plural: networksets + singular: networkset + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: NetworkSetSpec contains the specification for a NetworkSet + resource. + properties: + nets: + description: The list of IP networks that belong to this set. + items: + type: string + type: array + type: object + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_imagesets_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_imagesets_crd.yaml new file mode 100755 index 0000000..d09ae1c --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_imagesets_crd.yaml @@ -0,0 +1,75 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: imagesets.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: ImageSet + listKind: ImageSetList + plural: imagesets + singular: imageset + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ImageSet is used to specify image digests for the images that + the operator deploys. The name of the ImageSet is expected to be in the + format `-`. The `variant` used is `enterprise` if the + InstallationSpec Variant is `TigeraSecureEnterprise` otherwise it is `calico`. + The `release` must match the version of the variant that the operator is + built to deploy, this version can be obtained by passing the `--version` + flag to the operator binary. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageSetSpec defines the desired state of ImageSet. + properties: + images: + description: Images is the list of images to use digests. All images + that the operator will deploy must be specified. + items: + properties: + digest: + description: Digest is the image identifier that will be used + for the Image. The field should not include a leading `@` + and must be prefixed with `sha256:`. + type: string + image: + description: Image is an image that the operator deploys and + instead of using the built in tag the operator will use the + Digest for the image identifier. The value should be the image + name without registry or tag or digest. For the image `docker.io/calico/node:v3.17.1` + it should be represented as `calico/node` + type: string + required: + - digest + - image + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_installations_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_installations_crd.yaml new file mode 100755 index 0000000..a327924 --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_installations_crd.yaml @@ -0,0 +1,1242 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: installations.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: Installation + listKind: InstallationList + plural: installations + singular: installation + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Installation configures an installation of Calico or Calico Enterprise. + At most one instance of this resource is supported. It must be named "default". + The Installation API installs core networking and network policy components, + and provides general install-time configuration. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Specification of the desired state for the Calico or Calico + Enterprise installation. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration options + for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip forwarding + will be enabled for containers in the CNI configuration. Default: + Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the Calico + CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create if + none exist. At most one IP pool of each address family may be + specified. If omitted, a single pool will be configured if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the main + IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the IP + Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector that + will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + linuxDataplane: + description: 'LinuxDataplane is used to select the dataplane used + for Linux nodes. In particular, it causes the operator to add + required mounts and environment variables for the particular + dataplane. If not specified, iptables mode is used. Default: + Iptables' + enum: + - Iptables + - BPF + type: string + mtu: + description: MTU specifies the maximum transmission unit to use + on the pod network. If not specified, Calico will perform MTU + auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based on which + source address on the node is used to reach the specified + IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on which + addresses on the nodes are within one of the provided CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching parameters + to select an interface, performing best-effort filtering + based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based on + interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a CertificateSigningRequest + to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. + This feature requires that you bring your own CSR signing and approval + process, otherwise pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate a + key pair that is associated with the X.509 certificate request. + Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature of + the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to accommodate + for clusters with multiple signers. Must be formatted as: `/`.' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management that + will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For CNI + Plugin Calico, this field defaults to Calico. * For CNI + Plugin GKE, this field defaults to HostLocal. * For CNI + Plugin AzureVNET, this field defaults to AzureVNET. * For + CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only if the + CNI plugin is set to Calico, for all other values of the + CNI plugin the plugin binaries and CNI config is a dependency + that is expected to be installed separately. \n Default: + Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in the + Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider AKS, + this field defaults to AzureVNET. * For KubernetesProvider EKS, + this field defaults to AmazonVPC. * If aws-node daemonset exists + in kube-system when the Installation resource is created, this + field defaults to AmazonVPC. * For all other cases this field + defaults to Calico. \n For the value Calico, the CNI plugin + binaries and CNI config will be installed as part of deployment, + for all other values the CNI plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. Node, Typha, and KubeControllers + are supported for installations. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of limits + and requests for compute resources such as cpu and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control plane + nodes on which to run Calico components. This is globally applied + to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which are + then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates any + taint that matches the triple using the matching + operator . + properties: + effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match all + values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod + can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, it + is not set, which means tolerate the taint forever (do not + evict). Zero and negative values will be treated as 0 (evict + immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path for + FlexVolume. If not specified, FlexVolume will be enabled by default. + If set to 'None', FlexVolume will be disabled. The default is based + on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to be + specified. If specified then the specified value will be used as + the image path for each image. If not specified or empty, the default + for each image will be used. A special case value, UseDefault, is + supported to explicitly specify the default image path will be used + for each image. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + imagePrefix: + description: "ImagePrefix allows for the prefix part of an image to + be specified. If specified then the given value will be used as + a prefix on each image. If not specified or empty, no prefix will + be used. A special case value, UseDefault, is supported to explicitly + specify the default image prefix will be used for each image. \n + Image format: `//:` + \n This option allows configuring the `` portion of + the above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images to + be pulled. + items: + description: LocalObjectReference contains enough information to + let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider of + the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to automatically + determine the current provider. If the specified value is not empty, + the Operator will still attempt auto-detection, but will additionally + compare the auto-detected value to the specified value to confirm + they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node serves + prometheus metrics on. By default, metrics are not enabled. If specified, + this overrides any FelixConfiguration resources which may exist. + If omitted, then prometheus metrics may still be configured through + FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if type + = "RollingUpdate". --- TODO: Update this to follow our convention + for oneOf, whatever we decide it to be. Same as Deployment `strategy.rollingUpdate`. + See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that can + be unavailable during the update. Value can be an absolute + number (ex: 5) or a percentage of total number of DaemonSet + pods at the start of the update (ex: 10%). Absolute number + is calculated from percentage by rounding up. This cannot + be 0. Default value is 1. Example: when this is set to 30%, + at most 30% of the total number of nodes that should be + running the daemon pod (i.e. status.desiredNumberScheduled) + can have their pods stopped for an update at any given time. + The update starts by stopping at most 30% of those DaemonSet + pods and then brings up new DaemonSet pods in their place. + Once the new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times during + the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for component + Docker images. If specified, all images will be pulled from this + registry. If not specified then the default registries will be used. + A special case value, UseDefault, is supported to explicitly specify + the default registries will be used. \n Image format: `//:` + \n This option allows configuring the `` portion of the + above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity characteristics + for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling rules + for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects (i.e. + is also a no-op). + properties: + preference: + description: A node selector term, associated with the + corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha serves + prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico or + TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + status: + description: Most recently observed state for the Calico or Calico Enterprise + installation. + properties: + computed: + description: Computed is the final installation including overlaid + resources. + properties: + calicoNetwork: + description: CalicoNetwork specifies networking configuration + options for Calico. + properties: + bgp: + description: BGP configures whether or not to enable Calico's + BGP capabilities. + enum: + - Enabled + - Disabled + type: string + containerIPForwarding: + description: 'ContainerIPForwarding configures whether ip + forwarding will be enabled for containers in the CNI configuration. + Default: Disabled' + enum: + - Enabled + - Disabled + type: string + hostPorts: + description: 'HostPorts configures whether or not Calico will + support Kubernetes HostPorts. Valid only when using the + Calico CNI plugin. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + ipPools: + description: IPPools contains a list of IP pools to create + if none exist. At most one IP pool of each address family + may be specified. If omitted, a single pool will be configured + if needed. + items: + properties: + blockSize: + description: 'BlockSize specifies the CIDR prefex length + to use when allocating per-node IP blocks from the + main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)' + format: int32 + type: integer + cidr: + description: CIDR contains the address range for the + IP Pool in classless inter-domain routing format. + type: string + encapsulation: + description: 'Encapsulation specifies the encapsulation + type that will be used with the IP Pool. Default: + IPIP' + enum: + - IPIPCrossSubnet + - IPIP + - VXLAN + - VXLANCrossSubnet + - None + type: string + natOutgoing: + description: 'NATOutgoing specifies if NAT will be enabled + or disabled for outgoing traffic. Default: Enabled' + enum: + - Enabled + - Disabled + type: string + nodeSelector: + description: 'NodeSelector specifies the node selector + that will be set for the IP Pool. Default: ''all()''' + type: string + required: + - cidr + type: object + type: array + linuxDataplane: + description: 'LinuxDataplane is used to select the dataplane + used for Linux nodes. In particular, it causes the operator + to add required mounts and environment variables for the + particular dataplane. If not specified, iptables mode is + used. Default: Iptables' + enum: + - Iptables + - BPF + type: string + mtu: + description: MTU specifies the maximum transmission unit to + use on the pod network. If not specified, Calico will perform + MTU auto-detection based on the cluster network. + format: int32 + type: integer + multiInterfaceMode: + description: 'MultiInterfaceMode configures what will configure + multiple interface per pod. Only valid for Calico Enterprise + installations using the Calico CNI plugin. Default: None' + enum: + - None + - Multus + type: string + nodeAddressAutodetectionV4: + description: NodeAddressAutodetectionV4 specifies an approach + to automatically detect node IPv4 addresses. If not specified, + will use default auto-detection settings to acquire an IPv4 + address for each node. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + nodeAddressAutodetectionV6: + description: NodeAddressAutodetectionV6 specifies an approach + to automatically detect node IPv6 addresses. If not specified, + IPv6 addresses will not be auto-detected. + properties: + canReach: + description: CanReach enables IP auto-detection based + on which source address on the node is used to reach + the specified IP or domain. + type: string + cidrs: + description: CIDRS enables IP auto-detection based on + which addresses on the nodes are within one of the provided + CIDRs. + items: + type: string + type: array + firstFound: + description: FirstFound uses default interface matching + parameters to select an interface, performing best-effort + filtering based on well-known interface names. + type: boolean + interface: + description: Interface enables IP auto-detection based + on interfaces that match the given regex. + type: string + skipInterface: + description: SkipInterface enables IP auto-detection based + on interfaces that do not match the given regex. + type: string + type: object + type: object + certificateManagement: + description: CertificateManagement configures pods to submit a + CertificateSigningRequest to the certificates.k8s.io/v1beta1 + API in order to obtain TLS certificates. This feature requires + that you bring your own CSR signing and approval process, otherwise + pods will be stuck during initialization. + properties: + caCert: + description: Certificate of the authority that signs the CertificateSigningRequests + in PEM format. + format: byte + type: string + keyAlgorithm: + description: 'Specify the algorithm used by pods to generate + a key pair that is associated with the X.509 certificate + request. Default: RSAWithSize2048' + enum: + - "" + - RSAWithSize2048 + - RSAWithSize4096 + - RSAWithSize8192 + - ECDSAWithCurve256 + - ECDSAWithCurve384 + - ECDSAWithCurve521 + type: string + signatureAlgorithm: + description: 'Specify the algorithm used for the signature + of the X.509 certificate request. Default: SHA256WithRSA' + enum: + - "" + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + type: string + signerName: + description: 'When a CSR is issued to the certificates.k8s.io + API, the signerName is added to the request in order to + accommodate for clusters with multiple signers. Must be + formatted as: `/`.' + type: string + required: + - caCert + - signerName + type: object + cni: + description: CNI specifies the CNI that will be used by this installation. + properties: + ipam: + description: IPAM specifies the pod IP address management + that will be used in the Calico or Calico Enterprise installation. + properties: + type: + description: "Specifies the IPAM plugin that will be used + in the Calico or Calico Enterprise installation. * For + CNI Plugin Calico, this field defaults to Calico. * + For CNI Plugin GKE, this field defaults to HostLocal. + * For CNI Plugin AzureVNET, this field defaults to AzureVNET. + * For CNI Plugin AmazonVPC, this field defaults to AmazonVPC. + \n The IPAM plugin is installed and configured only + if the CNI plugin is set to Calico, for all other values + of the CNI plugin the plugin binaries and CNI config + is a dependency that is expected to be installed separately. + \n Default: Calico" + enum: + - Calico + - HostLocal + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + type: + description: "Specifies the CNI plugin that will be used in + the Calico or Calico Enterprise installation. * For KubernetesProvider + GKE, this field defaults to GKE. * For KubernetesProvider + AKS, this field defaults to AzureVNET. * For KubernetesProvider + EKS, this field defaults to AmazonVPC. * If aws-node daemonset + exists in kube-system when the Installation resource is + created, this field defaults to AmazonVPC. * For all other + cases this field defaults to Calico. \n For the value Calico, + the CNI plugin binaries and CNI config will be installed + as part of deployment, for all other values the CNI plugin + binaries and CNI config is a dependency that is expected + to be installed separately. \n Default: Calico" + enum: + - Calico + - GKE + - AmazonVPC + - AzureVNET + type: string + required: + - type + type: object + componentResources: + description: ComponentResources can be used to customize the resource + requirements for each component. Node, Typha, and KubeControllers + are supported for installations. + items: + description: The ComponentResource struct associates a ResourceRequirements + with a component by name + properties: + componentName: + description: ComponentName is an enum which identifies the + component + enum: + - Node + - Typha + - KubeControllers + type: string + resourceRequirements: + description: ResourceRequirements allows customization of + limits and requests for compute resources such as cpu + and memory. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of + compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/' + type: object + type: object + required: + - componentName + - resourceRequirements + type: object + type: array + controlPlaneNodeSelector: + additionalProperties: + type: string + description: ControlPlaneNodeSelector is used to select control + plane nodes on which to run Calico components. This is globally + applied to all resources created by the operator excluding daemonsets. + type: object + controlPlaneTolerations: + description: ControlPlaneTolerations specify tolerations which + are then globally applied to all resources created by the operator. + items: + description: The pod this Toleration is attached to tolerates + any taint that matches the triple using + the matching operator . + properties: + effect: + description: Effect indicates the taint effect to match. + Empty means match all taint effects. When specified, allowed + values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match + all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to + the value. Valid operators are Exists and Equal. Defaults + to Equal. Exists is equivalent to wildcard for value, + so that a pod can tolerate all taints of a particular + category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of + time the toleration (which must be of effect NoExecute, + otherwise this field is ignored) tolerates the taint. + By default, it is not set, which means tolerate the taint + forever (do not evict). Zero and negative values will + be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + flexVolumePath: + description: FlexVolumePath optionally specifies a custom path + for FlexVolume. If not specified, FlexVolume will be enabled + by default. If set to 'None', FlexVolume will be disabled. The + default is based on the kubernetesProvider. + type: string + imagePath: + description: "ImagePath allows for the path part of an image to + be specified. If specified then the specified value will be + used as the image path for each image. If not specified or empty, + the default for each image will be used. A special case value, + UseDefault, is supported to explicitly specify the default image + path will be used for each image. \n Image format: `//:` + \n This option allows configuring the `` portion + of the above format." + type: string + imagePrefix: + description: "ImagePrefix allows for the prefix part of an image + to be specified. If specified then the given value will be used + as a prefix on each image. If not specified or empty, no prefix + will be used. A special case value, UseDefault, is supported + to explicitly specify the default image prefix will be used + for each image. \n Image format: `//:` + \n This option allows configuring the `` portion + of the above format." + type: string + imagePullSecrets: + description: ImagePullSecrets is an array of references to container + registry pull secrets to use. These are applied to all images + to be pulled. + items: + description: LocalObjectReference contains enough information + to let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + type: array + kubernetesProvider: + description: KubernetesProvider specifies a particular provider + of the Kubernetes platform and enables provider-specific configuration. + If the specified value is empty, the Operator will attempt to + automatically determine the current provider. If the specified + value is not empty, the Operator will still attempt auto-detection, + but will additionally compare the auto-detected value to the + specified value to confirm they match. + enum: + - "" + - EKS + - GKE + - AKS + - OpenShift + - DockerEnterprise + type: string + nodeMetricsPort: + description: NodeMetricsPort specifies which port calico/node + serves prometheus metrics on. By default, metrics are not enabled. + If specified, this overrides any FelixConfiguration resources + which may exist. If omitted, then prometheus metrics may still + be configured through FelixConfiguration. + format: int32 + type: integer + nodeUpdateStrategy: + description: NodeUpdateStrategy can be used to customize the desired + update strategy, such as the MaxUnavailable field. + properties: + rollingUpdate: + description: 'Rolling update config params. Present only if + type = "RollingUpdate". --- TODO: Update this to follow + our convention for oneOf, whatever we decide it to be. Same + as Deployment `strategy.rollingUpdate`. See https://github.com/kubernetes/kubernetes/issues/35345' + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'The maximum number of DaemonSet pods that + can be unavailable during the update. Value can be an + absolute number (ex: 5) or a percentage of total number + of DaemonSet pods at the start of the update (ex: 10%). + Absolute number is calculated from percentage by rounding + up. This cannot be 0. Default value is 1. Example: when + this is set to 30%, at most 30% of the total number + of nodes that should be running the daemon pod (i.e. + status.desiredNumberScheduled) can have their pods stopped + for an update at any given time. The update starts by + stopping at most 30% of those DaemonSet pods and then + brings up new DaemonSet pods in their place. Once the + new pods are available, it then proceeds onto other + DaemonSet pods, thus ensuring that at least 70% of original + number of DaemonSet pods are available at all times + during the update.' + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + registry: + description: "Registry is the default Docker registry used for + component Docker images. If specified, all images will be pulled + from this registry. If not specified then the default registries + will be used. A special case value, UseDefault, is supported + to explicitly specify the default registries will be used. \n + Image format: `//:` + \n This option allows configuring the `` portion of + the above format." + type: string + typhaAffinity: + description: TyphaAffinity allows configuration of node affinity + characteristics for Typha pods. + properties: + nodeAffinity: + description: NodeAffinity describes node affinity scheduling + rules for typha. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects + (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is + a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. + type: string + values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If the + operator is Exists or DoesNotExist, + the values array must be empty. If the + operator is Gt or Lt, the values array + must have a single element, which will + be interpreted as an integer. This array + is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + type: object + type: object + typhaMetricsPort: + description: TyphaMetricsPort specifies which port calico/typha + serves prometheus metrics on. By default, metrics are not enabled. + format: int32 + type: integer + variant: + description: 'Variant is the product to install - one of Calico + or TigeraSecureEnterprise Default: Calico' + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + imageSet: + description: ImageSet is the name of the ImageSet being used, if there + is an ImageSet that is being used. If an ImageSet is not being used + then this will not be set. + type: string + mtu: + description: MTU is the most recently observed value for pod network + MTU. This may be an explicitly configured value, or based on Calico's + native auto-detetion. + format: int32 + type: integer + variant: + description: Variant is the most recently observed installed variant + - one of Calico or TigeraSecureEnterprise + enum: + - Calico + - TigeraSecureEnterprise + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_tigerastatuses_crd.yaml b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_tigerastatuses_crd.yaml new file mode 100755 index 0000000..abfe29c --- /dev/null +++ b/charts/rke2-calico/rke2-calico-crd/v1.0.103/templates/operator.tigera.io_tigerastatuses_crd.yaml @@ -0,0 +1,104 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.3.0 + name: tigerastatuses.operator.tigera.io +spec: + group: operator.tigera.io + names: + kind: TigeraStatus + listKind: TigeraStatusList + plural: tigerastatuses + singular: tigerastatus + scope: Cluster + versions: + - additionalPrinterColumns: + - description: Whether the component running and stable. + jsonPath: .status.conditions[?(@.type=='Available')].status + name: Available + type: string + - description: Whether the component is processing changes. + jsonPath: .status.conditions[?(@.type=='Progressing')].status + name: Progressing + type: string + - description: Whether the component is degraded. + jsonPath: .status.conditions[?(@.type=='Degraded')].status + name: Degraded + type: string + - description: The time the component's Available status last changed. + jsonPath: .status.conditions[?(@.type=='Available')].lastTransitionTime + name: Since + type: date + name: v1 + schema: + openAPIV3Schema: + description: TigeraStatus represents the most recently observed status for + Calico or a Calico Enterprise functional area. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: TigeraStatusSpec defines the desired state of TigeraStatus + type: object + status: + description: TigeraStatusStatus defines the observed state of TigeraStatus + properties: + conditions: + description: Conditions represents the latest observed set of conditions + for this component. A component may be one or more of Available, + Progressing, or Degraded. + items: + description: TigeraStatusCondition represents a condition attached + to a particular component. + properties: + lastTransitionTime: + description: The timestamp representing the start time for the + current status. + format: date-time + type: string + message: + description: Optionally, a detailed message providing additional + context. + type: string + reason: + description: A brief reason explaining the condition. + type: string + status: + description: The status of the condition. May be True, False, + or Unknown. + type: string + type: + description: The type of condition. May be Available, Progressing, + or Degraded. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + required: + - conditions + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/Chart.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/Chart.yaml new file mode 100755 index 0000000..cbf7a87 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/Chart.yaml @@ -0,0 +1,7 @@ +annotations: + catalog.cattle.io/namespace: tigera-operator +apiVersion: v2 +appVersion: v3.19.2 +description: Installs the Tigera operator for Calico +name: rke2-calico +version: v3.19.2-203 diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/_helpers.tpl b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/_helpers.tpl new file mode 100755 index 0000000..3ac4a1c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/_helpers.tpl @@ -0,0 +1,10 @@ +{{/* generate the image name for a component*/}} +{{- define "tigera-operator.image" -}} +{{- if .Values.global.systemDefaultRegistry -}} +{{- $_ := set .Values.tigeraOperator "registry" .Values.global.systemDefaultRegistry -}} +{{- end -}} +{{- if .Values.tigeraOperator.registry -}} + {{- .Values.tigeraOperator.registry | trimSuffix "/" -}}/ +{{- end -}} +{{- .Values.tigeraOperator.image -}}:{{- .Values.tigeraOperator.version -}} +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/certs/certs-node.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/certs/certs-node.yaml new file mode 100755 index 0000000..5830c2a --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/certs/certs-node.yaml @@ -0,0 +1,13 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +apiVersion: v1 +kind: Secret +metadata: + name: node-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.node.cert" .Values.certs.node.cert | b64enc }} + key.key: {{ required "must set certs.node.key" .Values.certs.node.key | b64enc }} + common-name: {{ required "must set certs.node.commonName" .Values.certs.node.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/certs/certs-typha.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/certs/certs-typha.yaml new file mode 100755 index 0000000..4463e89 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/certs/certs-typha.yaml @@ -0,0 +1,23 @@ +{{/* if any of .Values.certs.node or .Values.certs.typha is not nil */}} +{{ if without (concat (values .Values.certs.node) (values .Values.certs.typha)) nil }} +kind: ConfigMap +apiVersion: v1 +metadata: + name: typha-ca + namespace: tigera-operator +data: + caBundle: | +{{ required "must set certs.typha.caBundle" .Values.certs.typha.caBundle | indent 4}} +--- + +apiVersion: v1 +kind: Secret +metadata: + name: typha-certs + namespace: tigera-operator +type: Opaque +data: + cert.crt: {{ required "must set certs.typha.cert" .Values.certs.typha.cert | b64enc }} + key.key: {{ required "must set certs.typha.key" .Values.certs.typha.key | b64enc }} + common-name: {{ required "must set certs.typha.commonName" .Values.certs.typha.commonName | b64enc }} +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/crs/custom-resources.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/crs/custom-resources.yaml new file mode 100755 index 0000000..7e97770 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/crs/custom-resources.yaml @@ -0,0 +1,24 @@ +{{ if .Values.installation.enabled }} +{{ $installSpec := omit .Values.installation "enabled" }} +{{ $secrets := list }} +{{ range $name := keys .Values.imagePullSecrets -}} +{{ $item := dict "name" $name }} +{{ $secrets = append $secrets $item }} +{{ end }} +{{ $_ := set $installSpec "imagePullSecrets" $secrets }} +{{ $defaultRegistry := get $installSpec "registry" }} +{{ $finalRegistry := coalesce .Values.global.systemDefaultRegistry $defaultRegistry }} +{{ $_ := set $installSpec "registry" $finalRegistry }} +{{ $defaultipPools := get .Values.installation.calicoNetwork "ipPools" | first }} +{{ $defaultCIDR := get $defaultipPools "cidr" }} +{{ $finalCIDR := coalesce .Values.global.clusterCIDR $defaultCIDR }} +{{ $_ := set $defaultipPools "cidr" $finalCIDR }} + +apiVersion: operator.tigera.io/v1 +kind: Installation +metadata: + name: default +spec: +{{ $installSpec | toYaml | indent 2 }} + +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/felixconfig.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/felixconfig.yaml new file mode 100755 index 0000000..9d030ba --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/felixconfig.yaml @@ -0,0 +1,6 @@ +apiVersion: crd.projectcalico.org/v1 +kind: FelixConfiguration +metadata: + name: default +spec: + featureDetectOverride: {{ .Values.felixConfiguration.featureDetectOverride }} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/ipamconfig.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/ipamconfig.yaml new file mode 100755 index 0000000..22dba0e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/ipamconfig.yaml @@ -0,0 +1,7 @@ +apiVersion: crd.projectcalico.org/v1 +kind: IPAMConfig +metadata: + name: default +spec: + strictAffinity: {{ .Values.ipamConfig.strictAffinity }} + autoAllocateBlocks: {{ .Values.ipamConfig.autoAllocateBlocks }} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/00-namespace-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/00-namespace-tigera-operator.yaml new file mode 100755 index 0000000..b7e260e --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/00-namespace-tigera-operator.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: tigera-operator + annotations: +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/node-selector: "" +{{- end }} + labels: + name: tigera-operator +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + openshift.io/run-level: "0" +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/01-imagepullsecret.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/01-imagepullsecret.yaml new file mode 100755 index 0000000..b90407c --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/01-imagepullsecret.yaml @@ -0,0 +1,15 @@ +{{- $envAll := . }} +{{- if .Values.imagePullSecrets -}} + +{{range $key, $value := .Values.imagePullSecrets -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $key }} + namespace: tigera-operator +data: + .dockerconfigjson: {{ $value | b64enc }} +type: kubernetes.io/dockerconfigjson +{{- end -}} + +{{- end -}} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-configmap-calico-resources.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-configmap-calico-resources.yaml new file mode 100755 index 0000000..2270813 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-configmap-calico-resources.yaml @@ -0,0 +1,27 @@ +{{- if eq .Values.installation.kubernetesProvider "openshift" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: calico-resources + namespace: tigera-operator +data: + # To create Calico resources before Calico components are started add + # an entry here and the contents of the resource under the entry. + # The resources here should all be projectcalico.org/v3. + # Multiple resources/entries can be added to this ConfigMap. + # + # If you need to remove a resource that was added to this ConfigMap + # you should remove it from here or else it will be re-created. + # + # example-global-network-set.yaml: | + # apiVersion: projectcalico.org/v3 + # kind: GlobalNetworkSet + # metadata: + # name: a-name-for-the-set + # labels: + # role: external-database + # spec: + # nets: + # - 198.51.100.0/28 + # - 203.0.113.0/24 +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml new file mode 100755 index 0000000..97e5c04 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml @@ -0,0 +1,47 @@ +{{ if ne .Values.installation.kubernetesProvider "openshift" }} +# This should not be rendered for an OpenShift install. +# OpenShift uses SecurityContextConstraints instead. +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: tigera-operator + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'hostPath' + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + # Assume that persistentVolumes set up by the cluster admin are safe to use. + - 'persistentVolumeClaim' + hostNetwork: true + hostPorts: + - min: 0 + max: 65535 + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{ end }} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-role-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-role-tigera-operator.yaml new file mode 100755 index 0000000..70b68b2 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-role-tigera-operator.yaml @@ -0,0 +1,253 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tigera-operator +rules: + - apiGroups: + - "" + resources: + - namespaces + - pods + - podtemplates + - services + - endpoints + - events + - configmaps + - secrets + - serviceaccounts + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + # Need to update node labels when migrating nodes. + - 'get' + - 'patch' + - 'list' + # We need this for Typha autoscaling + - 'watch' + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - rolebindings + - roles + verbs: + - create + - get + - list + - update + - delete + - watch + - bind + - escalate + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - statefulsets + verbs: + - create + - get + - list + - patch + - update + - delete + - watch + - apiGroups: + - apps + resourceNames: + - tigera-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - operator.tigera.io + resources: + - '*' + verbs: + - create + - get + - list + - update + - patch + - delete + - watch + - apiGroups: + - crd.projectcalico.org + resources: + - felixconfigurations + verbs: + - patch + - apiGroups: + - crd.projectcalico.org + resources: + - ippools + - kubecontrollersconfigurations + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - get + - list + - update + - delete + - watch + - apiGroups: + - apiregistration.k8s.io + resources: + - apiservices + verbs: + - list + - watch + # Needed for operator lock + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - update + - delete + - watch +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + # When running in OpenShift, we need to update networking config. + - apiGroups: + - config.openshift.io + resources: + - networks/status + verbs: + - get + - list + - update + - apiGroups: + - config.openshift.io + resources: + - networks + - infrastructures + verbs: + - get + - list + - patch + - watch + # On OpenShift, we need to modify SCCs. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - create + - get + - list + - update + - delete + - watch + # The following rule is only for operator certification purposes. + # The operator normally runs in a namespace with openshift.io/run-level=0 which bypasses SCC. + # However in certification tests, the operator is run in a normal namespace so this + # rule is needed for host networking and hostPath volume access. + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - hostaccess + verbs: + - use + # Need these permissions for the calicoctl init container. + - apiGroups: + - crd.projectcalico.org + resources: + - bgpconfigurations + - bgppeers + - felixconfigurations + - kubecontrollersconfigurations + - globalnetworkpolicies + - globalnetworksets + - hostendpoints + - ippools + - networkpolicies + - networksets + verbs: + - create + - apiGroups: + - crd.projectcalico.org + resources: + - ipamblocks + verbs: + - list + # For AWS security group setup. + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - create + - update + - list + - watch +{{- else }} + # Add the appropriate pod security policy permissions + - apiGroups: + - policy + resources: + - podsecuritypolicies + resourceNames: + - tigera-operator + verbs: + - use + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - get + - list + - watch + - create + - update +# Add the permissions to monitor the status of certificatesigningrequests when certificate management is enabled. + - apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + verbs: + - list +{{- end }} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-rolebinding-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-rolebinding-tigera-operator.yaml new file mode 100755 index 0000000..5689683 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-rolebinding-tigera-operator.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tigera-operator +subjects: +- kind: ServiceAccount + name: tigera-operator + namespace: tigera-operator +roleRef: + kind: ClusterRole + name: tigera-operator + apiGroup: rbac.authorization.k8s.io diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml new file mode 100755 index 0000000..14cd955 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tigera-operator + namespace: tigera-operator diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-tigera-operator.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-tigera-operator.yaml new file mode 100755 index 0000000..e705255 --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/tigera-operator/02-tigera-operator.yaml @@ -0,0 +1,85 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tigera-operator + namespace: tigera-operator + labels: + k8s-app: tigera-operator +spec: + replicas: 1 + selector: + matchLabels: + name: tigera-operator + template: + metadata: + labels: + name: tigera-operator + k8s-app: tigera-operator + spec: + nodeSelector: + kubernetes.io/os: linux + tolerations: + - effect: NoExecute + operator: Exists + - effect: NoSchedule + operator: Exists + serviceAccountName: tigera-operator + hostNetwork: true + # This must be set when hostNetwork is true or else the cluster services won't resolve + dnsPolicy: ClusterFirstWithHostNet + containers: + - name: tigera-operator + image: {{ template "tigera-operator.image" . }} + imagePullPolicy: IfNotPresent + command: + - operator + volumeMounts: + - name: var-lib-calico + readOnly: true + mountPath: /var/lib/calico + env: + - name: WATCH_NAMESPACE + value: "" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: "tigera-operator" + - name: TIGERA_OPERATOR_INIT_IMAGE_VERSION + value: {{.Values.tigeraOperator.version}} + envFrom: + - configMapRef: + name: kubernetes-services-endpoint + optional: true + volumes: + - name: var-lib-calico + hostPath: + path: /var/lib/calico +{{- if eq .Values.installation.kubernetesProvider "openshift" }} + - name: calico-resources + configMap: + defaultMode: 0400 + name: calico-resources + - name: install-resources-script + configMap: + defaultMode: 0777 + name: install-resources-script + initContainers: + - name: create-initial-resources + image: {{.Values.calicoctl.image}}:{{.Values.calicoctl.tag}} + env: + - name: DATASTORE_TYPE + value: kubernetes + command: + - calicoctl + args: + - create + - --skip-exists + - --skip-empty + - -f + - /calico-resources + volumeMounts: + - name: calico-resources + mountPath: /calico-resources +{{- end}} diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/validate-install-crd.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/validate-install-crd.yaml new file mode 100755 index 0000000..4fcb3cf --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/templates/validate-install-crd.yaml @@ -0,0 +1,31 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "crd.projectcalico.org/v1/BGPConfiguration" false -}} +# {{- set $found "crd.projectcalico.org/v1/BGPPeer" false -}} +# {{- set $found "crd.projectcalico.org/v1/BlockAffinity" false -}} +# {{- set $found "crd.projectcalico.org/v1/ClusterInformation" false -}} +# {{- set $found "crd.projectcalico.org/v1/FelixConfiguration" false -}} +# {{- set $found "crd.projectcalico.org/v1/GlobalNetworkPolicy" false -}} +# {{- set $found "crd.projectcalico.org/v1/GlobalNetworkSet" false -}} +# {{- set $found "crd.projectcalico.org/v1/HostEndpoint" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPAMBlock" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPAMConfig" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPAMHandle" false -}} +# {{- set $found "crd.projectcalico.org/v1/IPPool" false -}} +# {{- set $found "crd.projectcalico.org/v1/KubeControllersConfiguration" false -}} +# {{- set $found "crd.projectcalico.org/v1/NetworkPolicy" false -}} +# {{- set $found "crd.projectcalico.org/v1/NetworkSet" false -}} +# {{- set $found "operator.tigera.io/v1/ImageSet" false -}} +# {{- set $found "operator.tigera.io/v1/Installation" false -}} +# {{- set $found "operator.tigera.io/v1/TigeraStatus" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rke2-calico/rke2-calico/v3.19.2-203/values.yaml b/charts/rke2-calico/rke2-calico/v3.19.2-203/values.yaml new file mode 100755 index 0000000..923411d --- /dev/null +++ b/charts/rke2-calico/rke2-calico/v3.19.2-203/values.yaml @@ -0,0 +1,53 @@ +imagePullSecrets: {} + +installation: + controlPlaneTolerations: + - key: "node-role.kubernetes.io/control-plane" + operator: "Exists" + effect: "NoSchedule" + - key: "node-role.kubernetes.io/etcd" + operator: "Exists" + effect: "NoExecute" + enabled: true + kubernetesProvider: "" + calicoNetwork: + bgp: Disabled + ipPools: + - natOutgoing: Enabled + encapsulation: VXLAN + cidr: 10.42.0.0/16 + blockSize: 24 + imagePath: "rancher" + imagePrefix: "mirrored-calico-" + +certs: + node: + key: + cert: + commonName: + typha: + key: + cert: + commonName: + caBundle: + +# Configuration for the tigera operator +tigeraOperator: + image: rancher/mirrored-calico-operator + version: v1.17.6 + registry: docker.io +calicoctl: + image: rancher/mirrored-calico-ctl + tag: v3.19.2 + +global: + systemDefaultRegistry: "" + +# Config required by Windows nodes +ipamConfig: + strictAffinity: true + autoAllocateBlocks: true + +# Config required to fix RKE2 issue #1541 +felixConfiguration: + featureDetectOverride: "ChecksumOffloadBroken=true" diff --git a/index.yaml b/index.yaml index 56137fb..73e70a0 100755 --- a/index.yaml +++ b/index.yaml @@ -34,6 +34,17 @@ entries: urls: - assets/rke2-calico/rke2-calico-v3.1906.tgz version: v3.1906 + - annotations: + catalog.cattle.io/namespace: tigera-operator + apiVersion: v2 + appVersion: v3.19.2 + created: "2021-08-23T15:25:00.614191114Z" + description: Installs the Tigera operator for Calico + digest: 25379d98639ae1546063c7c9af565b5e6a9c149942a332072d4fb0269f052e41 + name: rke2-calico + urls: + - assets/rke2-calico/rke2-calico-v3.19.2-203.tgz + version: v3.19.2-203 - annotations: catalog.cattle.io/namespace: tigera-operator apiVersion: v2 @@ -112,6 +123,15 @@ entries: - assets/rke2-calico/rke2-calico-v3.18.1-101.tgz version: v3.18.1-101 rke2-calico-crd: + - apiVersion: v1 + created: "2021-08-23T15:25:00.588727223Z" + description: Installs the CRDs for rke2-calico + digest: 277d39e5fe6fb880e33bea6c3e51fb64c9dbaec508a896faeae24ba289660b1e + name: rke2-calico-crd + type: application + urls: + - assets/rke2-calico/rke2-calico-crd-v1.0.103.tgz + version: v1.0.103 - apiVersion: v1 created: "2021-08-12T18:07:43.615706753Z" description: Installs the CRDs for rke2-calico