Seeing this error at runtime:
```
Error: parse error at (rke2-canal/templates/config.yaml:63): function "Values" not defined
```
Signed-off-by: Jacob Blain Christen <jacob@rancher.com>
Before this change, wait-for-node-init container was not able to execute
properly with SELinux enabled, due to lack of ability to access the bind
mounted file. Due to lack of ability to set the container_file_t label
through Kubernetes, the other possible solution, done in this commit, is
making the container privileged. All the other containers accessing the
bootstrap file are already privileged as well, so it should not be that
harmful.
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
Consume the images from our rancher/mirrored-xxx images
Unfortunately, we can't consume the rest of the images. This feature is
unavailable
Signed-off-by: Manuel Buil <mbuil@suse.com>
Adds charts for sriov and multus.
Details:
* Multus chart, on deployment installs number of cnis, not only multus
itself but also other cnis ussually combined with it, like host-device
and macvlan.
* Multus includes a CRD, NetworkAttachmentDefinition, which is the
means to attach interfaces to pods by specifying a delegated cni for
each.
* Multus replaces the existing cni with itself, and sets up a default
NetworkAttachmentDefinition with that existing cni that will setup the
first interface of the pod just as if multus was not there.
* The NetworkAttachmentDefinition CRD is included along other multus
templates in the chart and no specific chart is setup for the CRD.
This CRD is no consumed on deployment and is unlikely to change
frequently.
* Sriov depends on NetworkAttachmentDefinition CRD but no dependency is
set between Multus and Sriov. Sriov charts checks on the presence of
NetworkAttachmentDefinition CRD via capabilities and fails deployment
if unavailable.
* Sriov includes a number of CRDs which are setup as separate chart.
* Sriov operator depends on certificates to be able to deploy its
webhooks. The charts depends and checks for the presence of
cert-manager to generate these certificates. Optionally, via chart
value, cert-manager integration can be disabled in which case the
chart will generate certificates with 1 year validity as a means to
quickly test or trial, but not the intended setup for production
clusters.
Signed-off-by: Jaime Caamaño Ruiz <jcaamano@suse.com>
Signed-off-by: Manuel Buil <mbuil@suse.com>
Made FailsafeOutboundHostPorts and FailsafeInboundHostPorts configurable
to allow users to have custom network policy for example SSH (22)
Previously failsafe rules would always have opened 22 even if user had
custom GlobalNetworkPolicy applied on the node.
Fixes https://github.com/rancher/rke2/issues/921
* Update coredns and kube-proxy charts to use passthrough values
* bump kube-proxy versions back to v1.21.0
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
This change contains only autoregenerated patches after the update of
Cilium to 1.9.6. Those patches had to be regenerated due to upstream
changes in Cilium Helm charts.
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
This change updates the Cilium version from 1.9.4 to 1.9.6. This release
updates Envoy to 1.17.2 to address CVE-2021-28682, CVE-2021-28683 and
CVE-2021-29258.
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
Cilium's default ipam mode does not honor the pod CIDR set in kube-controller-manager.
The benefits of that mode are not relevant when deploying with rke2
Fixes issue rke2/891
Signed-off-by: Manuel Buil <mbuil@suse.com>
The chart is organized in subcharts to clearly delimit supported vs
non-supported customization options, as follows:
- The main rke2-cilium chart which only supplies supported customization
options through its values.yaml.
- Cilium upstream chart is pulled in as a subchart dependency and is
patched to support a system default registry as a global variable.
- A rke2-cilium-hard-defaults subchart which supplies cilium options
that change from upstream defaults for which we don't intend to
support any customization.
All cilium options are scoped & accessible, for example:
`helm install rke2-cilium --set cilium.preflight.enabled=true`
Signed-off-by: Jaime Caamaño Ruiz <jcaamano@suse.com>
Jacob Blain Christen
Manuel Buil
Michal Rostecki
Brad Davidson
Erik Wilson
Brian Downs
Jaime Caamaño Ruiz
Jonas Falck
Brad Davidson
Chris Kim
Chris Kim
David Nuzik
Menna Elmasry