devbox
繁依Fanyi0
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

通过keepalived+nginx实现 k8s apiserver节点高可用

作者：繁依Fanyi0 | 2024-03-26 08:12:17

赞

踩

通过keepalived+nginx实现 k8s apiserver节点高可用

 一、环境准备

K8s 主机配置：
配置： 4Gib 内存/4vCPU/60G 硬盘
网络：机器相互可以通信

k8s 实验环境网络规划：
podSubnet（pod 网段） 10.244.0.0/16
serviceSubnet（service 网段）: 10.96.0.0/12
物理机网段：192.168.1.0/24

2个控制节点2个工作节点

K8S集群角色IP地址主机名安装的组件
控制节点192.168.1.63xuegod63apiserver、controllermanager、schedule、kubelet、etcd、kubeproxy、容器运行时、calico、keepalived、nginx、kubeadm、kubectl
 
控制节点192.168.1.64xuegod64apiserver、controllermanager、schedule、kubelet、etcd、kubeproxy、容器运行时、calico、keepalived、nginx、kubeadm、kubectl
 
工作节点192.168.1.65xuegod65Kube-proxy、calico、coredns、容器运行时、kubelet、kubeadm、kubectl
工作节点192.168.1.62xuegod62Kube-proxy、calico、coredns、容器运行时、kubelet、kubeadm、kubectl
VIP192.168.1.199

初始化安装安装到第三步https://candy.blog.csdn.net/article/details/134723910?spm=1001.2014.3001.5502

上面的安装到第三步，安装初始化 k8s 需要的组件，三台都安装
[root@xuegod63 ~]# yum install -y kubelet-1.26.0 kubeadm-1.26.0 kubectl-1.26.0
[root@xuegod63 ~]# systemctl enable kubelet

二、63、64 安装keepalived+nginx

1、安装 nginx 和 keepalived 

在 xuegod63 和 xuegod64 上安装 keepalived 和 nginx，实现对 apiserver 负载均衡和反向代
理。Xuegod63 是 keepalived 主节点，xuegod64 是 keepalived 备节点。
[root@xuegod63 ~]# yum install epel-release nginx keepalived nginx-mod-stream -y
[root@xuegod64 ~]# yum install epel-release nginx keepalived nginx-mod-stream -y
[root@xuegod63 ~]# vim /etc/nginx/nginx.conf


2.修改配置63、64 nginx 配置文件 

  1. user nginx;
  2. worker_processes auto;
  3. error_log /var/log/nginx/error.log;
  4. pid /run/nginx.pid;
  5.  
  6. include /usr/share/nginx/modules/*.conf;
  7.  
  8. events {
  9.     worker_connections 1024;
  10. }
  11.  
  12. # 四层负载均衡，为两台Master apiserver组件提供负载均衡
  13. stream {
  14.  
  15.     log_format  main  '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';
  16.  
  17.     access_log  /var/log/nginx/k8s-access.log  main;
  18.  
  19.     upstream k8s-apiserver {
  20.             server 192.168.1.63:6443 weight=5 max_fails=3 fail_timeout=30s;  
  21.             server 192.168.1.64:6443 weight=5 max_fails=3 fail_timeout=30s;         
  22.  
  23.     }
  24.     
  25.     server {
  26.        listen 16443; # 由于nginx与master节点复用，这个监听端口不能是6443，否则会冲突
  27.        proxy_pass k8s-apiserver;
  28.     }
  29. }
  30.  
  31. http {
  32.     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
  33.                       '$status $body_bytes_sent "$http_referer" '
  34.                       '"$http_user_agent" "$http_x_forwarded_for"';
  35.  
  36.     access_log  /var/log/nginx/access.log  main;
  37.  
  38.     sendfile            on;
  39.     tcp_nopush          on;
  40.     tcp_nodelay         on;
  41.     keepalive_timeout   65;
  42.     types_hash_max_size 2048;
  43.  
  44.     include             /etc/nginx/mime.types;
  45.     default_type        application/octet-stream;
  46.  
  47.     server {
  48.         listen       80 default_server;
  49.         server_name  _;
  50.  
  51.         location / {
  52.         }
  53.     }
  54. }
  55.

 备注：
nginx 配置文件参数解释：
1、weight 指定了每个后端服务器的权重，用于调节请求的分配比例，例如上述配置中三个后端服务器的权重都为 5，则每个服务器会均衡地处理 1/3 的请求。
2、max_fails 指定了最大的失败次数，如果在 fail_timeout 时间内连续失败了 max_fails 次，则该
后端服务器会被暂时认为是不可用的，不再向其分配请求。
3、fail_timeout 指定了服务器被认为是不可用的时间，即在该时间段内连续失败了 max_fails 次，则该后端服务器会被暂时认为是不可用的。

3、修改 keepalive 配置文件，主备不一样，需要区分

63是主节点的修改 [root@xuegod63 ~]#

vi /etc/keepalived/keepalived.conf

注意：63、64网卡根据自己的实际情况进行修改

  1. global_defs { 
  2.    notification_email { 
  3.      acassen@firewall.loc 
  4.      failover@firewall.loc 
  5.      sysadmin@firewall.loc 
  6.    } 
  7.    notification_email_from Alexandre.Cassen@firewall.loc  
  8.    smtp_server 127.0.0.1 
  9.    smtp_connect_timeout 30 
  10.    router_id NGINX_MASTER
  11. } 
  12.  
  13. vrrp_script check_nginx {
  14.     script "/etc/keepalived/check_nginx.sh"
  15. }
  16.  
  17. vrrp_instance VI_1 { 
  18.     state MASTER 
  19.     interface ens33  # 修改为实际网卡名
  20.     virtual_router_id 51 # VRRP 路由 ID实例，每个实例是唯一的 
  21.     priority 100    # 优先级，备服务器设置 90 
  22.     advert_int 1    # 指定VRRP 心跳包通告间隔时间，默认1秒 
  23.     authentication { 
  24.         auth_type PASS      
  25.         auth_pass 1111 
  26.     }  
  27.     # 虚拟IP
  28.     virtual_ipaddress { 
  29.         192.168.1.199/24
  30.     } 
  31.     track_script {
  32.         check_nginx
  33.     } 
  34. }
  35.

配置文件一样64修改 [root@xuegod64 ~]# vim /etc/keepalived/keepalived.conf   

  1. global_defs { 
  2.    notification_email { 
  3.      acassen@firewall.loc 
  4.      failover@firewall.loc 
  5.      sysadmin@firewall.loc 
  6.    } 
  7.    notification_email_from Alexandre.Cassen@firewall.loc  
  8.    smtp_server 127.0.0.1 
  9.    smtp_connect_timeout 30 
  10.    router_id NGINX_MASTER
  11. } 
  12.  
  13. vrrp_script check_nginx {
  14.     script "/etc/keepalived/check_nginx.sh"
  15. }
  16.  
  17. vrrp_instance VI_1 { 
  18.     state BACKUP 
  19.     interface ens33  # 修改为实际网卡名
  20.     virtual_router_id 51 # VRRP 路由 ID实例，每个实例是唯一的 
  21.     priority 90    # 优先级，备服务器设置 90 
  22.     advert_int 1    # 指定VRRP 心跳包通告间隔时间，默认1秒 
  23.     authentication { 
  24.         auth_type PASS      
  25.         auth_pass 1111 
  26.     }  
  27.     # 虚拟IP
  28.     virtual_ipaddress { 
  29.         192.168.1.199/24
  30.     } 
  31.     track_script {
  32.         check_nginx
  33.     } 
  34. }
  35.

4.检测nginx运行的脚本 

这有个检测nginx脚本

vi  /etc/keepalived/check_nginx.sh

   （63、64都在执行）

chmod +x /etc/keepalived/check_nginx.sh

  1. #!/bin/bash
  2. #1、判断Nginx是否存活
  3. counter=$(ps -ef |grep nginx | grep sbin | egrep -cv "grep|$$" )
  4. if [ $counter -eq 0 ]; then
  5.     #2、如果不存活则尝试启动Nginx
  6.     service nginx start
  7.     sleep 2
  8.     #3、等待2秒后再次获取一次Nginx状态
  9.     counter=$(ps -ef |grep nginx | grep sbin | egrep -cv "grep|$$" )
  10.     #4、再次进行判断，如Nginx还不存活则停止Keepalived，让地址进行漂移
  11.     if [ $counter -eq 0 ]; then
  12.         service  keepalived stop
  13.     fi
  14. fi
  15.

5、启动服务：

[root@xuegod63 ~]# systemctl daemon-reload && systemctl start nginx
[root@xuegod63 ~]# systemctl start keepalived && systemctl enable nginx keepalived
[root@xuegod64 ~]# systemctl daemon-reload && systemctl start nginx
[root@xuegod64 ~]# systemctl start keepalived && systemctl enable nginx keepalived

可以看到vip已经运行起来了

6、测试 vip 能否漂移：

停掉 xuegod63 上的 keepalived，Vip 会漂移到 xuegod64
[root@xuegod63 ~]# service keepalived stop
[root@xuegod64]# ip addr

 可以看到Vip 会漂移到 xuegod64

#启动 xuegod63 上的 nginx 和 keepalived，vip 又会漂移回来
[root@xuegod63 ~]# systemctl start nginx
[root@xuegod63 ~]# systemctl start keepalived
[root@xuegod63]# ip addr

可以看到已经回来了

三、kubeadm 初始化 k8s 集群

因为控制节点做了高可用，所以k8s集群里的配置要变

1.使用 kubeadm 初始化 k8s 集群

[root@xuegod63 ~]# kubeadm config print init-defaults > kubeadm.yaml

只在master1上执行；根据我们自己的需求修改配置，比如修改 imageRepository 的值，kube-proxy 的模式为ipvs，需要注意的是由于我们使用的 containerd 作为运行时，所以在初始化节点的时候需要指定cgroupDriver 为 systemd

vi kubeadm.yaml 完整配置如下：

  1. apiVersion: kubeadm.k8s.io/v1beta3
  2. bootstrapTokens:
  3. - groups:
  4.   - system:bootstrappers:kubeadm:default-node-token
  5.   token: abcdef.0123456789abcdef
  6.   ttl: 24h0m0s
  7.   usages:
  8.   - signing
  9.   - authentication
  10. kind: InitConfiguration
  11. #localAPIEndpoint:
  12. #  advertiseAddress: 192.168.1.63
  13. #  bindPort: 6443
  14. nodeRegistration:
  15.   criSocket: unix:///run/containerd/containerd.sock
  16.   imagePullPolicy: IfNotPresent
  17. # name: xuegod63
  18.   taints: null
  19. ---
  20. apiServer:
  21.   timeoutForControlPlane: 4m0s
  22. apiVersion: kubeadm.k8s.io/v1beta3
  23. certificatesDir: /etc/kubernetes/pki
  24. clusterName: kubernetes
  25. controllerManager: {}
  26. dns: {}
  27. etcd:
  28.   local:
  29.     dataDir: /var/lib/etcd
  30. imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
  31. kind: ClusterConfiguration
  32. kubernetesVersion: 1.26.0
  33. controlPlaneEndpoint: 192.168.1.199:16443
  34. networking:
  35.   dnsDomain: cluster.local
  36.   serviceSubnet: 10.96.0.0/12
  37.   podSubnet: 10.244.0.0/16
  38. scheduler: {}
  39. ---
  40. apiVersion: kubeproxy.config.k8s.io/v1alpha1
  41. kind: KubeProxyConfiguration
  42. mode: ipvs
  43. ---
  44. apiVersion: kubelet.config.k8s.io/v1beta1
  45. kind: KubeletConfiguration
  46. cgroupDriver: systemd

#然后基于 kubeadm.yaml 初始化 k8s（集群资源上一篇有分享）上传资源
[root@xuegod63 ~]# ctr -n=k8s.io images import k8s_1.26.0.tar.gz
[root@xuegod62 ~]# ctr -n=k8s.io images import k8s_1.26.0.tar.gz
[root@xuegod64 ~]# ctr -n=k8s.io images import k8s_1.26.0.tar.gz
[root@xuegod65 ~]# ctr -n=k8s.io images import k8s_1.26.0.tar.gz

[root@xuegod63 ~]# 

kubeadm init --config=kubeadm.yaml --ignore-preflight-errors=SystemVerification

 Your Kubernetes control-plane has initialized successfully!  说明初始化成功

#配置 kubectl 的配置文件 config，相当于对 kubectl 进行授权，这样 kubectl 命令可以使用这个
证书对 k8s 集群进行管理
[root@xuegod63 ~]# mkdir -p $HOME/.kube
[root@xuegod63 ~]# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[root@xuegod63 ~]# sudo chown $(id -u):$(id -g) $HOME/.kube/config

[root@xuegod63 ~]# kubectl get nodes

2 、扩容 k8s 控制节点，把 xuegod64 加入到 k8s 集群

#把 xuegod63 节点的证书拷贝到 xuegod64 上
在 xuegod64 创建证书存放目录：
[root@xuegod64 ~]#

cd /root && mkdir -p /etc/kubernetes/pki/etcd &&mkdir -p ~/.kube/

#把 xuegod63 节点的证书拷贝到 xuegod64 上：

  1. scp /etc/kubernetes/pki/ca.crt xuegod64:/etc/kubernetes/pki/
  2. scp /etc/kubernetes/pki/ca.key xuegod64:/etc/kubernetes/pki/
  3. scp /etc/kubernetes/pki/sa.key xuegod64:/etc/kubernetes/pki/
  4. scp /etc/kubernetes/pki/sa.pub xuegod64:/etc/kubernetes/pki/
  5. scp /etc/kubernetes/pki/front-proxy-ca.crt xuegod64:/etc/kubernetes/pki/
  6. scp /etc/kubernetes/pki/front-proxy-ca.key xuegod64:/etc/kubernetes/pki/
  7. scp /etc/kubernetes/pki/etcd/ca.crt xuegod64:/etc/kubernetes/pki/etcd/
  8. scp /etc/kubernetes/pki/etcd/ca.key xuegod64:/etc/kubernetes/pki/etcd/

在 xuegod63 上查看加入节点的命令：
[root@xuegod63 ~]# kubeadm token create --print-join-command

64添加为控制节点 在 xuegod64  上执行：
[root@xuegod64 ~]#kubeadm join 192.168.1.199:16443 --token mdn9gg.dcl0i58oagtmhezn --discovery-token-ca-cert-hash sha256:bce6f69bf0b7983d300f98d0e71d8687b4b5dbc2936f1c872ca48af72716a5ba --control-plane --ignore-preflight-errors=SystemVerification    这个不要复制，每次生成的不一样

后面加上 --control-plane --ignore-preflight-errors=SystemVerification

注：--control-plane  这个参数是一控制节点加入 最后再加上 --ignore-preflight-errors=SystemVerification

在 xuegod63 上查看集群状况：
[root@xuegod63 ~]# kubectl get nodes

3、扩容 k8s 集群-65添加工作节点

在 xuegod63 上查看加入节点的命令：
[root@xuegod63 ~]# kubeadm token create --print-join-command

把 xuegod6 加入 k8s 集群：
[root@xuegod65~]#kubeadm join 192.168.1.199:16443 --token mdn9gg.dcl0i58oagtmhezn --discovery-token-ca-cert-hash sha256:bce6f69bf0b7983d300f98d0e71d8687b4b5dbc2936f1c872ca48af72716a5ba  --ignore-preflight-errors=SystemVerification

#在 xuegod63 上查看集群节点状况：
[root@xuegod63 ~]# kubectl get nodes

 给xuegod打上work工作标签节点

kubectl label nodes xuegod65 node-role.kubernetes.io/work=work

 再次查看

4、安装 kubernetes 网络组件-Calico

把安装 calico 需要的镜像 calico.tar.gz 传到 xuegod63、xuegod62、xuegod64 和 xuegod66
节点，手动解压：
[root@xuegod63 ~]# ctr -n=k8s.io images import calico.tar.gz
[root@xuegod62 ~]# ctr -n=k8s.io images import calico.tar.gz
[root@xuegod64 ~]# ctr -n=k8s.io images import calico.tar.gz
[root@xuegod65 ~]# ctr -n=k8s.io images import calico.tar.gz

修改 calico.yaml 文件： 

  1. ---
  2. # Source: calico/templates/calico-config.yaml
  3. # This ConfigMap is used to configure a self-hosted Calico installation.
  4. kind: ConfigMap
  5. apiVersion: v1
  6. metadata:
  7.   name: calico-config
  8.   namespace: kube-system
  9. data:
  10.   # Typha is disabled.
  11.   typha_service_name: "none"
  12.   # Configure the backend to use.
  13.   calico_backend: "bird"
  14.  
  15.   # Configure the MTU to use for workload interfaces and tunnels.
  16.   # By default, MTU is auto-detected, and explicitly setting this field should not be required.
  17.   # You can override auto-detection by providing a non-zero value.
  18.   veth_mtu: "0"
  19.  
  20.   # The CNI network configuration to install on each node. The special
  21.   # values in this config will be automatically populated.
  22.   cni_network_config: |-
  23.     {
  24.       "name": "k8s-pod-network",
  25.       "cniVersion": "0.3.1",
  26.       "plugins": [
  27.         {
  28.           "type": "calico",
  29.           "log_level": "info",
  30.           "log_file_path": "/var/log/calico/cni/cni.log",
  31.           "datastore_type": "kubernetes",
  32.           "nodename": "__KUBERNETES_NODE_NAME__",
  33.           "mtu": __CNI_MTU__,
  34.           "ipam": {
  35.               "type": "calico-ipam"
  36.           },
  37.           "policy": {
  38.               "type": "k8s"
  39.           },
  40.           "kubernetes": {
  41.               "kubeconfig": "__KUBECONFIG_FILEPATH__"
  42.           }
  43.         },
  44.         {
  45.           "type": "portmap",
  46.           "snat": true,
  47.           "capabilities": {"portMappings": true}
  48.         },
  49.         {
  50.           "type": "bandwidth",
  51.           "capabilities": {"bandwidth": true}
  52.         }
  53.       ]
  54.     }
  55.  
  56. ---
  57. # Source: calico/templates/kdd-crds.yaml
  58.  
  59. apiVersion: apiextensions.k8s.io/v1
  60. kind: CustomResourceDefinition
  61. metadata:
  62.   name: bgpconfigurations.crd.projectcalico.org
  63. spec:
  64.   group: crd.projectcalico.org
  65.   names:
  66.     kind: BGPConfiguration
  67.     listKind: BGPConfigurationList
  68.     plural: bgpconfigurations
  69.     singular: bgpconfiguration
  70.   scope: Cluster
  71.   versions:
  72.   - name: v1
  73.     schema:
  74.       openAPIV3Schema:
  75.         description: BGPConfiguration contains the configuration for any BGP routing.
  76.         properties:
  77.           apiVersion:
  78.             description: 'APIVersion defines the versioned schema of this representation
  79.               of an object. Servers should convert recognized schemas to the latest
  80.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  81.             type: string
  82.           kind:
  83.             description: 'Kind is a string value representing the REST resource this
  84.               object represents. Servers may infer this from the endpoint the client
  85.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  86.             type: string
  87.           metadata:
  88.             type: object
  89.           spec:
  90.             description: BGPConfigurationSpec contains the values of the BGP configuration.
  91.             properties:
  92.               asNumber:
  93.                 description: 'ASNumber is the default AS number used by a node. [Default:
  94.                   64512]'
  95.                 format: int32
  96.                 type: integer
  97.               communities:
  98.                 description: Communities is a list of BGP community values and their
  99.                   arbitrary names for tagging routes.
  100.                 items:
  101.                   description: Community contains standard or large community value
  102.                     and its name.
  103.                   properties:
  104.                     name:
  105.                       description: Name given to community value.
  106.                       type: string
  107.                     value:
  108.                       description: Value must be of format `aa:nn` or `aa:nn:mm`.
  109.                         For standard community use `aa:nn` format, where `aa` and
  110.                         `nn` are 16 bit number. For large community use `aa:nn:mm`
  111.                         format, where `aa`, `nn` and `mm` are 32 bit number. Where,
  112.                         `aa` is an AS Number, `nn` and `mm` are per-AS identifier.
  113.                       pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$
  114.                       type: string
  115.                   type: object
  116.                 type: array
  117.               listenPort:
  118.                 description: ListenPort is the port where BGP protocol should listen.
  119.                   Defaults to 179
  120.                 maximum: 65535
  121.                 minimum: 1
  122.                 type: integer
  123.               logSeverityScreen:
  124.                 description: 'LogSeverityScreen is the log severity above which logs
  125.                   are sent to the stdout. [Default: INFO]'
  126.                 type: string
  127.               nodeToNodeMeshEnabled:
  128.                 description: 'NodeToNodeMeshEnabled sets whether full node to node
  129.                   BGP mesh is enabled. [Default: true]'
  130.                 type: boolean
  131.               prefixAdvertisements:
  132.                 description: PrefixAdvertisements contains per-prefix advertisement
  133.                   configuration.
  134.                 items:
  135.                   description: PrefixAdvertisement configures advertisement properties
  136.                     for the specified CIDR.
  137.                   properties:
  138.                     cidr:
  139.                       description: CIDR for which properties should be advertised.
  140.                       type: string
  141.                     communities:
  142.                       description: Communities can be list of either community names
  143.                         already defined in `Specs.Communities` or community value
  144.                         of format `aa:nn` or `aa:nn:mm`. For standard community use
  145.                         `aa:nn` format, where `aa` and `nn` are 16 bit number. For
  146.                         large community use `aa:nn:mm` format, where `aa`, `nn` and
  147.                         `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and
  148.                         `mm` are per-AS identifier.
  149.                       items:
  150.                         type: string
  151.                       type: array
  152.                   type: object
  153.                 type: array
  154.               serviceClusterIPs:
  155.                 description: ServiceClusterIPs are the CIDR blocks from which service
  156.                   cluster IPs are allocated. If specified, Calico will advertise these
  157.                   blocks, as well as any cluster IPs within them.
  158.                 items:
  159.                   description: ServiceClusterIPBlock represents a single allowed ClusterIP
  160.                     CIDR block.
  161.                   properties:
  162.                     cidr:
  163.                       type: string
  164.                   type: object
  165.                 type: array
  166.               serviceExternalIPs:
  167.                 description: ServiceExternalIPs are the CIDR blocks for Kubernetes
  168.                   Service External IPs. Kubernetes Service ExternalIPs will only be
  169.                   advertised if they are within one of these blocks.
  170.                 items:
  171.                   description: ServiceExternalIPBlock represents a single allowed
  172.                     External IP CIDR block.
  173.                   properties:
  174.                     cidr:
  175.                       type: string
  176.                   type: object
  177.                 type: array
  178.               serviceLoadBalancerIPs:
  179.                 description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes
  180.                   Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress
  181.                   IPs will only be advertised if they are within one of these blocks.
  182.                 items:
  183.                   description: ServiceLoadBalancerIPBlock represents a single allowed
  184.                     LoadBalancer IP CIDR block.
  185.                   properties:
  186.                     cidr:
  187.                       type: string
  188.                   type: object
  189.                 type: array
  190.             type: object
  191.         type: object
  192.     served: true
  193.     storage: true
  194. status:
  195.   acceptedNames:
  196.     kind: ""
  197.     plural: ""
  198.   conditions: []
  199.   storedVersions: []
  200.  
  201. ---
  202. apiVersion: apiextensions.k8s.io/v1
  203. kind: CustomResourceDefinition
  204. metadata:
  205.   name: bgppeers.crd.projectcalico.org
  206. spec:
  207.   group: crd.projectcalico.org
  208.   names:
  209.     kind: BGPPeer
  210.     listKind: BGPPeerList
  211.     plural: bgppeers
  212.     singular: bgppeer
  213.   scope: Cluster
  214.   versions:
  215.   - name: v1
  216.     schema:
  217.       openAPIV3Schema:
  218.         properties:
  219.           apiVersion:
  220.             description: 'APIVersion defines the versioned schema of this representation
  221.               of an object. Servers should convert recognized schemas to the latest
  222.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  223.             type: string
  224.           kind:
  225.             description: 'Kind is a string value representing the REST resource this
  226.               object represents. Servers may infer this from the endpoint the client
  227.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  228.             type: string
  229.           metadata:
  230.             type: object
  231.           spec:
  232.             description: BGPPeerSpec contains the specification for a BGPPeer resource.
  233.             properties:
  234.               asNumber:
  235.                 description: The AS Number of the peer.
  236.                 format: int32
  237.                 type: integer
  238.               keepOriginalNextHop:
  239.                 description: Option to keep the original nexthop field when routes
  240.                   are sent to a BGP Peer. Setting "true" configures the selected BGP
  241.                   Peers node to use the "next hop keep;" instead of "next hop self;"(default)
  242.                   in the specific branch of the Node on "bird.cfg".
  243.                 type: boolean
  244.               node:
  245.                 description: The node name identifying the Calico node instance that
  246.                   is targeted by this peer. If this is not set, and no nodeSelector
  247.                   is specified, then this BGP peer selects all nodes in the cluster.
  248.                 type: string
  249.               nodeSelector:
  250.                 description: Selector for the nodes that should have this peering.  When
  251.                   this is set, the Node field must be empty.
  252.                 type: string
  253.               password:
  254.                 description: Optional BGP password for the peerings generated by this
  255.                   BGPPeer resource.
  256.                 properties:
  257.                   secretKeyRef:
  258.                     description: Selects a key of a secret in the node pod's namespace.
  259.                     properties:
  260.                       key:
  261.                         description: The key of the secret to select from.  Must be
  262.                           a valid secret key.
  263.                         type: string
  264.                       name:
  265.                         description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  266.                           TODO: Add other useful fields. apiVersion, kind, uid?'
  267.                         type: string
  268.                       optional:
  269.                         description: Specify whether the Secret or its key must be
  270.                           defined
  271.                         type: boolean
  272.                     required:
  273.                     - key
  274.                     type: object
  275.                 type: object
  276.               peerIP:
  277.                 description: The IP address of the peer followed by an optional port
  278.                   number to peer with. If port number is given, format should be `[<IPv6>]:port`
  279.                   or `<IPv4>:<port>` for IPv4. If optional port number is not set,
  280.                   and this peer IP and ASNumber belongs to a calico/node with ListenPort
  281.                   set in BGPConfiguration, then we use that port to peer.
  282.                 type: string
  283.               peerSelector:
  284.                 description: Selector for the remote nodes to peer with.  When this
  285.                   is set, the PeerIP and ASNumber fields must be empty.  For each
  286.                   peering between the local node and selected remote nodes, we configure
  287.                   an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified,
  288.                   and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified.  The
  289.                   remote AS number comes from the remote node's NodeBGPSpec.ASNumber,
  290.                   or the global default if that is not set.
  291.                 type: string
  292.               sourceAddress:
  293.                 description: Specifies whether and how to configure a source address
  294.                   for the peerings generated by this BGPPeer resource.  Default value
  295.                   "UseNodeIP" means to configure the node IP as the source address.  "None"
  296.                   means not to configure a source address.
  297.                 type: string
  298.             type: object
  299.         type: object
  300.     served: true
  301.     storage: true
  302. status:
  303.   acceptedNames:
  304.     kind: ""
  305.     plural: ""
  306.   conditions: []
  307.   storedVersions: []
  308.  
  309. ---
  310. apiVersion: apiextensions.k8s.io/v1
  311. kind: CustomResourceDefinition
  312. metadata:
  313.   name: blockaffinities.crd.projectcalico.org
  314. spec:
  315.   group: crd.projectcalico.org
  316.   names:
  317.     kind: BlockAffinity
  318.     listKind: BlockAffinityList
  319.     plural: blockaffinities
  320.     singular: blockaffinity
  321.   scope: Cluster
  322.   versions:
  323.   - name: v1
  324.     schema:
  325.       openAPIV3Schema:
  326.         properties:
  327.           apiVersion:
  328.             description: 'APIVersion defines the versioned schema of this representation
  329.               of an object. Servers should convert recognized schemas to the latest
  330.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  331.             type: string
  332.           kind:
  333.             description: 'Kind is a string value representing the REST resource this
  334.               object represents. Servers may infer this from the endpoint the client
  335.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  336.             type: string
  337.           metadata:
  338.             type: object
  339.           spec:
  340.             description: BlockAffinitySpec contains the specification for a BlockAffinity
  341.               resource.
  342.             properties:
  343.               cidr:
  344.                 type: string
  345.               deleted:
  346.                 description: Deleted indicates that this block affinity is being deleted.
  347.                   This field is a string for compatibility with older releases that
  348.                   mistakenly treat this field as a string.
  349.                 type: string
  350.               node:
  351.                 type: string
  352.               state:
  353.                 type: string
  354.             required:
  355.             - cidr
  356.             - deleted
  357.             - node
  358.             - state
  359.             type: object
  360.         type: object
  361.     served: true
  362.     storage: true
  363. status:
  364.   acceptedNames:
  365.     kind: ""
  366.     plural: ""
  367.   conditions: []
  368.   storedVersions: []
  369.  
  370. ---
  371. apiVersion: apiextensions.k8s.io/v1
  372. kind: CustomResourceDefinition
  373. metadata:
  374.   name: clusterinformations.crd.projectcalico.org
  375. spec:
  376.   group: crd.projectcalico.org
  377.   names:
  378.     kind: ClusterInformation
  379.     listKind: ClusterInformationList
  380.     plural: clusterinformations
  381.     singular: clusterinformation
  382.   scope: Cluster
  383.   versions:
  384.   - name: v1
  385.     schema:
  386.       openAPIV3Schema:
  387.         description: ClusterInformation contains the cluster specific information.
  388.         properties:
  389.           apiVersion:
  390.             description: 'APIVersion defines the versioned schema of this representation
  391.               of an object. Servers should convert recognized schemas to the latest
  392.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  393.             type: string
  394.           kind:
  395.             description: 'Kind is a string value representing the REST resource this
  396.               object represents. Servers may infer this from the endpoint the client
  397.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  398.             type: string
  399.           metadata:
  400.             type: object
  401.           spec:
  402.             description: ClusterInformationSpec contains the values of describing
  403.               the cluster.
  404.             properties:
  405.               calicoVersion:
  406.                 description: CalicoVersion is the version of Calico that the cluster
  407.                   is running
  408.                 type: string
  409.               clusterGUID:
  410.                 description: ClusterGUID is the GUID of the cluster
  411.                 type: string
  412.               clusterType:
  413.                 description: ClusterType describes the type of the cluster
  414.                 type: string
  415.               datastoreReady:
  416.                 description: DatastoreReady is used during significant datastore migrations
  417.                   to signal to components such as Felix that it should wait before
  418.                   accessing the datastore.
  419.                 type: boolean
  420.               variant:
  421.                 description: Variant declares which variant of Calico should be active.
  422.                 type: string
  423.             type: object
  424.         type: object
  425.     served: true
  426.     storage: true
  427. status:
  428.   acceptedNames:
  429.     kind: ""
  430.     plural: ""
  431.   conditions: []
  432.   storedVersions: []
  433.  
  434. ---
  435. apiVersion: apiextensions.k8s.io/v1
  436. kind: CustomResourceDefinition
  437. metadata:
  438.   name: felixconfigurations.crd.projectcalico.org
  439. spec:
  440.   group: crd.projectcalico.org
  441.   names:
  442.     kind: FelixConfiguration
  443.     listKind: FelixConfigurationList
  444.     plural: felixconfigurations
  445.     singular: felixconfiguration
  446.   scope: Cluster
  447.   versions:
  448.   - name: v1
  449.     schema:
  450.       openAPIV3Schema:
  451.         description: Felix Configuration contains the configuration for Felix.
  452.         properties:
  453.           apiVersion:
  454.             description: 'APIVersion defines the versioned schema of this representation
  455.               of an object. Servers should convert recognized schemas to the latest
  456.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  457.             type: string
  458.           kind:
  459.             description: 'Kind is a string value representing the REST resource this
  460.               object represents. Servers may infer this from the endpoint the client
  461.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  462.             type: string
  463.           metadata:
  464.             type: object
  465.           spec:
  466.             description: FelixConfigurationSpec contains the values of the Felix configuration.
  467.             properties:
  468.               allowIPIPPacketsFromWorkloads:
  469.                 description: 'AllowIPIPPacketsFromWorkloads controls whether Felix
  470.                   will add a rule to drop IPIP encapsulated traffic from workloads
  471.                   [Default: false]'
  472.                 type: boolean
  473.               allowVXLANPacketsFromWorkloads:
  474.                 description: 'AllowVXLANPacketsFromWorkloads controls whether Felix
  475.                   will add a rule to drop VXLAN encapsulated traffic from workloads
  476.                   [Default: false]'
  477.                 type: boolean
  478.               awsSrcDstCheck:
  479.                 description: 'Set source-destination-check on AWS EC2 instances. Accepted
  480.                   value must be one of "DoNothing", "Enabled" or "Disabled". [Default:
  481.                   DoNothing]'
  482.                 enum:
  483.                 - DoNothing
  484.                 - Enable
  485.                 - Disable
  486.                 type: string
  487.               bpfConnectTimeLoadBalancingEnabled:
  488.                 description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode,
  489.                   controls whether Felix installs the connection-time load balancer.  The
  490.                   connect-time load balancer is required for the host to be able to
  491.                   reach Kubernetes services and it improves the performance of pod-to-service
  492.                   connections.  The only reason to disable it is for debugging purposes.  [Default:
  493.                   true]'
  494.                 type: boolean
  495.               bpfDataIfacePattern:
  496.                 description: BPFDataIfacePattern is a regular expression that controls
  497.                   which interfaces Felix should attach BPF programs to in order to
  498.                   catch traffic to/from the network.  This needs to match the interfaces
  499.                   that Calico workload traffic flows over as well as any interfaces
  500.                   that handle incoming traffic to nodeports and services from outside
  501.                   the cluster.  It should not match the workload interfaces (usually
  502.                   named cali...).
  503.                 type: string
  504.               bpfDisableUnprivileged:
  505.                 description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled
  506.                   sysctl to disable unprivileged use of BPF.  This ensures that unprivileged
  507.                   users cannot access Calico''s BPF maps and cannot insert their own
  508.                   BPF programs to interfere with Calico''s. [Default: true]'
  509.                 type: boolean
  510.               bpfEnabled:
  511.                 description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
  512.                   [Default: false]'
  513.                 type: boolean
  514.               bpfExternalServiceMode:
  515.                 description: 'BPFExternalServiceMode in BPF mode, controls how connections
  516.                   from outside the cluster to services (node ports and cluster IPs)
  517.                   are forwarded to remote workloads.  If set to "Tunnel" then both
  518.                   request and response traffic is tunneled to the remote node.  If
  519.                   set to "DSR", the request traffic is tunneled but the response traffic
  520.                   is sent directly from the remote node.  In "DSR" mode, the remote
  521.                   node appears to use the IP of the ingress node; this requires a
  522.                   permissive L2 network.  [Default: Tunnel]'
  523.                 type: string
  524.               bpfKubeProxyEndpointSlicesEnabled:
  525.                 description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
  526.                   whether Felix's embedded kube-proxy accepts EndpointSlices or not.
  527.                 type: boolean
  528.               bpfKubeProxyIptablesCleanupEnabled:
  529.                 description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF
  530.                   mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s
  531.                   iptables chains.  Should only be enabled if kube-proxy is not running.  [Default:
  532.                   true]'
  533.                 type: boolean
  534.               bpfKubeProxyMinSyncPeriod:
  535.                 description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the
  536.                   minimum time between updates to the dataplane for Felix''s embedded
  537.                   kube-proxy.  Lower values give reduced set-up latency.  Higher values
  538.                   reduce Felix CPU usage by batching up more work.  [Default: 1s]'
  539.                 type: string
  540.               bpfLogLevel:
  541.                 description: 'BPFLogLevel controls the log level of the BPF programs
  542.                   when in BPF dataplane mode.  One of "Off", "Info", or "Debug".  The
  543.                   logs are emitted to the BPF trace pipe, accessible with the command
  544.                   `tc exec bpf debug`. [Default: Off].'
  545.                 type: string
  546.               chainInsertMode:
  547.                 description: 'ChainInsertMode controls whether Felix hooks the kernel''s
  548.                   top-level iptables chains by inserting a rule at the top of the
  549.                   chain or by appending a rule at the bottom. insert is the safe default
  550.                   since it prevents Calico''s rules from being bypassed. If you switch
  551.                   to append mode, be sure that the other rules in the chains signal
  552.                   acceptance by falling through to the Calico rules, otherwise the
  553.                   Calico policy will be bypassed. [Default: insert]'
  554.                 type: string
  555.               dataplaneDriver:
  556.                 type: string
  557.               debugDisableLogDropping:
  558.                 type: boolean
  559.               debugMemoryProfilePath:
  560.                 type: string
  561.               debugSimulateCalcGraphHangAfter:
  562.                 type: string
  563.               debugSimulateDataplaneHangAfter:
  564.                 type: string
  565.               defaultEndpointToHostAction:
  566.                 description: 'DefaultEndpointToHostAction controls what happens to
  567.                   traffic that goes from a workload endpoint to the host itself (after
  568.                   the traffic hits the endpoint egress policy). By default Calico
  569.                   blocks traffic from workload endpoints to the host itself with an
  570.                   iptables "DROP" action. If you want to allow some or all traffic
  571.                   from endpoint to host, set this parameter to RETURN or ACCEPT. Use
  572.                   RETURN if you have your own rules in the iptables "INPUT" chain;
  573.                   Calico will insert its rules at the top of that chain, then "RETURN"
  574.                   packets to the "INPUT" chain once it has completed processing workload
  575.                   endpoint egress policy. Use ACCEPT to unconditionally accept packets
  576.                   from workloads after processing workload endpoint egress policy.
  577.                   [Default: Drop]'
  578.                 type: string
  579.               deviceRouteProtocol:
  580.                 description: This defines the route protocol added to programmed device
  581.                   routes, by default this will be RTPROT_BOOT when left blank.
  582.                 type: integer
  583.               deviceRouteSourceAddress:
  584.                 description: This is the source address to use on programmed device
  585.                   routes. By default the source address is left blank, leaving the
  586.                   kernel to choose the source address used.
  587.                 type: string
  588.               disableConntrackInvalidCheck:
  589.                 type: boolean
  590.               endpointReportingDelay:
  591.                 type: string
  592.               endpointReportingEnabled:
  593.                 type: boolean
  594.               externalNodesList:
  595.                 description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes
  596.                   which may source tunnel traffic and have the tunneled traffic be
  597.                   accepted at calico nodes.
  598.                 items:
  599.                   type: string
  600.                 type: array
  601.               failsafeInboundHostPorts:
  602.                 description: 'FailsafeInboundHostPorts is a comma-delimited list of
  603.                   UDP/TCP ports that Felix will allow incoming traffic to host endpoints
  604.                   on irrespective of the security policy. This is useful to avoid
  605.                   accidentally cutting off a host with incorrect configuration. Each
  606.                   port should be specified as tcp:<port-number> or udp:<port-number>.
  607.                   For back-compatibility, if the protocol is not specified, it defaults
  608.                   to "tcp". To disable all inbound host ports, use the value none.
  609.                   The default value allows ssh access and DHCP. [Default: tcp:22,
  610.                   udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
  611.                 items:
  612.                   description: ProtoPort is combination of protocol and port, both
  613.                     must be specified.
  614.                   properties:
  615.                     port:
  616.                       type: integer
  617.                     protocol:
  618.                       type: string
  619.                   required:
  620.                   - port
  621.                   - protocol
  622.                   type: object
  623.                 type: array
  624.               failsafeOutboundHostPorts:
  625.                 description: 'FailsafeOutboundHostPorts is a comma-delimited list
  626.                   of UDP/TCP ports that Felix will allow outgoing traffic from host
  627.                   endpoints to irrespective of the security policy. This is useful
  628.                   to avoid accidentally cutting off a host with incorrect configuration.
  629.                   Each port should be specified as tcp:<port-number> or udp:<port-number>.
  630.                   For back-compatibility, if the protocol is not specified, it defaults
  631.                   to "tcp". To disable all outbound host ports, use the value none.
  632.                   The default value opens etcd''s standard ports to ensure that Felix
  633.                   does not get cut off from etcd as well as allowing DHCP and DNS.
  634.                   [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667,
  635.                   udp:53, udp:67]'
  636.                 items:
  637.                   description: ProtoPort is combination of protocol and port, both
  638.                     must be specified.
  639.                   properties:
  640.                     port:
  641.                       type: integer
  642.                     protocol:
  643.                       type: string
  644.                   required:
  645.                   - port
  646.                   - protocol
  647.                   type: object
  648.                 type: array
  649.               featureDetectOverride:
  650.                 description: FeatureDetectOverride is used to override the feature
  651.                   detection. Values are specified in a comma separated list with no
  652.                   spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=".
  653.                   "true" or "false" will force the feature, empty or omitted values
  654.                   are auto-detected.
  655.                 type: string
  656.               genericXDPEnabled:
  657.                 description: 'GenericXDPEnabled enables Generic XDP so network cards
  658.                   that don''t support XDP offload or driver modes can use XDP. This
  659.                   is not recommended since it doesn''t provide better performance
  660.                   than iptables. [Default: false]'
  661.                 type: boolean
  662.               healthEnabled:
  663.                 type: boolean
  664.               healthHost:
  665.                 type: string
  666.               healthPort:
  667.                 type: integer
  668.               interfaceExclude:
  669.                 description: 'InterfaceExclude is a comma-separated list of interfaces
  670.                   that Felix should exclude when monitoring for host endpoints. The
  671.                   default value ensures that Felix ignores Kubernetes'' IPVS dummy
  672.                   interface, which is used internally by kube-proxy. If you want to
  673.                   exclude multiple interface names using a single value, the list
  674.                   supports regular expressions. For regular expressions you must wrap
  675.                   the value with ''/''. For example having values ''/^kube/,veth1''
  676.                   will exclude all interfaces that begin with ''kube'' and also the
  677.                   interface ''veth1''. [Default: kube-ipvs0]'
  678.                 type: string
  679.               interfacePrefix:
  680.                 description: 'InterfacePrefix is the interface name prefix that identifies
  681.                   workload endpoints and so distinguishes them from host endpoint
  682.                   interfaces. Note: in environments other than bare metal, the orchestrators
  683.                   configure this appropriately. For example our Kubernetes and Docker
  684.                   integrations set the ''cali'' value, and our OpenStack integration
  685.                   sets the ''tap'' value. [Default: cali]'
  686.                 type: string
  687.               interfaceRefreshInterval:
  688.                 description: InterfaceRefreshInterval is the period at which Felix
  689.                   rescans local interfaces to verify their state. The rescan can be
  690.                   disabled by setting the interval to 0.
  691.                 type: string
  692.               ipipEnabled:
  693.                 type: boolean
  694.               ipipMTU:
  695.                 description: 'IPIPMTU is the MTU to set on the tunnel device. See
  696.                   Configuring MTU [Default: 1440]'
  697.                 type: integer
  698.               ipsetsRefreshInterval:
  699.                 description: 'IpsetsRefreshInterval is the period at which Felix re-checks
  700.                   all iptables state to ensure that no other process has accidentally
  701.                   broken Calico''s rules. Set to 0 to disable iptables refresh. [Default:
  702.                   90s]'
  703.                 type: string
  704.               iptablesBackend:
  705.                 description: IptablesBackend specifies which backend of iptables will
  706.                   be used. The default is legacy.
  707.                 type: string
  708.               iptablesFilterAllowAction:
  709.                 type: string
  710.               iptablesLockFilePath:
  711.                 description: 'IptablesLockFilePath is the location of the iptables
  712.                   lock file. You may need to change this if the lock file is not in
  713.                   its standard location (for example if you have mapped it into Felix''s
  714.                   container at a different path). [Default: /run/xtables.lock]'
  715.                 type: string
  716.               iptablesLockProbeInterval:
  717.                 description: 'IptablesLockProbeInterval is the time that Felix will
  718.                   wait between attempts to acquire the iptables lock if it is not
  719.                   available. Lower values make Felix more responsive when the lock
  720.                   is contended, but use more CPU. [Default: 50ms]'
  721.                 type: string
  722.               iptablesLockTimeout:
  723.                 description: 'IptablesLockTimeout is the time that Felix will wait
  724.                   for the iptables lock, or 0, to disable. To use this feature, Felix
  725.                   must share the iptables lock file with all other processes that
  726.                   also take the lock. When running Felix inside a container, this
  727.                   requires the /run directory of the host to be mounted into the calico/node
  728.                   or calico/felix container. [Default: 0s disabled]'
  729.                 type: string
  730.               iptablesMangleAllowAction:
  731.                 type: string
  732.               iptablesMarkMask:
  733.                 description: 'IptablesMarkMask is the mask that Felix selects its
  734.                   IPTables Mark bits from. Should be a 32 bit hexadecimal number with
  735.                   at least 8 bits set, none of which clash with any other mark bits
  736.                   in use on the system. [Default: 0xff000000]'
  737.                 format: int32
  738.                 type: integer
  739.               iptablesNATOutgoingInterfaceFilter:
  740.                 type: string
  741.               iptablesPostWriteCheckInterval:
  742.                 description: 'IptablesPostWriteCheckInterval is the period after Felix
  743.                   has done a write to the dataplane that it schedules an extra read
  744.                   back in order to check the write was not clobbered by another process.
  745.                   This should only occur if another application on the system doesn''t
  746.                   respect the iptables lock. [Default: 1s]'
  747.                 type: string
  748.               iptablesRefreshInterval:
  749.                 description: 'IptablesRefreshInterval is the period at which Felix
  750.                   re-checks the IP sets in the dataplane to ensure that no other process
  751.                   has accidentally broken Calico''s rules. Set to 0 to disable IP
  752.                   sets refresh. Note: the default for this value is lower than the
  753.                   other refresh intervals as a workaround for a Linux kernel bug that
  754.                   was fixed in kernel version 4.11. If you are using v4.11 or greater
  755.                   you may want to set this to, a higher value to reduce Felix CPU
  756.                   usage. [Default: 10s]'
  757.                 type: string
  758.               ipv6Support:
  759.                 type: boolean
  760.               kubeNodePortRanges:
  761.                 description: 'KubeNodePortRanges holds list of port ranges used for
  762.                   service node ports. Only used if felix detects kube-proxy running
  763.                   in ipvs mode. Felix uses these ranges to separate host and workload
  764.                   traffic. [Default: 30000:32767].'
  765.                 items:
  766.                   anyOf:
  767.                   - type: integer
  768.                   - type: string
  769.                   pattern: ^.*
  770.                   x-kubernetes-int-or-string: true
  771.                 type: array
  772.               logFilePath:
  773.                 description: 'LogFilePath is the full path to the Felix log. Set to
  774.                   none to disable file logging. [Default: /var/log/calico/felix.log]'
  775.                 type: string
  776.               logPrefix:
  777.                 description: 'LogPrefix is the log prefix that Felix uses when rendering
  778.                   LOG rules. [Default: calico-packet]'
  779.                 type: string
  780.               logSeverityFile:
  781.                 description: 'LogSeverityFile is the log severity above which logs
  782.                   are sent to the log file. [Default: Info]'
  783.                 type: string
  784.               logSeverityScreen:
  785.                 description: 'LogSeverityScreen is the log severity above which logs
  786.                   are sent to the stdout. [Default: Info]'
  787.                 type: string
  788.               logSeveritySys:
  789.                 description: 'LogSeveritySys is the log severity above which logs
  790.                   are sent to the syslog. Set to None for no logging to syslog. [Default:
  791.                   Info]'
  792.                 type: string
  793.               maxIpsetSize:
  794.                 type: integer
  795.               metadataAddr:
  796.                 description: 'MetadataAddr is the IP address or domain name of the
  797.                   server that can answer VM queries for cloud-init metadata. In OpenStack,
  798.                   this corresponds to the machine running nova-api (or in Ubuntu,
  799.                   nova-api-metadata). A value of none (case insensitive) means that
  800.                   Felix should not set up any NAT rule for the metadata path. [Default:
  801.                   127.0.0.1]'
  802.                 type: string
  803.               metadataPort:
  804.                 description: 'MetadataPort is the port of the metadata server. This,
  805.                   combined with global.MetadataAddr (if not ''None''), is used to
  806.                   set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
  807.                   In most cases this should not need to be changed [Default: 8775].'
  808.                 type: integer
  809.               mtuIfacePattern:
  810.                 description: MTUIfacePattern is a regular expression that controls
  811.                   which interfaces Felix should scan in order to calculate the host's
  812.                   MTU. This should not match workload interfaces (usually named cali...).
  813.                 type: string
  814.               natOutgoingAddress:
  815.                 description: NATOutgoingAddress specifies an address to use when performing
  816.                   source NAT for traffic in a natOutgoing pool that is leaving the
  817.                   network. By default the address used is an address on the interface
  818.                   the traffic is leaving on (ie it uses the iptables MASQUERADE target)
  819.                 type: string
  820.               natPortRange:
  821.                 anyOf:
  822.                 - type: integer
  823.                 - type: string
  824.                 description: NATPortRange specifies the range of ports that is used
  825.                   for port mapping when doing outgoing NAT. When unset the default
  826.                   behavior of the network stack is used.
  827.                 pattern: ^.*
  828.                 x-kubernetes-int-or-string: true
  829.               netlinkTimeout:
  830.                 type: string
  831.               openstackRegion:
  832.                 description: 'OpenstackRegion is the name of the region that a particular
  833.                   Felix belongs to. In a multi-region Calico/OpenStack deployment,
  834.                   this must be configured somehow for each Felix (here in the datamodel,
  835.                   or in felix.cfg or the environment on each compute node), and must
  836.                   match the [calico] openstack_region value configured in neutron.conf
  837.                   on each node. [Default: Empty]'
  838.                 type: string
  839.               policySyncPathPrefix:
  840.                 description: 'PolicySyncPathPrefix is used to by Felix to communicate
  841.                   policy changes to external services, like Application layer policy.
  842.                   [Default: Empty]'
  843.                 type: string
  844.               prometheusGoMetricsEnabled:
  845.                 description: 'PrometheusGoMetricsEnabled disables Go runtime metrics
  846.                   collection, which the Prometheus client does by default, when set
  847.                   to false. This reduces the number of metrics reported, reducing
  848.                   Prometheus load. [Default: true]'
  849.                 type: boolean
  850.               prometheusMetricsEnabled:
  851.                 description: 'PrometheusMetricsEnabled enables the Prometheus metrics
  852.                   server in Felix if set to true. [Default: false]'
  853.                 type: boolean
  854.               prometheusMetricsHost:
  855.                 description: 'PrometheusMetricsHost is the host that the Prometheus
  856.                   metrics server should bind to. [Default: empty]'
  857.                 type: string
  858.               prometheusMetricsPort:
  859.                 description: 'PrometheusMetricsPort is the TCP port that the Prometheus
  860.                   metrics server should bind to. [Default: 9091]'
  861.                 type: integer
  862.               prometheusProcessMetricsEnabled:
  863.                 description: 'PrometheusProcessMetricsEnabled disables process metrics
  864.                   collection, which the Prometheus client does by default, when set
  865.                   to false. This reduces the number of metrics reported, reducing
  866.                   Prometheus load. [Default: true]'
  867.                 type: boolean
  868.               removeExternalRoutes:
  869.                 description: Whether or not to remove device routes that have not
  870.                   been programmed by Felix. Disabling this will allow external applications
  871.                   to also add device routes. This is enabled by default which means
  872.                   we will remove externally added routes.
  873.                 type: boolean
  874.               reportingInterval:
  875.                 description: 'ReportingInterval is the interval at which Felix reports
  876.                   its status into the datastore or 0 to disable. Must be non-zero
  877.                   in OpenStack deployments. [Default: 30s]'
  878.                 type: string
  879.               reportingTTL:
  880.                 description: 'ReportingTTL is the time-to-live setting for process-wide
  881.                   status reports. [Default: 90s]'
  882.                 type: string
  883.               routeRefreshInterval:
  884.                 description: 'RouteRefreshInterval is the period at which Felix re-checks
  885.                   the routes in the dataplane to ensure that no other process has
  886.                   accidentally broken Calico''s rules. Set to 0 to disable route refresh.
  887.                   [Default: 90s]'
  888.                 type: string
  889.               routeSource:
  890.                 description: 'RouteSource configures where Felix gets its routing
  891.                   information. - WorkloadIPs: use workload endpoints to construct
  892.                   routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
  893.                 type: string
  894.               routeTableRange:
  895.                 description: Calico programs additional Linux route tables for various
  896.                   purposes.  RouteTableRange specifies the indices of the route tables
  897.                   that Calico should use.
  898.                 properties:
  899.                   max:
  900.                     type: integer
  901.                   min:
  902.                     type: integer
  903.                 required:
  904.                 - max
  905.                 - min
  906.                 type: object
  907.               serviceLoopPrevention:
  908.                 description: 'When service IP advertisement is enabled, prevent routing
  909.                   loops to service IPs that are not in use, by dropping or rejecting
  910.                   packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled",
  911.                   in which case such routing loops continue to be allowed. [Default:
  912.                   Drop]'
  913.                 type: string
  914.               sidecarAccelerationEnabled:
  915.                 description: 'SidecarAccelerationEnabled enables experimental sidecar
  916.                   acceleration [Default: false]'
  917.                 type: boolean
  918.               usageReportingEnabled:
  919.                 description: 'UsageReportingEnabled reports anonymous Calico version
  920.                   number and cluster size to projectcalico.org. Logs warnings returned
  921.                   by the usage server. For example, if a significant security vulnerability
  922.                   has been discovered in the version of Calico being used. [Default:
  923.                   true]'
  924.                 type: boolean
  925.               usageReportingInitialDelay:
  926.                 description: 'UsageReportingInitialDelay controls the minimum delay
  927.                   before Felix makes a report. [Default: 300s]'
  928.                 type: string
  929.               usageReportingInterval:
  930.                 description: 'UsageReportingInterval controls the interval at which
  931.                   Felix makes reports. [Default: 86400s]'
  932.                 type: string
  933.               useInternalDataplaneDriver:
  934.                 type: boolean
  935.               vxlanEnabled:
  936.                 type: boolean
  937.               vxlanMTU:
  938.                 description: 'VXLANMTU is the MTU to set on the tunnel device. See
  939.                   Configuring MTU [Default: 1440]'
  940.                 type: integer
  941.               vxlanPort:
  942.                 type: integer
  943.               vxlanVNI:
  944.                 type: integer
  945.               wireguardEnabled:
  946.                 description: 'WireguardEnabled controls whether Wireguard is enabled.
  947.                   [Default: false]'
  948.                 type: boolean
  949.               wireguardInterfaceName:
  950.                 description: 'WireguardInterfaceName specifies the name to use for
  951.                   the Wireguard interface. [Default: wg.calico]'
  952.                 type: string
  953.               wireguardListeningPort:
  954.                 description: 'WireguardListeningPort controls the listening port used
  955.                   by Wireguard. [Default: 51820]'
  956.                 type: integer
  957.               wireguardMTU:
  958.                 description: 'WireguardMTU controls the MTU on the Wireguard interface.
  959.                   See Configuring MTU [Default: 1420]'
  960.                 type: integer
  961.               wireguardRoutingRulePriority:
  962.                 description: 'WireguardRoutingRulePriority controls the priority value
  963.                   to use for the Wireguard routing rule. [Default: 99]'
  964.                 type: integer
  965.               xdpEnabled:
  966.                 description: 'XDPEnabled enables XDP acceleration for suitable untracked
  967.                   incoming deny rules. [Default: true]'
  968.                 type: boolean
  969.               xdpRefreshInterval:
  970.                 description: 'XDPRefreshInterval is the period at which Felix re-checks
  971.                   all XDP state to ensure that no other process has accidentally broken
  972.                   Calico''s BPF maps or attached programs. Set to 0 to disable XDP
  973.                   refresh. [Default: 90s]'
  974.                 type: string
  975.             type: object
  976.         type: object
  977.     served: true
  978.     storage: true
  979. status:
  980.   acceptedNames:
  981.     kind: ""
  982.     plural: ""
  983.   conditions: []
  984.   storedVersions: []
  986. ---
  987. apiVersion: apiextensions.k8s.io/v1
  988. kind: CustomResourceDefinition
  989. metadata:
  990.   name: globalnetworkpolicies.crd.projectcalico.org
  991. spec:
  992.   group: crd.projectcalico.org
  993.   names:
  994.     kind: GlobalNetworkPolicy
  995.     listKind: GlobalNetworkPolicyList
  996.     plural: globalnetworkpolicies
  997.     singular: globalnetworkpolicy
  998.   scope: Cluster
  999.   versions:
  1000.   - name: v1
  1001.     schema:
  1002.       openAPIV3Schema:
  1003.         properties:
  1004.           apiVersion:
  1005.             description: 'APIVersion defines the versioned schema of this representation
  1006.               of an object. Servers should convert recognized schemas to the latest
  1007.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1008.             type: string
  1009.           kind:
  1010.             description: 'Kind is a string value representing the REST resource this
  1011.               object represents. Servers may infer this from the endpoint the client
  1012.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1013.             type: string
  1014.           metadata:
  1015.             type: object
  1016.           spec:
  1017.             properties:
  1018.               applyOnForward:
  1019.                 description: ApplyOnForward indicates to apply the rules in this policy
  1020.                   on forward traffic.
  1021.                 type: boolean
  1022.               doNotTrack:
  1023.                 description: DoNotTrack indicates whether packets matched by the rules
  1024.                   in this policy should go through the data plane's connection tracking,
  1025.                   such as Linux conntrack.  If True, the rules in this policy are
  1026.                   applied before any data plane connection tracking, and packets allowed
  1027.                   by this policy are marked as not to be tracked.
  1028.                 type: boolean
  1029.               egress:
  1030.                 description: The ordered set of egress rules.  Each rule contains
  1031.                   a set of packet match criteria and a corresponding action to apply.
  1032.                 items:
  1033.                   description: "A Rule encapsulates a set of match criteria and an
  1034.                     action.  Both selector-based security Policy and security Profiles
  1035.                     reference rules - separated out as a list of rules for both ingress
  1036.                     and egress packet matching. \n Each positive match criteria has
  1037.                     a negated version, prefixed with \"Not\". All the match criteria
  1038.                     within a rule must be satisfied for a packet to match. A single
  1039.                     rule can contain the positive and negative version of a match
  1040.                     and both must be satisfied for the rule to match."
  1041.                   properties:
  1042.                     action:
  1043.                       type: string
  1044.                     destination:
  1045.                       description: Destination contains the match criteria that apply
  1046.                         to destination entity.
  1047.                       properties:
  1048.                         namespaceSelector:
  1049.                           description: "NamespaceSelector is an optional field that
  1050.                             contains a selector expression. Only traffic that originates
  1051.                             from (or terminates at) endpoints within the selected
  1052.                             namespaces will be matched. When both NamespaceSelector
  1053.                             and Selector are defined on the same rule, then only workload
  1054.                             endpoints that are matched by both selectors will be selected
  1055.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1056.                             implies that the Selector is limited to selecting only
  1057.                             workload endpoints in the same namespace as the NetworkPolicy.
  1058.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1059.                             that the Selector is limited to selecting only GlobalNetworkSet
  1060.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1061.                             NamespaceSelector implies the Selector applies to workload
  1062.                             endpoints across all namespaces."
  1063.                           type: string
  1064.                         nets:
  1065.                           description: Nets is an optional field that restricts the
  1066.                             rule to only apply to traffic that originates from (or
  1067.                             terminates at) IP addresses in any of the given subnets.
  1068.                           items:
  1069.                             type: string
  1070.                           type: array
  1071.                         notNets:
  1072.                           description: NotNets is the negated version of the Nets
  1073.                             field.
  1074.                           items:
  1075.                             type: string
  1076.                           type: array
  1077.                         notPorts:
  1078.                           description: NotPorts is the negated version of the Ports
  1079.                             field. Since only some protocols have ports, if any ports
  1080.                             are specified it requires the Protocol match in the Rule
  1081.                             to be set to "TCP" or "UDP".
  1082.                           items:
  1083.                             anyOf:
  1084.                             - type: integer
  1085.                             - type: string
  1086.                             pattern: ^.*
  1087.                             x-kubernetes-int-or-string: true
  1088.                           type: array
  1089.                         notSelector:
  1090.                           description: NotSelector is the negated version of the Selector
  1091.                             field.  See Selector field for subtleties with negated
  1092.                             selectors.
  1093.                           type: string
  1094.                         ports:
  1095.                           description: "Ports is an optional field that restricts
  1096.                             the rule to only apply to traffic that has a source (destination)
  1097.                             port that matches one of these ranges/values. This value
  1098.                             is a list of integers or strings that represent ranges
  1099.                             of ports. \n Since only some protocols have ports, if
  1100.                             any ports are specified it requires the Protocol match
  1101.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1102.                           items:
  1103.                             anyOf:
  1104.                             - type: integer
  1105.                             - type: string
  1106.                             pattern: ^.*
  1107.                             x-kubernetes-int-or-string: true
  1108.                           type: array
  1109.                         selector:
  1110.                           description: "Selector is an optional field that contains
  1111.                             a selector expression (see Policy for sample syntax).
  1112.                             \ Only traffic that originates from (terminates at) endpoints
  1113.                             matching the selector will be matched. \n Note that: in
  1114.                             addition to the negated version of the Selector (see NotSelector
  1115.                             below), the selector expression syntax itself supports
  1116.                             negation.  The two types of negation are subtly different.
  1117.                             One negates the set of matched endpoints, the other negates
  1118.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1119.                             packets that are from other Calico-controlled \tendpoints
  1120.                             that do not have the label \"my_label\". \n \tNotSelector
  1121.                             = \"has(my_label)\" matches packets that are not from
  1122.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  1123.                             \n The effect is that the latter will accept packets from
  1124.                             non-Calico sources whereas the former is limited to packets
  1125.                             from Calico-controlled endpoints."
  1126.                           type: string
  1127.                         serviceAccounts:
  1128.                           description: ServiceAccounts is an optional field that restricts
  1129.                             the rule to only apply to traffic that originates from
  1130.                             (or terminates at) a pod running as a matching service
  1131.                             account.
  1132.                           properties:
  1133.                             names:
  1134.                               description: Names is an optional field that restricts
  1135.                                 the rule to only apply to traffic that originates
  1136.                                 from (or terminates at) a pod running as a service
  1137.                                 account whose name is in the list.
  1138.                               items:
  1139.                                 type: string
  1140.                               type: array
  1141.                             selector:
  1142.                               description: Selector is an optional field that restricts
  1143.                                 the rule to only apply to traffic that originates
  1144.                                 from (or terminates at) a pod running as a service
  1145.                                 account that matches the given label selector. If
  1146.                                 both Names and Selector are specified then they are
  1147.                                 AND'ed.
  1148.                               type: string
  1149.                           type: object
  1150.                       type: object
  1151.                     http:
  1152.                       description: HTTP contains match criteria that apply to HTTP
  1153.                         requests.
  1154.                       properties:
  1155.                         methods:
  1156.                           description: Methods is an optional field that restricts
  1157.                             the rule to apply only to HTTP requests that use one of
  1158.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  1159.                             methods are OR'd together.
  1160.                           items:
  1161.                             type: string
  1162.                           type: array
  1163.                         paths:
  1164.                           description: 'Paths is an optional field that restricts
  1165.                             the rule to apply to HTTP requests that use one of the
  1166.                             listed HTTP Paths. Multiple paths are OR''d together.
  1167.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  1168.                             ONLY specify either a `exact` or a `prefix` match. The
  1169.                             validator will check for it.'
  1170.                           items:
  1171.                             description: 'HTTPPath specifies an HTTP path to match.
  1172.                               It may be either of the form: exact: <path>: which matches
  1173.                               the path exactly or prefix: <path-prefix>: which matches
  1174.                               the path prefix'
  1175.                             properties:
  1176.                               exact:
  1177.                                 type: string
  1178.                               prefix:
  1179.                                 type: string
  1180.                             type: object
  1181.                           type: array
  1182.                       type: object
  1183.                     icmp:
  1184.                       description: ICMP is an optional field that restricts the rule
  1185.                         to apply to a specific type and code of ICMP traffic.  This
  1186.                         should only be specified if the Protocol field is set to "ICMP"
  1187.                         or "ICMPv6".
  1188.                       properties:
  1189.                         code:
  1190.                           description: Match on a specific ICMP code.  If specified,
  1191.                             the Type value must also be specified. This is a technical
  1192.                             limitation imposed by the kernel's iptables firewall,
  1193.                             which Calico uses to enforce the rule.
  1194.                           type: integer
  1195.                         type:
  1196.                           description: Match on a specific ICMP type.  For example
  1197.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1198.                           type: integer
  1199.                       type: object
  1200.                     ipVersion:
  1201.                       description: IPVersion is an optional field that restricts the
  1202.                         rule to only match a specific IP version.
  1203.                       type: integer
  1204.                     metadata:
  1205.                       description: Metadata contains additional information for this
  1206.                         rule
  1207.                       properties:
  1208.                         annotations:
  1209.                           additionalProperties:
  1210.                             type: string
  1211.                           description: Annotations is a set of key value pairs that
  1212.                             give extra information about the rule
  1213.                           type: object
  1214.                       type: object
  1215.                     notICMP:
  1216.                       description: NotICMP is the negated version of the ICMP field.
  1217.                       properties:
  1218.                         code:
  1219.                           description: Match on a specific ICMP code.  If specified,
  1220.                             the Type value must also be specified. This is a technical
  1221.                             limitation imposed by the kernel's iptables firewall,
  1222.                             which Calico uses to enforce the rule.
  1223.                           type: integer
  1224.                         type:
  1225.                           description: Match on a specific ICMP type.  For example
  1226.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1227.                           type: integer
  1228.                       type: object
  1229.                     notProtocol:
  1230.                       anyOf:
  1231.                       - type: integer
  1232.                       - type: string
  1233.                       description: NotProtocol is the negated version of the Protocol
  1234.                         field.
  1235.                       pattern: ^.*
  1236.                       x-kubernetes-int-or-string: true
  1237.                     protocol:
  1238.                       anyOf:
  1239.                       - type: integer
  1240.                       - type: string
  1241.                       description: "Protocol is an optional field that restricts the
  1242.                         rule to only apply to traffic of a specific IP protocol. Required
  1243.                         if any of the EntityRules contain Ports (because ports only
  1244.                         apply to certain protocols). \n Must be one of these string
  1245.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  1246.                         \"UDPLite\" or an integer in the range 1-255."
  1247.                       pattern: ^.*
  1248.                       x-kubernetes-int-or-string: true
  1249.                     source:
  1250.                       description: Source contains the match criteria that apply to
  1251.                         source entity.
  1252.                       properties:
  1253.                         namespaceSelector:
  1254.                           description: "NamespaceSelector is an optional field that
  1255.                             contains a selector expression. Only traffic that originates
  1256.                             from (or terminates at) endpoints within the selected
  1257.                             namespaces will be matched. When both NamespaceSelector
  1258.                             and Selector are defined on the same rule, then only workload
  1259.                             endpoints that are matched by both selectors will be selected
  1260.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1261.                             implies that the Selector is limited to selecting only
  1262.                             workload endpoints in the same namespace as the NetworkPolicy.
  1263.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1264.                             that the Selector is limited to selecting only GlobalNetworkSet
  1265.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1266.                             NamespaceSelector implies the Selector applies to workload
  1267.                             endpoints across all namespaces."
  1268.                           type: string
  1269.                         nets:
  1270.                           description: Nets is an optional field that restricts the
  1271.                             rule to only apply to traffic that originates from (or
  1272.                             terminates at) IP addresses in any of the given subnets.
  1273.                           items:
  1274.                             type: string
  1275.                           type: array
  1276.                         notNets:
  1277.                           description: NotNets is the negated version of the Nets
  1278.                             field.
  1279.                           items:
  1280.                             type: string
  1281.                           type: array
  1282.                         notPorts:
  1283.                           description: NotPorts is the negated version of the Ports
  1284.                             field. Since only some protocols have ports, if any ports
  1285.                             are specified it requires the Protocol match in the Rule
  1286.                             to be set to "TCP" or "UDP".
  1287.                           items:
  1288.                             anyOf:
  1289.                             - type: integer
  1290.                             - type: string
  1291.                             pattern: ^.*
  1292.                             x-kubernetes-int-or-string: true
  1293.                           type: array
  1294.                         notSelector:
  1295.                           description: NotSelector is the negated version of the Selector
  1296.                             field.  See Selector field for subtleties with negated
  1297.                             selectors.
  1298.                           type: string
  1299.                         ports:
  1300.                           description: "Ports is an optional field that restricts
  1301.                             the rule to only apply to traffic that has a source (destination)
  1302.                             port that matches one of these ranges/values. This value
  1303.                             is a list of integers or strings that represent ranges
  1304.                             of ports. \n Since only some protocols have ports, if
  1305.                             any ports are specified it requires the Protocol match
  1306.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1307.                           items:
  1308.                             anyOf:
  1309.                             - type: integer
  1310.                             - type: string
  1311.                             pattern: ^.*
  1312.                             x-kubernetes-int-or-string: true
  1313.                           type: array
  1314.                         selector:
  1315.                           description: "Selector is an optional field that contains
  1316.                             a selector expression (see Policy for sample syntax).
  1317.                             \ Only traffic that originates from (terminates at) endpoints
  1318.                             matching the selector will be matched. \n Note that: in
  1319.                             addition to the negated version of the Selector (see NotSelector
  1320.                             below), the selector expression syntax itself supports
  1321.                             negation.  The two types of negation are subtly different.
  1322.                             One negates the set of matched endpoints, the other negates
  1323.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1324.                             packets that are from other Calico-controlled \tendpoints
  1325.                             that do not have the label \"my_label\". \n \tNotSelector
  1326.                             = \"has(my_label)\" matches packets that are not from
  1327.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  1328.                             \n The effect is that the latter will accept packets from
  1329.                             non-Calico sources whereas the former is limited to packets
  1330.                             from Calico-controlled endpoints."
  1331.                           type: string
  1332.                         serviceAccounts:
  1333.                           description: ServiceAccounts is an optional field that restricts
  1334.                             the rule to only apply to traffic that originates from
  1335.                             (or terminates at) a pod running as a matching service
  1336.                             account.
  1337.                           properties:
  1338.                             names:
  1339.                               description: Names is an optional field that restricts
  1340.                                 the rule to only apply to traffic that originates
  1341.                                 from (or terminates at) a pod running as a service
  1342.                                 account whose name is in the list.
  1343.                               items:
  1344.                                 type: string
  1345.                               type: array
  1346.                             selector:
  1347.                               description: Selector is an optional field that restricts
  1348.                                 the rule to only apply to traffic that originates
  1349.                                 from (or terminates at) a pod running as a service
  1350.                                 account that matches the given label selector. If
  1351.                                 both Names and Selector are specified then they are
  1352.                                 AND'ed.
  1353.                               type: string
  1354.                           type: object
  1355.                       type: object
  1356.                   required:
  1357.                   - action
  1358.                   type: object
  1359.                 type: array
  1360.               ingress:
  1361.                 description: The ordered set of ingress rules.  Each rule contains
  1362.                   a set of packet match criteria and a corresponding action to apply.
  1363.                 items:
  1364.                   description: "A Rule encapsulates a set of match criteria and an
  1365.                     action.  Both selector-based security Policy and security Profiles
  1366.                     reference rules - separated out as a list of rules for both ingress
  1367.                     and egress packet matching. \n Each positive match criteria has
  1368.                     a negated version, prefixed with \"Not\". All the match criteria
  1369.                     within a rule must be satisfied for a packet to match. A single
  1370.                     rule can contain the positive and negative version of a match
  1371.                     and both must be satisfied for the rule to match."
  1372.                   properties:
  1373.                     action:
  1374.                       type: string
  1375.                     destination:
  1376.                       description: Destination contains the match criteria that apply
  1377.                         to destination entity.
  1378.                       properties:
  1379.                         namespaceSelector:
  1380.                           description: "NamespaceSelector is an optional field that
  1381.                             contains a selector expression. Only traffic that originates
  1382.                             from (or terminates at) endpoints within the selected
  1383.                             namespaces will be matched. When both NamespaceSelector
  1384.                             and Selector are defined on the same rule, then only workload
  1385.                             endpoints that are matched by both selectors will be selected
  1386.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1387.                             implies that the Selector is limited to selecting only
  1388.                             workload endpoints in the same namespace as the NetworkPolicy.
  1389.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1390.                             that the Selector is limited to selecting only GlobalNetworkSet
  1391.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1392.                             NamespaceSelector implies the Selector applies to workload
  1393.                             endpoints across all namespaces."
  1394.                           type: string
  1395.                         nets:
  1396.                           description: Nets is an optional field that restricts the
  1397.                             rule to only apply to traffic that originates from (or
  1398.                             terminates at) IP addresses in any of the given subnets.
  1399.                           items:
  1400.                             type: string
  1401.                           type: array
  1402.                         notNets:
  1403.                           description: NotNets is the negated version of the Nets
  1404.                             field.
  1405.                           items:
  1406.                             type: string
  1407.                           type: array
  1408.                         notPorts:
  1409.                           description: NotPorts is the negated version of the Ports
  1410.                             field. Since only some protocols have ports, if any ports
  1411.                             are specified it requires the Protocol match in the Rule
  1412.                             to be set to "TCP" or "UDP".
  1413.                           items:
  1414.                             anyOf:
  1415.                             - type: integer
  1416.                             - type: string
  1417.                             pattern: ^.*
  1418.                             x-kubernetes-int-or-string: true
  1419.                           type: array
  1420.                         notSelector:
  1421.                           description: NotSelector is the negated version of the Selector
  1422.                             field.  See Selector field for subtleties with negated
  1423.                             selectors.
  1424.                           type: string
  1425.                         ports:
  1426.                           description: "Ports is an optional field that restricts
  1427.                             the rule to only apply to traffic that has a source (destination)
  1428.                             port that matches one of these ranges/values. This value
  1429.                             is a list of integers or strings that represent ranges
  1430.                             of ports. \n Since only some protocols have ports, if
  1431.                             any ports are specified it requires the Protocol match
  1432.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1433.                           items:
  1434.                             anyOf:
  1435.                             - type: integer
  1436.                             - type: string
  1437.                             pattern: ^.*
  1438.                             x-kubernetes-int-or-string: true
  1439.                           type: array
  1440.                         selector:
  1441.                           description: "Selector is an optional field that contains
  1442.                             a selector expression (see Policy for sample syntax).
  1443.                             \ Only traffic that originates from (terminates at) endpoints
  1444.                             matching the selector will be matched. \n Note that: in
  1445.                             addition to the negated version of the Selector (see NotSelector
  1446.                             below), the selector expression syntax itself supports
  1447.                             negation.  The two types of negation are subtly different.
  1448.                             One negates the set of matched endpoints, the other negates
  1449.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1450.                             packets that are from other Calico-controlled \tendpoints
  1451.                             that do not have the label \"my_label\". \n \tNotSelector
  1452.                             = \"has(my_label)\" matches packets that are not from
  1453.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  1454.                             \n The effect is that the latter will accept packets from
  1455.                             non-Calico sources whereas the former is limited to packets
  1456.                             from Calico-controlled endpoints."
  1457.                           type: string
  1458.                         serviceAccounts:
  1459.                           description: ServiceAccounts is an optional field that restricts
  1460.                             the rule to only apply to traffic that originates from
  1461.                             (or terminates at) a pod running as a matching service
  1462.                             account.
  1463.                           properties:
  1464.                             names:
  1465.                               description: Names is an optional field that restricts
  1466.                                 the rule to only apply to traffic that originates
  1467.                                 from (or terminates at) a pod running as a service
  1468.                                 account whose name is in the list.
  1469.                               items:
  1470.                                 type: string
  1471.                               type: array
  1472.                             selector:
  1473.                               description: Selector is an optional field that restricts
  1474.                                 the rule to only apply to traffic that originates
  1475.                                 from (or terminates at) a pod running as a service
  1476.                                 account that matches the given label selector. If
  1477.                                 both Names and Selector are specified then they are
  1478.                                 AND'ed.
  1479.                               type: string
  1480.                           type: object
  1481.                       type: object
  1482.                     http:
  1483.                       description: HTTP contains match criteria that apply to HTTP
  1484.                         requests.
  1485.                       properties:
  1486.                         methods:
  1487.                           description: Methods is an optional field that restricts
  1488.                             the rule to apply only to HTTP requests that use one of
  1489.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  1490.                             methods are OR'd together.
  1491.                           items:
  1492.                             type: string
  1493.                           type: array
  1494.                         paths:
  1495.                           description: 'Paths is an optional field that restricts
  1496.                             the rule to apply to HTTP requests that use one of the
  1497.                             listed HTTP Paths. Multiple paths are OR''d together.
  1498.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  1499.                             ONLY specify either a `exact` or a `prefix` match. The
  1500.                             validator will check for it.'
  1501.                           items:
  1502.                             description: 'HTTPPath specifies an HTTP path to match.
  1503.                               It may be either of the form: exact: <path>: which matches
  1504.                               the path exactly or prefix: <path-prefix>: which matches
  1505.                               the path prefix'
  1506.                             properties:
  1507.                               exact:
  1508.                                 type: string
  1509.                               prefix:
  1510.                                 type: string
  1511.                             type: object
  1512.                           type: array
  1513.                       type: object
  1514.                     icmp:
  1515.                       description: ICMP is an optional field that restricts the rule
  1516.                         to apply to a specific type and code of ICMP traffic.  This
  1517.                         should only be specified if the Protocol field is set to "ICMP"
  1518.                         or "ICMPv6".
  1519.                       properties:
  1520.                         code:
  1521.                           description: Match on a specific ICMP code.  If specified,
  1522.                             the Type value must also be specified. This is a technical
  1523.                             limitation imposed by the kernel's iptables firewall,
  1524.                             which Calico uses to enforce the rule.
  1525.                           type: integer
  1526.                         type:
  1527.                           description: Match on a specific ICMP type.  For example
  1528.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1529.                           type: integer
  1530.                       type: object
  1531.                     ipVersion:
  1532.                       description: IPVersion is an optional field that restricts the
  1533.                         rule to only match a specific IP version.
  1534.                       type: integer
  1535.                     metadata:
  1536.                       description: Metadata contains additional information for this
  1537.                         rule
  1538.                       properties:
  1539.                         annotations:
  1540.                           additionalProperties:
  1541.                             type: string
  1542.                           description: Annotations is a set of key value pairs that
  1543.                             give extra information about the rule
  1544.                           type: object
  1545.                       type: object
  1546.                     notICMP:
  1547.                       description: NotICMP is the negated version of the ICMP field.
  1548.                       properties:
  1549.                         code:
  1550.                           description: Match on a specific ICMP code.  If specified,
  1551.                             the Type value must also be specified. This is a technical
  1552.                             limitation imposed by the kernel's iptables firewall,
  1553.                             which Calico uses to enforce the rule.
  1554.                           type: integer
  1555.                         type:
  1556.                           description: Match on a specific ICMP type.  For example
  1557.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  1558.                           type: integer
  1559.                       type: object
  1560.                     notProtocol:
  1561.                       anyOf:
  1562.                       - type: integer
  1563.                       - type: string
  1564.                       description: NotProtocol is the negated version of the Protocol
  1565.                         field.
  1566.                       pattern: ^.*
  1567.                       x-kubernetes-int-or-string: true
  1568.                     protocol:
  1569.                       anyOf:
  1570.                       - type: integer
  1571.                       - type: string
  1572.                       description: "Protocol is an optional field that restricts the
  1573.                         rule to only apply to traffic of a specific IP protocol. Required
  1574.                         if any of the EntityRules contain Ports (because ports only
  1575.                         apply to certain protocols). \n Must be one of these string
  1576.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  1577.                         \"UDPLite\" or an integer in the range 1-255."
  1578.                       pattern: ^.*
  1579.                       x-kubernetes-int-or-string: true
  1580.                     source:
  1581.                       description: Source contains the match criteria that apply to
  1582.                         source entity.
  1583.                       properties:
  1584.                         namespaceSelector:
  1585.                           description: "NamespaceSelector is an optional field that
  1586.                             contains a selector expression. Only traffic that originates
  1587.                             from (or terminates at) endpoints within the selected
  1588.                             namespaces will be matched. When both NamespaceSelector
  1589.                             and Selector are defined on the same rule, then only workload
  1590.                             endpoints that are matched by both selectors will be selected
  1591.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  1592.                             implies that the Selector is limited to selecting only
  1593.                             workload endpoints in the same namespace as the NetworkPolicy.
  1594.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  1595.                             that the Selector is limited to selecting only GlobalNetworkSet
  1596.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  1597.                             NamespaceSelector implies the Selector applies to workload
  1598.                             endpoints across all namespaces."
  1599.                           type: string
  1600.                         nets:
  1601.                           description: Nets is an optional field that restricts the
  1602.                             rule to only apply to traffic that originates from (or
  1603.                             terminates at) IP addresses in any of the given subnets.
  1604.                           items:
  1605.                             type: string
  1606.                           type: array
  1607.                         notNets:
  1608.                           description: NotNets is the negated version of the Nets
  1609.                             field.
  1610.                           items:
  1611.                             type: string
  1612.                           type: array
  1613.                         notPorts:
  1614.                           description: NotPorts is the negated version of the Ports
  1615.                             field. Since only some protocols have ports, if any ports
  1616.                             are specified it requires the Protocol match in the Rule
  1617.                             to be set to "TCP" or "UDP".
  1618.                           items:
  1619.                             anyOf:
  1620.                             - type: integer
  1621.                             - type: string
  1622.                             pattern: ^.*
  1623.                             x-kubernetes-int-or-string: true
  1624.                           type: array
  1625.                         notSelector:
  1626.                           description: NotSelector is the negated version of the Selector
  1627.                             field.  See Selector field for subtleties with negated
  1628.                             selectors.
  1629.                           type: string
  1630.                         ports:
  1631.                           description: "Ports is an optional field that restricts
  1632.                             the rule to only apply to traffic that has a source (destination)
  1633.                             port that matches one of these ranges/values. This value
  1634.                             is a list of integers or strings that represent ranges
  1635.                             of ports. \n Since only some protocols have ports, if
  1636.                             any ports are specified it requires the Protocol match
  1637.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  1638.                           items:
  1639.                             anyOf:
  1640.                             - type: integer
  1641.                             - type: string
  1642.                             pattern: ^.*
  1643.                             x-kubernetes-int-or-string: true
  1644.                           type: array
  1645.                         selector:
  1646.                           description: "Selector is an optional field that contains
  1647.                             a selector expression (see Policy for sample syntax).
  1648.                             \ Only traffic that originates from (terminates at) endpoints
  1649.                             matching the selector will be matched. \n Note that: in
  1650.                             addition to the negated version of the Selector (see NotSelector
  1651.                             below), the selector expression syntax itself supports
  1652.                             negation.  The two types of negation are subtly different.
  1653.                             One negates the set of matched endpoints, the other negates
  1654.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  1655.                             packets that are from other Calico-controlled \tendpoints
  1656.                             that do not have the label \"my_label\". \n \tNotSelector
  1657.                             = \"has(my_label)\" matches packets that are not from
  1658.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  1659.                             \n The effect is that the latter will accept packets from
  1660.                             non-Calico sources whereas the former is limited to packets
  1661.                             from Calico-controlled endpoints."
  1662.                           type: string
  1663.                         serviceAccounts:
  1664.                           description: ServiceAccounts is an optional field that restricts
  1665.                             the rule to only apply to traffic that originates from
  1666.                             (or terminates at) a pod running as a matching service
  1667.                             account.
  1668.                           properties:
  1669.                             names:
  1670.                               description: Names is an optional field that restricts
  1671.                                 the rule to only apply to traffic that originates
  1672.                                 from (or terminates at) a pod running as a service
  1673.                                 account whose name is in the list.
  1674.                               items:
  1675.                                 type: string
  1676.                               type: array
  1677.                             selector:
  1678.                               description: Selector is an optional field that restricts
  1679.                                 the rule to only apply to traffic that originates
  1680.                                 from (or terminates at) a pod running as a service
  1681.                                 account that matches the given label selector. If
  1682.                                 both Names and Selector are specified then they are
  1683.                                 AND'ed.
  1684.                               type: string
  1685.                           type: object
  1686.                       type: object
  1687.                   required:
  1688.                   - action
  1689.                   type: object
  1690.                 type: array
  1691.               namespaceSelector:
  1692.                 description: NamespaceSelector is an optional field for an expression
  1693.                   used to select a pod based on namespaces.
  1694.                 type: string
  1695.               order:
  1696.                 description: Order is an optional field that specifies the order in
  1697.                   which the policy is applied. Policies with higher "order" are applied
  1698.                   after those with lower order.  If the order is omitted, it may be
  1699.                   considered to be "infinite" - i.e. the policy will be applied last.  Policies
  1700.                   with identical order will be applied in alphanumerical order based
  1701.                   on the Policy "Name".
  1702.                 type: number
  1703.               preDNAT:
  1704.                 description: PreDNAT indicates to apply the rules in this policy before
  1705.                   any DNAT.
  1706.                 type: boolean
  1707.               selector:
  1708.                 description: "The selector is an expression used to pick pick out
  1709.                   the endpoints that the policy should be applied to. \n Selector
  1710.                   expressions follow this syntax: \n \tlabel == \"string_literal\"
  1711.                   \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
  1712.                   \  ->  not equal; also matches if label is not present \tlabel in
  1713.                   { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
  1714.                   one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
  1715.                   ... }  ->  true if the value of label X is not one of \"a\", \"b\",
  1716.                   \"c\" \thas(label_name)  -> True if that label is present \t! expr
  1717.                   -> negation of expr \texpr && expr  -> Short-circuit and \texpr
  1718.                   || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
  1719.                   or the empty selector -> matches all endpoints. \n Label names are
  1720.                   allowed to contain alphanumerics, -, _ and /. String literals are
  1721.                   more permissive but they do not support escape characters. \n Examples
  1722.                   (with made-up labels): \n \ttype == \"webserver\" && deployment
  1723.                   == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
  1724.                   \"dev\" \t! has(label_name)"
  1725.                 type: string
  1726.               serviceAccountSelector:
  1727.                 description: ServiceAccountSelector is an optional field for an expression
  1728.                   used to select a pod based on service accounts.
  1729.                 type: string
  1730.               types:
  1731.                 description: "Types indicates whether this policy applies to ingress,
  1732.                   or to egress, or to both.  When not explicitly specified (and so
  1733.                   the value on creation is empty or nil), Calico defaults Types according
  1734.                   to what Ingress and Egress rules are present in the policy.  The
  1735.                   default is: \n - [ PolicyTypeIngress ], if there are no Egress rules
  1736.                   (including the case where there are   also no Ingress rules) \n
  1737.                   - [ PolicyTypeEgress ], if there are Egress rules but no Ingress
  1738.                   rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are
  1739.                   both Ingress and Egress rules. \n When the policy is read back again,
  1740.                   Types will always be one of these values, never empty or nil."
  1741.                 items:
  1742.                   description: PolicyType enumerates the possible values of the PolicySpec
  1743.                     Types field.
  1744.                   type: string
  1745.                 type: array
  1746.             type: object
  1747.         type: object
  1748.     served: true
  1749.     storage: true
  1750. status:
  1751.   acceptedNames:
  1752.     kind: ""
  1753.     plural: ""
  1754.   conditions: []
  1755.   storedVersions: []
  1756.  
  1757. ---
  1758. apiVersion: apiextensions.k8s.io/v1
  1759. kind: CustomResourceDefinition
  1760. metadata:
  1761.   name: globalnetworksets.crd.projectcalico.org
  1762. spec:
  1763.   group: crd.projectcalico.org
  1764.   names:
  1765.     kind: GlobalNetworkSet
  1766.     listKind: GlobalNetworkSetList
  1767.     plural: globalnetworksets
  1768.     singular: globalnetworkset
  1769.   scope: Cluster
  1770.   versions:
  1771.   - name: v1
  1772.     schema:
  1773.       openAPIV3Schema:
  1774.         description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
  1775.           that share labels to allow rules to refer to them via selectors.  The labels
  1776.           of GlobalNetworkSet are not namespaced.
  1777.         properties:
  1778.           apiVersion:
  1779.             description: 'APIVersion defines the versioned schema of this representation
  1780.               of an object. Servers should convert recognized schemas to the latest
  1781.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1782.             type: string
  1783.           kind:
  1784.             description: 'Kind is a string value representing the REST resource this
  1785.               object represents. Servers may infer this from the endpoint the client
  1786.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1787.             type: string
  1788.           metadata:
  1789.             type: object
  1790.           spec:
  1791.             description: GlobalNetworkSetSpec contains the specification for a NetworkSet
  1792.               resource.
  1793.             properties:
  1794.               nets:
  1795.                 description: The list of IP networks that belong to this set.
  1796.                 items:
  1797.                   type: string
  1798.                 type: array
  1799.             type: object
  1800.         type: object
  1801.     served: true
  1802.     storage: true
  1803. status:
  1804.   acceptedNames:
  1805.     kind: ""
  1806.     plural: ""
  1807.   conditions: []
  1808.   storedVersions: []
  1809.  
  1810. ---
  1811. apiVersion: apiextensions.k8s.io/v1
  1812. kind: CustomResourceDefinition
  1813. metadata:
  1814.   name: hostendpoints.crd.projectcalico.org
  1815. spec:
  1816.   group: crd.projectcalico.org
  1817.   names:
  1818.     kind: HostEndpoint
  1819.     listKind: HostEndpointList
  1820.     plural: hostendpoints
  1821.     singular: hostendpoint
  1822.   scope: Cluster
  1823.   versions:
  1824.   - name: v1
  1825.     schema:
  1826.       openAPIV3Schema:
  1827.         properties:
  1828.           apiVersion:
  1829.             description: 'APIVersion defines the versioned schema of this representation
  1830.               of an object. Servers should convert recognized schemas to the latest
  1831.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1832.             type: string
  1833.           kind:
  1834.             description: 'Kind is a string value representing the REST resource this
  1835.               object represents. Servers may infer this from the endpoint the client
  1836.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1837.             type: string
  1838.           metadata:
  1839.             type: object
  1840.           spec:
  1841.             description: HostEndpointSpec contains the specification for a HostEndpoint
  1842.               resource.
  1843.             properties:
  1844.               expectedIPs:
  1845.                 description: "The expected IP addresses (IPv4 and IPv6) of the endpoint.
  1846.                   If \"InterfaceName\" is not present, Calico will look for an interface
  1847.                   matching any of the IPs in the list and apply policy to that. Note:
  1848.                   \tWhen using the selector match criteria in an ingress or egress
  1849.                   security Policy \tor Profile, Calico converts the selector into
  1850.                   a set of IP addresses. For host \tendpoints, the ExpectedIPs field
  1851.                   is used for that purpose. (If only the interface \tname is specified,
  1852.                   Calico does not learn the IPs of the interface for use in match
  1853.                   \tcriteria.)"
  1854.                 items:
  1855.                   type: string
  1856.                 type: array
  1857.               interfaceName:
  1858.                 description: "Either \"*\", or the name of a specific Linux interface
  1859.                   to apply policy to; or empty.  \"*\" indicates that this HostEndpoint
  1860.                   governs all traffic to, from or through the default network namespace
  1861.                   of the host named by the \"Node\" field; entering and leaving that
  1862.                   namespace via any interface, including those from/to non-host-networked
  1863.                   local workloads. \n If InterfaceName is not \"*\", this HostEndpoint
  1864.                   only governs traffic that enters or leaves the host through the
  1865.                   specific interface named by InterfaceName, or - when InterfaceName
  1866.                   is empty - through the specific interface that has one of the IPs
  1867.                   in ExpectedIPs. Therefore, when InterfaceName is empty, at least
  1868.                   one expected IP must be specified.  Only external interfaces (such
  1869.                   as \"eth0\") are supported here; it isn't possible for a HostEndpoint
  1870.                   to protect traffic through a specific local workload interface.
  1871.                   \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
  1872.                   initially just pre-DNAT policy.  Please check Calico documentation
  1873.                   for the latest position."
  1874.                 type: string
  1875.               node:
  1876.                 description: The node name identifying the Calico node instance.
  1877.                 type: string
  1878.               ports:
  1879.                 description: Ports contains the endpoint's named ports, which may
  1880.                   be referenced in security policy rules.
  1881.                 items:
  1882.                   properties:
  1883.                     name:
  1884.                       type: string
  1885.                     port:
  1886.                       type: integer
  1887.                     protocol:
  1888.                       anyOf:
  1889.                       - type: integer
  1890.                       - type: string
  1891.                       pattern: ^.*
  1892.                       x-kubernetes-int-or-string: true
  1893.                   required:
  1894.                   - name
  1895.                   - port
  1896.                   - protocol
  1897.                   type: object
  1898.                 type: array
  1899.               profiles:
  1900.                 description: A list of identifiers of security Profile objects that
  1901.                   apply to this endpoint. Each profile is applied in the order that
  1902.                   they appear in this list.  Profile rules are applied after the selector-based
  1903.                   security policy.
  1904.                 items:
  1905.                   type: string
  1906.                 type: array
  1907.             type: object
  1908.         type: object
  1909.     served: true
  1910.     storage: true
  1911. status:
  1912.   acceptedNames:
  1913.     kind: ""
  1914.     plural: ""
  1915.   conditions: []
  1916.   storedVersions: []
  1918. ---
  1919. apiVersion: apiextensions.k8s.io/v1
  1920. kind: CustomResourceDefinition
  1921. metadata:
  1922.   name: ipamblocks.crd.projectcalico.org
  1923. spec:
  1924.   group: crd.projectcalico.org
  1925.   names:
  1926.     kind: IPAMBlock
  1927.     listKind: IPAMBlockList
  1928.     plural: ipamblocks
  1929.     singular: ipamblock
  1930.   scope: Cluster
  1931.   versions:
  1932.   - name: v1
  1933.     schema:
  1934.       openAPIV3Schema:
  1935.         properties:
  1936.           apiVersion:
  1937.             description: 'APIVersion defines the versioned schema of this representation
  1938.               of an object. Servers should convert recognized schemas to the latest
  1939.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1940.             type: string
  1941.           kind:
  1942.             description: 'Kind is a string value representing the REST resource this
  1943.               object represents. Servers may infer this from the endpoint the client
  1944.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1945.             type: string
  1946.           metadata:
  1947.             type: object
  1948.           spec:
  1949.             description: IPAMBlockSpec contains the specification for an IPAMBlock
  1950.               resource.
  1951.             properties:
  1952.               affinity:
  1953.                 type: string
  1954.               allocations:
  1955.                 items:
  1956.                   type: integer
  1957.                   # TODO: This nullable is manually added in. We should update controller-gen
  1958.                   # to handle []*int properly itself.
  1959.                   nullable: true
  1960.                 type: array
  1961.               attributes:
  1962.                 items:
  1963.                   properties:
  1964.                     handle_id:
  1965.                       type: string
  1966.                     secondary:
  1967.                       additionalProperties:
  1968.                         type: string
  1969.                       type: object
  1970.                   type: object
  1971.                 type: array
  1972.               cidr:
  1973.                 type: string
  1974.               deleted:
  1975.                 type: boolean
  1976.               strictAffinity:
  1977.                 type: boolean
  1978.               unallocated:
  1979.                 items:
  1980.                   type: integer
  1981.                 type: array
  1982.             required:
  1983.             - allocations
  1984.             - attributes
  1985.             - cidr
  1986.             - strictAffinity
  1987.             - unallocated
  1988.             type: object
  1989.         type: object
  1990.     served: true
  1991.     storage: true
  1992. status:
  1993.   acceptedNames:
  1994.     kind: ""
  1995.     plural: ""
  1996.   conditions: []
  1997.   storedVersions: []
  1999. ---
  2000. apiVersion: apiextensions.k8s.io/v1
  2001. kind: CustomResourceDefinition
  2002. metadata:
  2003.   name: ipamconfigs.crd.projectcalico.org
  2004. spec:
  2005.   group: crd.projectcalico.org
  2006.   names:
  2007.     kind: IPAMConfig
  2008.     listKind: IPAMConfigList
  2009.     plural: ipamconfigs
  2010.     singular: ipamconfig
  2011.   scope: Cluster
  2012.   versions:
  2013.   - name: v1
  2014.     schema:
  2015.       openAPIV3Schema:
  2016.         properties:
  2017.           apiVersion:
  2018.             description: 'APIVersion defines the versioned schema of this representation
  2019.               of an object. Servers should convert recognized schemas to the latest
  2020.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2021.             type: string
  2022.           kind:
  2023.             description: 'Kind is a string value representing the REST resource this
  2024.               object represents. Servers may infer this from the endpoint the client
  2025.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2026.             type: string
  2027.           metadata:
  2028.             type: object
  2029.           spec:
  2030.             description: IPAMConfigSpec contains the specification for an IPAMConfig
  2031.               resource.
  2032.             properties:
  2033.               autoAllocateBlocks:
  2034.                 type: boolean
  2035.               maxBlocksPerHost:
  2036.                 description: MaxBlocksPerHost, if non-zero, is the max number of blocks
  2037.                   that can be affine to each host.
  2038.                 type: integer
  2039.               strictAffinity:
  2040.                 type: boolean
  2041.             required:
  2042.             - autoAllocateBlocks
  2043.             - strictAffinity
  2044.             type: object
  2045.         type: object
  2046.     served: true
  2047.     storage: true
  2048. status:
  2049.   acceptedNames:
  2050.     kind: ""
  2051.     plural: ""
  2052.   conditions: []
  2053.   storedVersions: []
  2055. ---
  2056. apiVersion: apiextensions.k8s.io/v1
  2057. kind: CustomResourceDefinition
  2058. metadata:
  2059.   name: ipamhandles.crd.projectcalico.org
  2060. spec:
  2061.   group: crd.projectcalico.org
  2062.   names:
  2063.     kind: IPAMHandle
  2064.     listKind: IPAMHandleList
  2065.     plural: ipamhandles
  2066.     singular: ipamhandle
  2067.   scope: Cluster
  2068.   versions:
  2069.   - name: v1
  2070.     schema:
  2071.       openAPIV3Schema:
  2072.         properties:
  2073.           apiVersion:
  2074.             description: 'APIVersion defines the versioned schema of this representation
  2075.               of an object. Servers should convert recognized schemas to the latest
  2076.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2077.             type: string
  2078.           kind:
  2079.             description: 'Kind is a string value representing the REST resource this
  2080.               object represents. Servers may infer this from the endpoint the client
  2081.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2082.             type: string
  2083.           metadata:
  2084.             type: object
  2085.           spec:
  2086.             description: IPAMHandleSpec contains the specification for an IPAMHandle
  2087.               resource.
  2088.             properties:
  2089.               block:
  2090.                 additionalProperties:
  2091.                   type: integer
  2092.                 type: object
  2093.               deleted:
  2094.                 type: boolean
  2095.               handleID:
  2096.                 type: string
  2097.             required:
  2098.             - block
  2099.             - handleID
  2100.             type: object
  2101.         type: object
  2102.     served: true
  2103.     storage: true
  2104. status:
  2105.   acceptedNames:
  2106.     kind: ""
  2107.     plural: ""
  2108.   conditions: []
  2109.   storedVersions: []
  2111. ---
  2112. apiVersion: apiextensions.k8s.io/v1
  2113. kind: CustomResourceDefinition
  2114. metadata:
  2115.   name: ippools.crd.projectcalico.org
  2116. spec:
  2117.   group: crd.projectcalico.org
  2118.   names:
  2119.     kind: IPPool
  2120.     listKind: IPPoolList
  2121.     plural: ippools
  2122.     singular: ippool
  2123.   scope: Cluster
  2124.   versions:
  2125.   - name: v1
  2126.     schema:
  2127.       openAPIV3Schema:
  2128.         properties:
  2129.           apiVersion:
  2130.             description: 'APIVersion defines the versioned schema of this representation
  2131.               of an object. Servers should convert recognized schemas to the latest
  2132.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2133.             type: string
  2134.           kind:
  2135.             description: 'Kind is a string value representing the REST resource this
  2136.               object represents. Servers may infer this from the endpoint the client
  2137.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2138.             type: string
  2139.           metadata:
  2140.             type: object
  2141.           spec:
  2142.             description: IPPoolSpec contains the specification for an IPPool resource.
  2143.             properties:
  2144.               blockSize:
  2145.                 description: The block size to use for IP address assignments from
  2146.                   this pool. Defaults to 26 for IPv4 and 112 for IPv6.
  2147.                 type: integer
  2148.               cidr:
  2149.                 description: The pool CIDR.
  2150.                 type: string
  2151.               disabled:
  2152.                 description: When disabled is true, Calico IPAM will not assign addresses
  2153.                   from this pool.
  2154.                 type: boolean
  2155.               ipip:
  2156.                 description: 'Deprecated: this field is only used for APIv1 backwards
  2157.                   compatibility. Setting this field is not allowed, this field is
  2158.                   for internal use only.'
  2159.                 properties:
  2160.                   enabled:
  2161.                     description: When enabled is true, ipip tunneling will be used
  2162.                       to deliver packets to destinations within this pool.
  2163.                     type: boolean
  2164.                   mode:
  2165.                     description: The IPIP mode.  This can be one of "always" or "cross-subnet".  A
  2166.                       mode of "always" will also use IPIP tunneling for routing to
  2167.                       destination IP addresses within this pool.  A mode of "cross-subnet"
  2168.                       will only use IPIP tunneling when the destination node is on
  2169.                       a different subnet to the originating node.  The default value
  2170.                       (if not specified) is "always".
  2171.                     type: string
  2172.                 type: object
  2173.               ipipMode:
  2174.                 description: Contains configuration for IPIP tunneling for this pool.
  2175.                   If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling
  2176.                   is disabled).
  2177.                 type: string
  2178.               nat-outgoing:
  2179.                 description: 'Deprecated: this field is only used for APIv1 backwards
  2180.                   compatibility. Setting this field is not allowed, this field is
  2181.                   for internal use only.'
  2182.                 type: boolean
  2183.               natOutgoing:
  2184.                 description: When nat-outgoing is true, packets sent from Calico networked
  2185.                   containers in this pool to destinations outside of this pool will
  2186.                   be masqueraded.
  2187.                 type: boolean
  2188.               nodeSelector:
  2189.                 description: Allows IPPool to allocate for a specific node by label
  2190.                   selector.
  2191.                 type: string
  2192.               vxlanMode:
  2193.                 description: Contains configuration for VXLAN tunneling for this pool.
  2194.                   If not specified, then this is defaulted to "Never" (i.e. VXLAN
  2195.                   tunneling is disabled).
  2196.                 type: string
  2197.             required:
  2198.             - cidr
  2199.             type: object
  2200.         type: object
  2201.     served: true
  2202.     storage: true
  2203. status:
  2204.   acceptedNames:
  2205.     kind: ""
  2206.     plural: ""
  2207.   conditions: []
  2208.   storedVersions: []
  2210. ---
  2211. apiVersion: apiextensions.k8s.io/v1
  2212. kind: CustomResourceDefinition
  2213. metadata:
  2214.   name: kubecontrollersconfigurations.crd.projectcalico.org
  2215. spec:
  2216.   group: crd.projectcalico.org
  2217.   names:
  2218.     kind: KubeControllersConfiguration
  2219.     listKind: KubeControllersConfigurationList
  2220.     plural: kubecontrollersconfigurations
  2221.     singular: kubecontrollersconfiguration
  2222.   scope: Cluster
  2223.   versions:
  2224.   - name: v1
  2225.     schema:
  2226.       openAPIV3Schema:
  2227.         properties:
  2228.           apiVersion:
  2229.             description: 'APIVersion defines the versioned schema of this representation
  2230.               of an object. Servers should convert recognized schemas to the latest
  2231.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2232.             type: string
  2233.           kind:
  2234.             description: 'Kind is a string value representing the REST resource this
  2235.               object represents. Servers may infer this from the endpoint the client
  2236.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2237.             type: string
  2238.           metadata:
  2239.             type: object
  2240.           spec:
  2241.             description: KubeControllersConfigurationSpec contains the values of the
  2242.               Kubernetes controllers configuration.
  2243.             properties:
  2244.               controllers:
  2245.                 description: Controllers enables and configures individual Kubernetes
  2246.                   controllers
  2247.                 properties:
  2248.                   namespace:
  2249.                     description: Namespace enables and configures the namespace controller.
  2250.                       Enabled by default, set to nil to disable.
  2251.                     properties:
  2252.                       reconcilerPeriod:
  2253.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2254.                           with the Calico datastore. [Default: 5m]'
  2255.                         type: string
  2256.                     type: object
  2257.                   node:
  2258.                     description: Node enables and configures the node controller.
  2259.                       Enabled by default, set to nil to disable.
  2260.                     properties:
  2261.                       hostEndpoint:
  2262.                         description: HostEndpoint controls syncing nodes to host endpoints.
  2263.                           Disabled by default, set to nil to disable.
  2264.                         properties:
  2265.                           autoCreate:
  2266.                             description: 'AutoCreate enables automatic creation of
  2267.                               host endpoints for every node. [Default: Disabled]'
  2268.                             type: string
  2269.                         type: object
  2270.                       reconcilerPeriod:
  2271.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2272.                           with the Calico datastore. [Default: 5m]'
  2273.                         type: string
  2274.                       syncLabels:
  2275.                         description: 'SyncLabels controls whether to copy Kubernetes
  2276.                           node labels to Calico nodes. [Default: Enabled]'
  2277.                         type: string
  2278.                     type: object
  2279.                   policy:
  2280.                     description: Policy enables and configures the policy controller.
  2281.                       Enabled by default, set to nil to disable.
  2282.                     properties:
  2283.                       reconcilerPeriod:
  2284.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2285.                           with the Calico datastore. [Default: 5m]'
  2286.                         type: string
  2287.                     type: object
  2288.                   serviceAccount:
  2289.                     description: ServiceAccount enables and configures the service
  2290.                       account controller. Enabled by default, set to nil to disable.
  2291.                     properties:
  2292.                       reconcilerPeriod:
  2293.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2294.                           with the Calico datastore. [Default: 5m]'
  2295.                         type: string
  2296.                     type: object
  2297.                   workloadEndpoint:
  2298.                     description: WorkloadEndpoint enables and configures the workload
  2299.                       endpoint controller. Enabled by default, set to nil to disable.
  2300.                     properties:
  2301.                       reconcilerPeriod:
  2302.                         description: 'ReconcilerPeriod is the period to perform reconciliation
  2303.                           with the Calico datastore. [Default: 5m]'
  2304.                         type: string
  2305.                     type: object
  2306.                 type: object
  2307.               etcdV3CompactionPeriod:
  2308.                 description: 'EtcdV3CompactionPeriod is the period between etcdv3
  2309.                   compaction requests. Set to 0 to disable. [Default: 10m]'
  2310.                 type: string
  2311.               healthChecks:
  2312.                 description: 'HealthChecks enables or disables support for health
  2313.                   checks [Default: Enabled]'
  2314.                 type: string
  2315.               logSeverityScreen:
  2316.                 description: 'LogSeverityScreen is the log severity above which logs
  2317.                   are sent to the stdout. [Default: Info]'
  2318.                 type: string
  2319.               prometheusMetricsPort:
  2320.                 description: 'PrometheusMetricsPort is the TCP port that the Prometheus
  2321.                   metrics server should bind to. Set to 0 to disable. [Default: 9094]'
  2322.                 type: integer
  2323.             required:
  2324.             - controllers
  2325.             type: object
  2326.           status:
  2327.             description: KubeControllersConfigurationStatus represents the status
  2328.               of the configuration. It's useful for admins to be able to see the actual
  2329.               config that was applied, which can be modified by environment variables
  2330.               on the kube-controllers process.
  2331.             properties:
  2332.               environmentVars:
  2333.                 additionalProperties:
  2334.                   type: string
  2335.                 description: EnvironmentVars contains the environment variables on
  2336.                   the kube-controllers that influenced the RunningConfig.
  2337.                 type: object
  2338.               runningConfig:
  2339.                 description: RunningConfig contains the effective config that is running
  2340.                   in the kube-controllers pod, after merging the API resource with
  2341.                   any environment variables.
  2342.                 properties:
  2343.                   controllers:
  2344.                     description: Controllers enables and configures individual Kubernetes
  2345.                       controllers
  2346.                     properties:
  2347.                       namespace:
  2348.                         description: Namespace enables and configures the namespace
  2349.                           controller. Enabled by default, set to nil to disable.
  2350.                         properties:
  2351.                           reconcilerPeriod:
  2352.                             description: 'ReconcilerPeriod is the period to perform
  2353.                               reconciliation with the Calico datastore. [Default:
  2354.                               5m]'
  2355.                             type: string
  2356.                         type: object
  2357.                       node:
  2358.                         description: Node enables and configures the node controller.
  2359.                           Enabled by default, set to nil to disable.
  2360.                         properties:
  2361.                           hostEndpoint:
  2362.                             description: HostEndpoint controls syncing nodes to host
  2363.                               endpoints. Disabled by default, set to nil to disable.
  2364.                             properties:
  2365.                               autoCreate:
  2366.                                 description: 'AutoCreate enables automatic creation
  2367.                                   of host endpoints for every node. [Default: Disabled]'
  2368.                                 type: string
  2369.                             type: object
  2370.                           reconcilerPeriod:
  2371.                             description: 'ReconcilerPeriod is the period to perform
  2372.                               reconciliation with the Calico datastore. [Default:
  2373.                               5m]'
  2374.                             type: string
  2375.                           syncLabels:
  2376.                             description: 'SyncLabels controls whether to copy Kubernetes
  2377.                               node labels to Calico nodes. [Default: Enabled]'
  2378.                             type: string
  2379.                         type: object
  2380.                       policy:
  2381.                         description: Policy enables and configures the policy controller.
  2382.                           Enabled by default, set to nil to disable.
  2383.                         properties:
  2384.                           reconcilerPeriod:
  2385.                             description: 'ReconcilerPeriod is the period to perform
  2386.                               reconciliation with the Calico datastore. [Default:
  2387.                               5m]'
  2388.                             type: string
  2389.                         type: object
  2390.                       serviceAccount:
  2391.                         description: ServiceAccount enables and configures the service
  2392.                           account controller. Enabled by default, set to nil to disable.
  2393.                         properties:
  2394.                           reconcilerPeriod:
  2395.                             description: 'ReconcilerPeriod is the period to perform
  2396.                               reconciliation with the Calico datastore. [Default:
  2397.                               5m]'
  2398.                             type: string
  2399.                         type: object
  2400.                       workloadEndpoint:
  2401.                         description: WorkloadEndpoint enables and configures the workload
  2402.                           endpoint controller. Enabled by default, set to nil to disable.
  2403.                         properties:
  2404.                           reconcilerPeriod:
  2405.                             description: 'ReconcilerPeriod is the period to perform
  2406.                               reconciliation with the Calico datastore. [Default:
  2407.                               5m]'
  2408.                             type: string
  2409.                         type: object
  2410.                     type: object
  2411.                   etcdV3CompactionPeriod:
  2412.                     description: 'EtcdV3CompactionPeriod is the period between etcdv3
  2413.                       compaction requests. Set to 0 to disable. [Default: 10m]'
  2414.                     type: string
  2415.                   healthChecks:
  2416.                     description: 'HealthChecks enables or disables support for health
  2417.                       checks [Default: Enabled]'
  2418.                     type: string
  2419.                   logSeverityScreen:
  2420.                     description: 'LogSeverityScreen is the log severity above which
  2421.                       logs are sent to the stdout. [Default: Info]'
  2422.                     type: string
  2423.                   prometheusMetricsPort:
  2424.                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
  2425.                       metrics server should bind to. Set to 0 to disable. [Default:
  2426.                       9094]'
  2427.                     type: integer
  2428.                 required:
  2429.                 - controllers
  2430.                 type: object
  2431.             type: object
  2432.         type: object
  2433.     served: true
  2434.     storage: true
  2435. status:
  2436.   acceptedNames:
  2437.     kind: ""
  2438.     plural: ""
  2439.   conditions: []
  2440.   storedVersions: []
  2441.  
  2442. ---
  2443. apiVersion: apiextensions.k8s.io/v1
  2444. kind: CustomResourceDefinition
  2445. metadata:
  2446.   name: networkpolicies.crd.projectcalico.org
  2447. spec:
  2448.   group: crd.projectcalico.org
  2449.   names:
  2450.     kind: NetworkPolicy
  2451.     listKind: NetworkPolicyList
  2452.     plural: networkpolicies
  2453.     singular: networkpolicy
  2454.   scope: Namespaced
  2455.   versions:
  2456.   - name: v1
  2457.     schema:
  2458.       openAPIV3Schema:
  2459.         properties:
  2460.           apiVersion:
  2461.             description: 'APIVersion defines the versioned schema of this representation
  2462.               of an object. Servers should convert recognized schemas to the latest
  2463.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2464.             type: string
  2465.           kind:
  2466.             description: 'Kind is a string value representing the REST resource this
  2467.               object represents. Servers may infer this from the endpoint the client
  2468.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2469.             type: string
  2470.           metadata:
  2471.             type: object
  2472.           spec:
  2473.             properties:
  2474.               egress:
  2475.                 description: The ordered set of egress rules.  Each rule contains
  2476.                   a set of packet match criteria and a corresponding action to apply.
  2477.                 items:
  2478.                   description: "A Rule encapsulates a set of match criteria and an
  2479.                     action.  Both selector-based security Policy and security Profiles
  2480.                     reference rules - separated out as a list of rules for both ingress
  2481.                     and egress packet matching. \n Each positive match criteria has
  2482.                     a negated version, prefixed with \"Not\". All the match criteria
  2483.                     within a rule must be satisfied for a packet to match. A single
  2484.                     rule can contain the positive and negative version of a match
  2485.                     and both must be satisfied for the rule to match."
  2486.                   properties:
  2487.                     action:
  2488.                       type: string
  2489.                     destination:
  2490.                       description: Destination contains the match criteria that apply
  2491.                         to destination entity.
  2492.                       properties:
  2493.                         namespaceSelector:
  2494.                           description: "NamespaceSelector is an optional field that
  2495.                             contains a selector expression. Only traffic that originates
  2496.                             from (or terminates at) endpoints within the selected
  2497.                             namespaces will be matched. When both NamespaceSelector
  2498.                             and Selector are defined on the same rule, then only workload
  2499.                             endpoints that are matched by both selectors will be selected
  2500.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  2501.                             implies that the Selector is limited to selecting only
  2502.                             workload endpoints in the same namespace as the NetworkPolicy.
  2503.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  2504.                             that the Selector is limited to selecting only GlobalNetworkSet
  2505.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  2506.                             NamespaceSelector implies the Selector applies to workload
  2507.                             endpoints across all namespaces."
  2508.                           type: string
  2509.                         nets:
  2510.                           description: Nets is an optional field that restricts the
  2511.                             rule to only apply to traffic that originates from (or
  2512.                             terminates at) IP addresses in any of the given subnets.
  2513.                           items:
  2514.                             type: string
  2515.                           type: array
  2516.                         notNets:
  2517.                           description: NotNets is the negated version of the Nets
  2518.                             field.
  2519.                           items:
  2520.                             type: string
  2521.                           type: array
  2522.                         notPorts:
  2523.                           description: NotPorts is the negated version of the Ports
  2524.                             field. Since only some protocols have ports, if any ports
  2525.                             are specified it requires the Protocol match in the Rule
  2526.                             to be set to "TCP" or "UDP".
  2527.                           items:
  2528.                             anyOf:
  2529.                             - type: integer
  2530.                             - type: string
  2531.                             pattern: ^.*
  2532.                             x-kubernetes-int-or-string: true
  2533.                           type: array
  2534.                         notSelector:
  2535.                           description: NotSelector is the negated version of the Selector
  2536.                             field.  See Selector field for subtleties with negated
  2537.                             selectors.
  2538.                           type: string
  2539.                         ports:
  2540.                           description: "Ports is an optional field that restricts
  2541.                             the rule to only apply to traffic that has a source (destination)
  2542.                             port that matches one of these ranges/values. This value
  2543.                             is a list of integers or strings that represent ranges
  2544.                             of ports. \n Since only some protocols have ports, if
  2545.                             any ports are specified it requires the Protocol match
  2546.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  2547.                           items:
  2548.                             anyOf:
  2549.                             - type: integer
  2550.                             - type: string
  2551.                             pattern: ^.*
  2552.                             x-kubernetes-int-or-string: true
  2553.                           type: array
  2554.                         selector:
  2555.                           description: "Selector is an optional field that contains
  2556.                             a selector expression (see Policy for sample syntax).
  2557.                             \ Only traffic that originates from (terminates at) endpoints
  2558.                             matching the selector will be matched. \n Note that: in
  2559.                             addition to the negated version of the Selector (see NotSelector
  2560.                             below), the selector expression syntax itself supports
  2561.                             negation.  The two types of negation are subtly different.
  2562.                             One negates the set of matched endpoints, the other negates
  2563.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  2564.                             packets that are from other Calico-controlled \tendpoints
  2565.                             that do not have the label \"my_label\". \n \tNotSelector
  2566.                             = \"has(my_label)\" matches packets that are not from
  2567.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  2568.                             \n The effect is that the latter will accept packets from
  2569.                             non-Calico sources whereas the former is limited to packets
  2570.                             from Calico-controlled endpoints."
  2571.                           type: string
  2572.                         serviceAccounts:
  2573.                           description: ServiceAccounts is an optional field that restricts
  2574.                             the rule to only apply to traffic that originates from
  2575.                             (or terminates at) a pod running as a matching service
  2576.                             account.
  2577.                           properties:
  2578.                             names:
  2579.                               description: Names is an optional field that restricts
  2580.                                 the rule to only apply to traffic that originates
  2581.                                 from (or terminates at) a pod running as a service
  2582.                                 account whose name is in the list.
  2583.                               items:
  2584.                                 type: string
  2585.                               type: array
  2586.                             selector:
  2587.                               description: Selector is an optional field that restricts
  2588.                                 the rule to only apply to traffic that originates
  2589.                                 from (or terminates at) a pod running as a service
  2590.                                 account that matches the given label selector. If
  2591.                                 both Names and Selector are specified then they are
  2592.                                 AND'ed.
  2593.                               type: string
  2594.                           type: object
  2595.                       type: object
  2596.                     http:
  2597.                       description: HTTP contains match criteria that apply to HTTP
  2598.                         requests.
  2599.                       properties:
  2600.                         methods:
  2601.                           description: Methods is an optional field that restricts
  2602.                             the rule to apply only to HTTP requests that use one of
  2603.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  2604.                             methods are OR'd together.
  2605.                           items:
  2606.                             type: string
  2607.                           type: array
  2608.                         paths:
  2609.                           description: 'Paths is an optional field that restricts
  2610.                             the rule to apply to HTTP requests that use one of the
  2611.                             listed HTTP Paths. Multiple paths are OR''d together.
  2612.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  2613.                             ONLY specify either a `exact` or a `prefix` match. The
  2614.                             validator will check for it.'
  2615.                           items:
  2616.                             description: 'HTTPPath specifies an HTTP path to match.
  2617.                               It may be either of the form: exact: <path>: which matches
  2618.                               the path exactly or prefix: <path-prefix>: which matches
  2619.                               the path prefix'
  2620.                             properties:
  2621.                               exact:
  2622.                                 type: string
  2623.                               prefix:
  2624.                                 type: string
  2625.                             type: object
  2626.                           type: array
  2627.                       type: object
  2628.                     icmp:
  2629.                       description: ICMP is an optional field that restricts the rule
  2630.                         to apply to a specific type and code of ICMP traffic.  This
  2631.                         should only be specified if the Protocol field is set to "ICMP"
  2632.                         or "ICMPv6".
  2633.                       properties:
  2634.                         code:
  2635.                           description: Match on a specific ICMP code.  If specified,
  2636.                             the Type value must also be specified. This is a technical
  2637.                             limitation imposed by the kernel's iptables firewall,
  2638.                             which Calico uses to enforce the rule.
  2639.                           type: integer
  2640.                         type:
  2641.                           description: Match on a specific ICMP type.  For example
  2642.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2643.                           type: integer
  2644.                       type: object
  2645.                     ipVersion:
  2646.                       description: IPVersion is an optional field that restricts the
  2647.                         rule to only match a specific IP version.
  2648.                       type: integer
  2649.                     metadata:
  2650.                       description: Metadata contains additional information for this
  2651.                         rule
  2652.                       properties:
  2653.                         annotations:
  2654.                           additionalProperties:
  2655.                             type: string
  2656.                           description: Annotations is a set of key value pairs that
  2657.                             give extra information about the rule
  2658.                           type: object
  2659.                       type: object
  2660.                     notICMP:
  2661.                       description: NotICMP is the negated version of the ICMP field.
  2662.                       properties:
  2663.                         code:
  2664.                           description: Match on a specific ICMP code.  If specified,
  2665.                             the Type value must also be specified. This is a technical
  2666.                             limitation imposed by the kernel's iptables firewall,
  2667.                             which Calico uses to enforce the rule.
  2668.                           type: integer
  2669.                         type:
  2670.                           description: Match on a specific ICMP type.  For example
  2671.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2672.                           type: integer
  2673.                       type: object
  2674.                     notProtocol:
  2675.                       anyOf:
  2676.                       - type: integer
  2677.                       - type: string
  2678.                       description: NotProtocol is the negated version of the Protocol
  2679.                         field.
  2680.                       pattern: ^.*
  2681.                       x-kubernetes-int-or-string: true
  2682.                     protocol:
  2683.                       anyOf:
  2684.                       - type: integer
  2685.                       - type: string
  2686.                       description: "Protocol is an optional field that restricts the
  2687.                         rule to only apply to traffic of a specific IP protocol. Required
  2688.                         if any of the EntityRules contain Ports (because ports only
  2689.                         apply to certain protocols). \n Must be one of these string
  2690.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  2691.                         \"UDPLite\" or an integer in the range 1-255."
  2692.                       pattern: ^.*
  2693.                       x-kubernetes-int-or-string: true
  2694.                     source:
  2695.                       description: Source contains the match criteria that apply to
  2696.                         source entity.
  2697.                       properties:
  2698.                         namespaceSelector:
  2699.                           description: "NamespaceSelector is an optional field that
  2700.                             contains a selector expression. Only traffic that originates
  2701.                             from (or terminates at) endpoints within the selected
  2702.                             namespaces will be matched. When both NamespaceSelector
  2703.                             and Selector are defined on the same rule, then only workload
  2704.                             endpoints that are matched by both selectors will be selected
  2705.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  2706.                             implies that the Selector is limited to selecting only
  2707.                             workload endpoints in the same namespace as the NetworkPolicy.
  2708.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  2709.                             that the Selector is limited to selecting only GlobalNetworkSet
  2710.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  2711.                             NamespaceSelector implies the Selector applies to workload
  2712.                             endpoints across all namespaces."
  2713.                           type: string
  2714.                         nets:
  2715.                           description: Nets is an optional field that restricts the
  2716.                             rule to only apply to traffic that originates from (or
  2717.                             terminates at) IP addresses in any of the given subnets.
  2718.                           items:
  2719.                             type: string
  2720.                           type: array
  2721.                         notNets:
  2722.                           description: NotNets is the negated version of the Nets
  2723.                             field.
  2724.                           items:
  2725.                             type: string
  2726.                           type: array
  2727.                         notPorts:
  2728.                           description: NotPorts is the negated version of the Ports
  2729.                             field. Since only some protocols have ports, if any ports
  2730.                             are specified it requires the Protocol match in the Rule
  2731.                             to be set to "TCP" or "UDP".
  2732.                           items:
  2733.                             anyOf:
  2734.                             - type: integer
  2735.                             - type: string
  2736.                             pattern: ^.*
  2737.                             x-kubernetes-int-or-string: true
  2738.                           type: array
  2739.                         notSelector:
  2740.                           description: NotSelector is the negated version of the Selector
  2741.                             field.  See Selector field for subtleties with negated
  2742.                             selectors.
  2743.                           type: string
  2744.                         ports:
  2745.                           description: "Ports is an optional field that restricts
  2746.                             the rule to only apply to traffic that has a source (destination)
  2747.                             port that matches one of these ranges/values. This value
  2748.                             is a list of integers or strings that represent ranges
  2749.                             of ports. \n Since only some protocols have ports, if
  2750.                             any ports are specified it requires the Protocol match
  2751.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  2752.                           items:
  2753.                             anyOf:
  2754.                             - type: integer
  2755.                             - type: string
  2756.                             pattern: ^.*
  2757.                             x-kubernetes-int-or-string: true
  2758.                           type: array
  2759.                         selector:
  2760.                           description: "Selector is an optional field that contains
  2761.                             a selector expression (see Policy for sample syntax).
  2762.                             \ Only traffic that originates from (terminates at) endpoints
  2763.                             matching the selector will be matched. \n Note that: in
  2764.                             addition to the negated version of the Selector (see NotSelector
  2765.                             below), the selector expression syntax itself supports
  2766.                             negation.  The two types of negation are subtly different.
  2767.                             One negates the set of matched endpoints, the other negates
  2768.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  2769.                             packets that are from other Calico-controlled \tendpoints
  2770.                             that do not have the label \"my_label\". \n \tNotSelector
  2771.                             = \"has(my_label)\" matches packets that are not from
  2772.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  2773.                             \n The effect is that the latter will accept packets from
  2774.                             non-Calico sources whereas the former is limited to packets
  2775.                             from Calico-controlled endpoints."
  2776.                           type: string
  2777.                         serviceAccounts:
  2778.                           description: ServiceAccounts is an optional field that restricts
  2779.                             the rule to only apply to traffic that originates from
  2780.                             (or terminates at) a pod running as a matching service
  2781.                             account.
  2782.                           properties:
  2783.                             names:
  2784.                               description: Names is an optional field that restricts
  2785.                                 the rule to only apply to traffic that originates
  2786.                                 from (or terminates at) a pod running as a service
  2787.                                 account whose name is in the list.
  2788.                               items:
  2789.                                 type: string
  2790.                               type: array
  2791.                             selector:
  2792.                               description: Selector is an optional field that restricts
  2793.                                 the rule to only apply to traffic that originates
  2794.                                 from (or terminates at) a pod running as a service
  2795.                                 account that matches the given label selector. If
  2796.                                 both Names and Selector are specified then they are
  2797.                                 AND'ed.
  2798.                               type: string
  2799.                           type: object
  2800.                       type: object
  2801.                   required:
  2802.                   - action
  2803.                   type: object
  2804.                 type: array
  2805.               ingress:
  2806.                 description: The ordered set of ingress rules.  Each rule contains
  2807.                   a set of packet match criteria and a corresponding action to apply.
  2808.                 items:
  2809.                   description: "A Rule encapsulates a set of match criteria and an
  2810.                     action.  Both selector-based security Policy and security Profiles
  2811.                     reference rules - separated out as a list of rules for both ingress
  2812.                     and egress packet matching. \n Each positive match criteria has
  2813.                     a negated version, prefixed with \"Not\". All the match criteria
  2814.                     within a rule must be satisfied for a packet to match. A single
  2815.                     rule can contain the positive and negative version of a match
  2816.                     and both must be satisfied for the rule to match."
  2817.                   properties:
  2818.                     action:
  2819.                       type: string
  2820.                     destination:
  2821.                       description: Destination contains the match criteria that apply
  2822.                         to destination entity.
  2823.                       properties:
  2824.                         namespaceSelector:
  2825.                           description: "NamespaceSelector is an optional field that
  2826.                             contains a selector expression. Only traffic that originates
  2827.                             from (or terminates at) endpoints within the selected
  2828.                             namespaces will be matched. When both NamespaceSelector
  2829.                             and Selector are defined on the same rule, then only workload
  2830.                             endpoints that are matched by both selectors will be selected
  2831.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  2832.                             implies that the Selector is limited to selecting only
  2833.                             workload endpoints in the same namespace as the NetworkPolicy.
  2834.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  2835.                             that the Selector is limited to selecting only GlobalNetworkSet
  2836.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  2837.                             NamespaceSelector implies the Selector applies to workload
  2838.                             endpoints across all namespaces."
  2839.                           type: string
  2840.                         nets:
  2841.                           description: Nets is an optional field that restricts the
  2842.                             rule to only apply to traffic that originates from (or
  2843.                             terminates at) IP addresses in any of the given subnets.
  2844.                           items:
  2845.                             type: string
  2846.                           type: array
  2847.                         notNets:
  2848.                           description: NotNets is the negated version of the Nets
  2849.                             field.
  2850.                           items:
  2851.                             type: string
  2852.                           type: array
  2853.                         notPorts:
  2854.                           description: NotPorts is the negated version of the Ports
  2855.                             field. Since only some protocols have ports, if any ports
  2856.                             are specified it requires the Protocol match in the Rule
  2857.                             to be set to "TCP" or "UDP".
  2858.                           items:
  2859.                             anyOf:
  2860.                             - type: integer
  2861.                             - type: string
  2862.                             pattern: ^.*
  2863.                             x-kubernetes-int-or-string: true
  2864.                           type: array
  2865.                         notSelector:
  2866.                           description: NotSelector is the negated version of the Selector
  2867.                             field.  See Selector field for subtleties with negated
  2868.                             selectors.
  2869.                           type: string
  2870.                         ports:
  2871.                           description: "Ports is an optional field that restricts
  2872.                             the rule to only apply to traffic that has a source (destination)
  2873.                             port that matches one of these ranges/values. This value
  2874.                             is a list of integers or strings that represent ranges
  2875.                             of ports. \n Since only some protocols have ports, if
  2876.                             any ports are specified it requires the Protocol match
  2877.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  2878.                           items:
  2879.                             anyOf:
  2880.                             - type: integer
  2881.                             - type: string
  2882.                             pattern: ^.*
  2883.                             x-kubernetes-int-or-string: true
  2884.                           type: array
  2885.                         selector:
  2886.                           description: "Selector is an optional field that contains
  2887.                             a selector expression (see Policy for sample syntax).
  2888.                             \ Only traffic that originates from (terminates at) endpoints
  2889.                             matching the selector will be matched. \n Note that: in
  2890.                             addition to the negated version of the Selector (see NotSelector
  2891.                             below), the selector expression syntax itself supports
  2892.                             negation.  The two types of negation are subtly different.
  2893.                             One negates the set of matched endpoints, the other negates
  2894.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  2895.                             packets that are from other Calico-controlled \tendpoints
  2896.                             that do not have the label \"my_label\". \n \tNotSelector
  2897.                             = \"has(my_label)\" matches packets that are not from
  2898.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  2899.                             \n The effect is that the latter will accept packets from
  2900.                             non-Calico sources whereas the former is limited to packets
  2901.                             from Calico-controlled endpoints."
  2902.                           type: string
  2903.                         serviceAccounts:
  2904.                           description: ServiceAccounts is an optional field that restricts
  2905.                             the rule to only apply to traffic that originates from
  2906.                             (or terminates at) a pod running as a matching service
  2907.                             account.
  2908.                           properties:
  2909.                             names:
  2910.                               description: Names is an optional field that restricts
  2911.                                 the rule to only apply to traffic that originates
  2912.                                 from (or terminates at) a pod running as a service
  2913.                                 account whose name is in the list.
  2914.                               items:
  2915.                                 type: string
  2916.                               type: array
  2917.                             selector:
  2918.                               description: Selector is an optional field that restricts
  2919.                                 the rule to only apply to traffic that originates
  2920.                                 from (or terminates at) a pod running as a service
  2921.                                 account that matches the given label selector. If
  2922.                                 both Names and Selector are specified then they are
  2923.                                 AND'ed.
  2924.                               type: string
  2925.                           type: object
  2926.                       type: object
  2927.                     http:
  2928.                       description: HTTP contains match criteria that apply to HTTP
  2929.                         requests.
  2930.                       properties:
  2931.                         methods:
  2932.                           description: Methods is an optional field that restricts
  2933.                             the rule to apply only to HTTP requests that use one of
  2934.                             the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
  2935.                             methods are OR'd together.
  2936.                           items:
  2937.                             type: string
  2938.                           type: array
  2939.                         paths:
  2940.                           description: 'Paths is an optional field that restricts
  2941.                             the rule to apply to HTTP requests that use one of the
  2942.                             listed HTTP Paths. Multiple paths are OR''d together.
  2943.                             e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
  2944.                             ONLY specify either a `exact` or a `prefix` match. The
  2945.                             validator will check for it.'
  2946.                           items:
  2947.                             description: 'HTTPPath specifies an HTTP path to match.
  2948.                               It may be either of the form: exact: <path>: which matches
  2949.                               the path exactly or prefix: <path-prefix>: which matches
  2950.                               the path prefix'
  2951.                             properties:
  2952.                               exact:
  2953.                                 type: string
  2954.                               prefix:
  2955.                                 type: string
  2956.                             type: object
  2957.                           type: array
  2958.                       type: object
  2959.                     icmp:
  2960.                       description: ICMP is an optional field that restricts the rule
  2961.                         to apply to a specific type and code of ICMP traffic.  This
  2962.                         should only be specified if the Protocol field is set to "ICMP"
  2963.                         or "ICMPv6".
  2964.                       properties:
  2965.                         code:
  2966.                           description: Match on a specific ICMP code.  If specified,
  2967.                             the Type value must also be specified. This is a technical
  2968.                             limitation imposed by the kernel's iptables firewall,
  2969.                             which Calico uses to enforce the rule.
  2970.                           type: integer
  2971.                         type:
  2972.                           description: Match on a specific ICMP type.  For example
  2973.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  2974.                           type: integer
  2975.                       type: object
  2976.                     ipVersion:
  2977.                       description: IPVersion is an optional field that restricts the
  2978.                         rule to only match a specific IP version.
  2979.                       type: integer
  2980.                     metadata:
  2981.                       description: Metadata contains additional information for this
  2982.                         rule
  2983.                       properties:
  2984.                         annotations:
  2985.                           additionalProperties:
  2986.                             type: string
  2987.                           description: Annotations is a set of key value pairs that
  2988.                             give extra information about the rule
  2989.                           type: object
  2990.                       type: object
  2991.                     notICMP:
  2992.                       description: NotICMP is the negated version of the ICMP field.
  2993.                       properties:
  2994.                         code:
  2995.                           description: Match on a specific ICMP code.  If specified,
  2996.                             the Type value must also be specified. This is a technical
  2997.                             limitation imposed by the kernel's iptables firewall,
  2998.                             which Calico uses to enforce the rule.
  2999.                           type: integer
  3000.                         type:
  3001.                           description: Match on a specific ICMP type.  For example
  3002.                             a value of 8 refers to ICMP Echo Request (i.e. pings).
  3003.                           type: integer
  3004.                       type: object
  3005.                     notProtocol:
  3006.                       anyOf:
  3007.                       - type: integer
  3008.                       - type: string
  3009.                       description: NotProtocol is the negated version of the Protocol
  3010.                         field.
  3011.                       pattern: ^.*
  3012.                       x-kubernetes-int-or-string: true
  3013.                     protocol:
  3014.                       anyOf:
  3015.                       - type: integer
  3016.                       - type: string
  3017.                       description: "Protocol is an optional field that restricts the
  3018.                         rule to only apply to traffic of a specific IP protocol. Required
  3019.                         if any of the EntityRules contain Ports (because ports only
  3020.                         apply to certain protocols). \n Must be one of these string
  3021.                         values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
  3022.                         \"UDPLite\" or an integer in the range 1-255."
  3023.                       pattern: ^.*
  3024.                       x-kubernetes-int-or-string: true
  3025.                     source:
  3026.                       description: Source contains the match criteria that apply to
  3027.                         source entity.
  3028.                       properties:
  3029.                         namespaceSelector:
  3030.                           description: "NamespaceSelector is an optional field that
  3031.                             contains a selector expression. Only traffic that originates
  3032.                             from (or terminates at) endpoints within the selected
  3033.                             namespaces will be matched. When both NamespaceSelector
  3034.                             and Selector are defined on the same rule, then only workload
  3035.                             endpoints that are matched by both selectors will be selected
  3036.                             by the rule. \n For NetworkPolicy, an empty NamespaceSelector
  3037.                             implies that the Selector is limited to selecting only
  3038.                             workload endpoints in the same namespace as the NetworkPolicy.
  3039.                             \n For NetworkPolicy, `global()` NamespaceSelector implies
  3040.                             that the Selector is limited to selecting only GlobalNetworkSet
  3041.                             or HostEndpoint. \n For GlobalNetworkPolicy, an empty
  3042.                             NamespaceSelector implies the Selector applies to workload
  3043.                             endpoints across all namespaces."
  3044.                           type: string
  3045.                         nets:
  3046.                           description: Nets is an optional field that restricts the
  3047.                             rule to only apply to traffic that originates from (or
  3048.                             terminates at) IP addresses in any of the given subnets.
  3049.                           items:
  3050.                             type: string
  3051.                           type: array
  3052.                         notNets:
  3053.                           description: NotNets is the negated version of the Nets
  3054.                             field.
  3055.                           items:
  3056.                             type: string
  3057.                           type: array
  3058.                         notPorts:
  3059.                           description: NotPorts is the negated version of the Ports
  3060.                             field. Since only some protocols have ports, if any ports
  3061.                             are specified it requires the Protocol match in the Rule
  3062.                             to be set to "TCP" or "UDP".
  3063.                           items:
  3064.                             anyOf:
  3065.                             - type: integer
  3066.                             - type: string
  3067.                             pattern: ^.*
  3068.                             x-kubernetes-int-or-string: true
  3069.                           type: array
  3070.                         notSelector:
  3071.                           description: NotSelector is the negated version of the Selector
  3072.                             field.  See Selector field for subtleties with negated
  3073.                             selectors.
  3074.                           type: string
  3075.                         ports:
  3076.                           description: "Ports is an optional field that restricts
  3077.                             the rule to only apply to traffic that has a source (destination)
  3078.                             port that matches one of these ranges/values. This value
  3079.                             is a list of integers or strings that represent ranges
  3080.                             of ports. \n Since only some protocols have ports, if
  3081.                             any ports are specified it requires the Protocol match
  3082.                             in the Rule to be set to \"TCP\" or \"UDP\"."
  3083.                           items:
  3084.                             anyOf:
  3085.                             - type: integer
  3086.                             - type: string
  3087.                             pattern: ^.*
  3088.                             x-kubernetes-int-or-string: true
  3089.                           type: array
  3090.                         selector:
  3091.                           description: "Selector is an optional field that contains
  3092.                             a selector expression (see Policy for sample syntax).
  3093.                             \ Only traffic that originates from (terminates at) endpoints
  3094.                             matching the selector will be matched. \n Note that: in
  3095.                             addition to the negated version of the Selector (see NotSelector
  3096.                             below), the selector expression syntax itself supports
  3097.                             negation.  The two types of negation are subtly different.
  3098.                             One negates the set of matched endpoints, the other negates
  3099.                             the whole match: \n \tSelector = \"!has(my_label)\" matches
  3100.                             packets that are from other Calico-controlled \tendpoints
  3101.                             that do not have the label \"my_label\". \n \tNotSelector
  3102.                             = \"has(my_label)\" matches packets that are not from
  3103.                             Calico-controlled \tendpoints that do have the label \"my_label\".
  3104.                             \n The effect is that the latter will accept packets from
  3105.                             non-Calico sources whereas the former is limited to packets
  3106.                             from Calico-controlled endpoints."
  3107.                           type: string
  3108.                         serviceAccounts:
  3109.                           description: ServiceAccounts is an optional field that restricts
  3110.                             the rule to only apply to traffic that originates from
  3111.                             (or terminates at) a pod running as a matching service
  3112.                             account.
  3113.                           properties:
  3114.                             names:
  3115.                               description: Names is an optional field that restricts
  3116.                                 the rule to only apply to traffic that originates
  3117.                                 from (or terminates at) a pod running as a service
  3118.                                 account whose name is in the list.
  3119.                               items:
  3120.                                 type: string
  3121.                               type: array
  3122.                             selector:
  3123.                               description: Selector is an optional field that restricts
  3124.                                 the rule to only apply to traffic that originates
  3125.                                 from (or terminates at) a pod running as a service
  3126.                                 account that matches the given label selector. If
  3127.                                 both Names and Selector are specified then they are
  3128.                                 AND'ed.
  3129.                               type: string
  3130.                           type: object
  3131.                       type: object
  3132.                   required:
  3133.                   - action
  3134.                   type: object
  3135.                 type: array
  3136.               order:
  3137.                 description: Order is an optional field that specifies the order in
  3138.                   which the policy is applied. Policies with higher "order" are applied
  3139.                   after those with lower order.  If the order is omitted, it may be
  3140.                   considered to be "infinite" - i.e. the policy will be applied last.  Policies
  3141.                   with identical order will be applied in alphanumerical order based
  3142.                   on the Policy "Name".
  3143.                 type: number
  3144.               selector:
  3145.                 description: "The selector is an expression used to pick pick out
  3146.                   the endpoints that the policy should be applied to. \n Selector
  3147.                   expressions follow this syntax: \n \tlabel == \"string_literal\"
  3148.                   \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
  3149.                   \  ->  not equal; also matches if label is not present \tlabel in
  3150.                   { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
  3151.                   one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
  3152.                   ... }  ->  true if the value of label X is not one of \"a\", \"b\",
  3153.                   \"c\" \thas(label_name)  -> True if that label is present \t! expr
  3154.                   -> negation of expr \texpr && expr  -> Short-circuit and \texpr
  3155.                   || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
  3156.                   or the empty selector -> matches all endpoints. \n Label names are
  3157.                   allowed to contain alphanumerics, -, _ and /. String literals are
  3158.                   more permissive but they do not support escape characters. \n Examples
  3159.                   (with made-up labels): \n \ttype == \"webserver\" && deployment
  3160.                   == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
  3161.                   \"dev\" \t! has(label_name)"
  3162.                 type: string
  3163.               serviceAccountSelector:
  3164.                 description: ServiceAccountSelector is an optional field for an expression
  3165.                   used to select a pod based on service accounts.
  3166.                 type: string
  3167.               types:
  3168.                 description: "Types indicates whether this policy applies to ingress,
  3169.                   or to egress, or to both.  When not explicitly specified (and so
  3170.                   the value on creation is empty or nil), Calico defaults Types according
  3171.                   to what Ingress and Egress are present in the policy.  The default
  3172.                   is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
  3173.                   the case where there are   also no Ingress rules) \n - [ PolicyTypeEgress
  3174.                   ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
  3175.                   PolicyTypeEgress ], if there are both Ingress and Egress rules.
  3176.                   \n When the policy is read back again, Types will always be one
  3177.                   of these values, never empty or nil."
  3178.                 items:
  3179.                   description: PolicyType enumerates the possible values of the PolicySpec
  3180.                     Types field.
  3181.                   type: string
  3182.                 type: array
  3183.             type: object
  3184.         type: object
  3185.     served: true
  3186.     storage: true
  3187. status:
  3188.   acceptedNames:
  3189.     kind: ""
  3190.     plural: ""
  3191.   conditions: []
  3192.   storedVersions: []
  3193.  
  3194. ---
  3195. apiVersion: apiextensions.k8s.io/v1
  3196. kind: CustomResourceDefinition
  3197. metadata:
  3198.   name: networksets.crd.projectcalico.org
  3199. spec:
  3200.   group: crd.projectcalico.org
  3201.   names:
  3202.     kind: NetworkSet
  3203.     listKind: NetworkSetList
  3204.     plural: networksets
  3205.     singular: networkset
  3206.   scope: Namespaced
  3207.   versions:
  3208.   - name: v1
  3209.     schema:
  3210.       openAPIV3Schema:
  3211.         description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet.
  3212.         properties:
  3213.           apiVersion:
  3214.             description: 'APIVersion defines the versioned schema of this representation
  3215.               of an object. Servers should convert recognized schemas to the latest
  3216.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  3217.             type: string
  3218.           kind:
  3219.             description: 'Kind is a string value representing the REST resource this
  3220.               object represents. Servers may infer this from the endpoint the client
  3221.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  3222.             type: string
  3223.           metadata:
  3224.             type: object
  3225.           spec:
  3226.             description: NetworkSetSpec contains the specification for a NetworkSet
  3227.               resource.
  3228.             properties:
  3229.               nets:
  3230.                 description: The list of IP networks that belong to this set.
  3231.                 items:
  3232.                   type: string
  3233.                 type: array
  3234.             type: object
  3235.         type: object
  3236.     served: true
  3237.     storage: true
  3238. status:
  3239.   acceptedNames:
  3240.     kind: ""
  3241.     plural: ""
  3242.   conditions: []
  3243.   storedVersions: []
  3244.  
  3245. ---
  3246. ---
  3247. # Source: calico/templates/calico-kube-controllers-rbac.yaml
  3248.  
  3249. # Include a clusterrole for the kube-controllers component,
  3250. # and bind it to the calico-kube-controllers serviceaccount.
  3251. kind: ClusterRole
  3252. apiVersion: rbac.authorization.k8s.io/v1
  3253. metadata:
  3254.   name: calico-kube-controllers
  3255. rules:
  3256.   # Nodes are watched to monitor for deletions.
  3257.   - apiGroups: [""]
  3258.     resources:
  3259.       - nodes
  3260.     verbs:
  3261.       - watch
  3262.       - list
  3263.       - get
  3264.   # Pods are queried to check for existence.
  3265.   - apiGroups: [""]
  3266.     resources:
  3267.       - pods
  3268.     verbs:
  3269.       - get
  3270.   # IPAM resources are manipulated when nodes are deleted.
  3271.   - apiGroups: ["crd.projectcalico.org"]
  3272.     resources:
  3273.       - ippools
  3274.     verbs:
  3275.       - list
  3276.   - apiGroups: ["crd.projectcalico.org"]
  3277.     resources:
  3278.       - blockaffinities
  3279.       - ipamblocks
  3280.       - ipamhandles
  3281.     verbs:
  3282.       - get
  3283.       - list
  3284.       - create
  3285.       - update
  3286.       - delete
  3287.       - watch
  3288.   # kube-controllers manages hostendpoints.
  3289.   - apiGroups: ["crd.projectcalico.org"]
  3290.     resources:
  3291.       - hostendpoints
  3292.     verbs:
  3293.       - get
  3294.       - list
  3295.       - create
  3296.       - update
  3297.       - delete
  3298.   # Needs access to update clusterinformations.
  3299.   - apiGroups: ["crd.projectcalico.org"]
  3300.     resources:
  3301.       - clusterinformations
  3302.     verbs:
  3303.       - get
  3304.       - create
  3305.       - update
  3306.   # KubeControllersConfiguration is where it gets its config
  3307.   - apiGroups: ["crd.projectcalico.org"]
  3308.     resources:
  3309.       - kubecontrollersconfigurations
  3310.     verbs:
  3311.       # read its own config
  3312.       - get
  3313.       # create a default if none exists
  3314.       - create
  3315.       # update status
  3316.       - update
  3317.       # watch for changes
  3318.       - watch
  3319. ---
  3320. kind: ClusterRoleBinding
  3321. apiVersion: rbac.authorization.k8s.io/v1
  3322. metadata:
  3323.   name: calico-kube-controllers
  3324. roleRef:
  3325.   apiGroup: rbac.authorization.k8s.io
  3326.   kind: ClusterRole
  3327.   name: calico-kube-controllers
  3328. subjects:
  3329. - kind: ServiceAccount
  3330.   name: calico-kube-controllers
  3331.   namespace: kube-system
  3332. ---
  3333.  
  3334. ---
  3335. # Source: calico/templates/calico-node-rbac.yaml
  3336. # Include a clusterrole for the calico-node DaemonSet,
  3337. # and bind it to the calico-node serviceaccount.
  3338. kind: ClusterRole
  3339. apiVersion: rbac.authorization.k8s.io/v1
  3340. metadata:
  3341.   name: calico-node
  3342. rules:
  3343.   # The CNI plugin needs to get pods, nodes, and namespaces.
  3344.   - apiGroups: [""]
  3345.     resources:
  3346.       - pods
  3347.       - nodes
  3348.       - namespaces
  3349.     verbs:
  3350.       - get
  3351.   - apiGroups: [""]
  3352.     resources:
  3353.       - endpoints
  3354.       - services
  3355.     verbs:
  3356.       # Used to discover service IPs for advertisement.
  3357.       - watch
  3358.       - list
  3359.       # Used to discover Typhas.
  3360.       - get
  3361.   # Pod CIDR auto-detection on kubeadm needs access to config maps.
  3362.   - apiGroups: [""]
  3363.     resources:
  3364.       - configmaps
  3365.     verbs:
  3366.       - get
  3367.   - apiGroups: [""]
  3368.     resources:
  3369.       - nodes/status
  3370.     verbs:
  3371.       # Needed for clearing NodeNetworkUnavailable flag.
  3372.       - patch
  3373.       # Calico stores some configuration information in node annotations.
  3374.       - update
  3375.   # Watch for changes to Kubernetes NetworkPolicies.
  3376.   - apiGroups: ["networking.k8s.io"]
  3377.     resources:
  3378.       - networkpolicies
  3379.     verbs:
  3380.       - watch
  3381.       - list
  3382.   # Used by Calico for policy information.
  3383.   - apiGroups: [""]
  3384.     resources:
  3385.       - pods
  3386.       - namespaces
  3387.       - serviceaccounts
  3388.     verbs:
  3389.       - list
  3390.       - watch
  3391.   # The CNI plugin patches pods/status.
  3392.   - apiGroups: [""]
  3393.     resources:
  3394.       - pods/status
  3395.     verbs:
  3396.       - patch
  3397.   # Calico monitors various CRDs for config.
  3398.   - apiGroups: ["crd.projectcalico.org"]
  3399.     resources:
  3400.       - globalfelixconfigs
  3401.       - felixconfigurations
  3402.       - bgppeers
  3403.       - globalbgpconfigs
  3404.       - bgpconfigurations
  3405.       - ippools
  3406.       - ipamblocks
  3407.       - globalnetworkpolicies
  3408.       - globalnetworksets
  3409.       - networkpolicies
  3410.       - networksets
  3411.       - clusterinformations
  3412.       - hostendpoints
  3413.       - blockaffinities
  3414.     verbs:
  3415.       - get
  3416.       - list
  3417.       - watch
  3418.   # Calico must create and update some CRDs on startup.
  3419.   - apiGroups: ["crd.projectcalico.org"]
  3420.     resources:
  3421.       - ippools
  3422.       - felixconfigurations
  3423.       - clusterinformations
  3424.     verbs:
  3425.       - create
  3426.       - update
  3427.   # Calico stores some configuration information on the node.
  3428.   - apiGroups: [""]
  3429.     resources:
  3430.       - nodes
  3431.     verbs:
  3432.       - get
  3433.       - list
  3434.       - watch
  3435.   # These permissions are only required for upgrade from v2.6, and can
  3436.   # be removed after upgrade or on fresh installations.
  3437.   - apiGroups: ["crd.projectcalico.org"]
  3438.     resources:
  3439.       - bgpconfigurations
  3440.       - bgppeers
  3441.     verbs:
  3442.       - create
  3443.       - update
  3444.   # These permissions are required for Calico CNI to perform IPAM allocations.
  3445.   - apiGroups: ["crd.projectcalico.org"]
  3446.     resources:
  3447.       - blockaffinities
  3448.       - ipamblocks
  3449.       - ipamhandles
  3450.     verbs:
  3451.       - get
  3452.       - list
  3453.       - create
  3454.       - update
  3455.       - delete
  3456.   - apiGroups: ["crd.projectcalico.org"]
  3457.     resources:
  3458.       - ipamconfigs
  3459.     verbs:
  3460.       - get
  3461.   # Block affinities must also be watchable by confd for route aggregation.
  3462.   - apiGroups: ["crd.projectcalico.org"]
  3463.     resources:
  3464.       - blockaffinities
  3465.     verbs:
  3466.       - watch
  3467.   # The Calico IPAM migration needs to get daemonsets. These permissions can be
  3468.   # removed if not upgrading from an installation using host-local IPAM.
  3469.   - apiGroups: ["apps"]
  3470.     resources:
  3471.       - daemonsets
  3472.     verbs:
  3473.       - get
  3474.  
  3475. ---
  3476. apiVersion: rbac.authorization.k8s.io/v1
  3477. kind: ClusterRoleBinding
  3478. metadata:
  3479.   name: calico-node
  3480. roleRef:
  3481.   apiGroup: rbac.authorization.k8s.io
  3482.   kind: ClusterRole
  3483.   name: calico-node
  3484. subjects:
  3485. - kind: ServiceAccount
  3486.   name: calico-node
  3487.   namespace: kube-system
  3488.  
  3489. ---
  3490. # Source: calico/templates/calico-node.yaml
  3491. # This manifest installs the calico-node container, as well
  3492. # as the CNI plugins and network config on
  3493. # each master and worker node in a Kubernetes cluster.
  3494. kind: DaemonSet
  3495. apiVersion: apps/v1
  3496. metadata:
  3497.   name: calico-node
  3498.   namespace: kube-system
  3499.   labels:
  3500.     k8s-app: calico-node
  3501. spec:
  3502.   selector:
  3503.     matchLabels:
  3504.       k8s-app: calico-node
  3505.   updateStrategy:
  3506.     type: RollingUpdate
  3507.     rollingUpdate:
  3508.       maxUnavailable: 1
  3509.   template:
  3510.     metadata:
  3511.       labels:
  3512.         k8s-app: calico-node
  3513.     spec:
  3514.       nodeSelector:
  3515.         kubernetes.io/os: linux
  3516.       hostNetwork: true
  3517.       tolerations:
  3518.         # Make sure calico-node gets scheduled on all nodes.
  3519.         - effect: NoSchedule
  3520.           operator: Exists
  3521.         # Mark the pod as a critical add-on for rescheduling.
  3522.         - key: CriticalAddonsOnly
  3523.           operator: Exists
  3524.         - effect: NoExecute
  3525.           operator: Exists
  3526.       serviceAccountName: calico-node
  3527.       # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
  3528.       # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
  3529.       terminationGracePeriodSeconds: 0
  3530.       priorityClassName: system-node-critical
  3531.       initContainers:
  3532.         # This container performs upgrade from host-local IPAM to calico-ipam.
  3533.         # It can be deleted if this is a fresh installation, or if you have already
  3534.         # upgraded to use calico-ipam.
  3535.         - name: upgrade-ipam
  3536.           image: docker.io/calico/cni:v3.18.0
  3537.           imagePullPolicy: IfNotPresent
  3538.           command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
  3539.           envFrom:
  3540.           - configMapRef:
  3541.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
  3542.               name: kubernetes-services-endpoint
  3543.               optional: true
  3544.           env:
  3545.             - name: KUBERNETES_NODE_NAME
  3546.               valueFrom:
  3547.                 fieldRef:
  3548.                   fieldPath: spec.nodeName
  3549.             - name: CALICO_NETWORKING_BACKEND
  3550.               valueFrom:
  3551.                 configMapKeyRef:
  3552.                   name: calico-config
  3553.                   key: calico_backend
  3554.           volumeMounts:
  3555.             - mountPath: /var/lib/cni/networks
  3556.               name: host-local-net-dir
  3557.             - mountPath: /host/opt/cni/bin
  3558.               name: cni-bin-dir
  3559.           securityContext:
  3560.             privileged: true
  3561.         # This container installs the CNI binaries
  3562.         # and CNI network config file on each node.
  3563.         - name: install-cni
  3564.           image: docker.io/calico/cni:v3.18.0
  3565.           command: ["/opt/cni/bin/install"]
  3566.           envFrom:
  3567.           - configMapRef:
  3568.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
  3569.               name: kubernetes-services-endpoint
  3570.               optional: true
  3571.           env:
  3572.             # Name of the CNI config file to create.
  3573.             - name: CNI_CONF_NAME
  3574.               value: "10-calico.conflist"
  3575.             # The CNI network config to install on each node.
  3576.             - name: CNI_NETWORK_CONFIG
  3577.               valueFrom:
  3578.                 configMapKeyRef:
  3579.                   name: calico-config
  3580.                   key: cni_network_config
  3581.             # Set the hostname based on the k8s node name.
  3582.             - name: KUBERNETES_NODE_NAME
  3583.               valueFrom:
  3584.                 fieldRef:
  3585.                   fieldPath: spec.nodeName
  3586.             # CNI MTU Config variable
  3587.             - name: CNI_MTU
  3588.               valueFrom:
  3589.                 configMapKeyRef:
  3590.                   name: calico-config
  3591.                   key: veth_mtu
  3592.             # Prevents the container from sleeping forever.
  3593.             - name: SLEEP
  3594.               value: "false"
  3595.           volumeMounts:
  3596.             - mountPath: /host/opt/cni/bin
  3597.               name: cni-bin-dir
  3598.             - mountPath: /host/etc/cni/net.d
  3599.               name: cni-net-dir
  3600.           securityContext:
  3601.             privileged: true
  3602.         # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
  3603.         # to communicate with Felix over the Policy Sync API.
  3604.         - name: flexvol-driver
  3605.           image: docker.io/calico/pod2daemon-flexvol:v3.18.0
  3606.           imagePullPolicy: IfNotPresent
  3607.           volumeMounts:
  3608.           - name: flexvol-driver-host
  3609.             mountPath: /host/driver
  3610.           securityContext:
  3611.             privileged: true
  3612.       containers:
  3613.         # Runs calico-node container on each Kubernetes node. This
  3614.         # container programs network policy and routes on each
  3615.         # host.
  3616.         - name: calico-node
  3617.           image: docker.io/calico/node:v3.18.0
  3618.           imagePullPolicy: IfNotPresent
  3619.           envFrom:
  3620.           - configMapRef:
  3621.               # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
  3622.               name: kubernetes-services-endpoint
  3623.               optional: true
  3624.           env:
  3625.             # Use Kubernetes API as the backing datastore.
  3626.             - name: DATASTORE_TYPE
  3627.               value: "kubernetes"
  3628.             # Wait for the datastore.
  3629.             - name: WAIT_FOR_DATASTORE
  3630.               value: "true"
  3631.             # Set based on the k8s node name.
  3632.             - name: NODENAME
  3633.               valueFrom:
  3634.                 fieldRef:
  3635.                   fieldPath: spec.nodeName
  3636.             # Choose the backend to use.
  3637.             - name: CALICO_NETWORKING_BACKEND
  3638.               valueFrom:
  3639.                 configMapKeyRef:
  3640.                   name: calico-config
  3641.                   key: calico_backend
  3642.             # Cluster type to identify the deployment type
  3643.             - name: CLUSTER_TYPE
  3644.               value: "k8s,bgp"
  3645.             # Auto-detect the BGP IP address.
  3646.             - name: IP
  3647.               value: "autodetect"
  3648.             # Enable IPIP
  3649.             - name: CALICO_IPV4POOL_IPIP
  3650.               value: "Always"
  3651.             # Enable or Disable VXLAN on the default IP pool.
  3652.             - name: CALICO_IPV4POOL_VXLAN
  3653.               value: "Never"
  3654.             # Set MTU for tunnel device used if ipip is enabled
  3655.             - name: FELIX_IPINIPMTU
  3656.               valueFrom:
  3657.                 configMapKeyRef:
  3658.                   name: calico-config
  3659.                   key: veth_mtu
  3660.             # Set MTU for the VXLAN tunnel device.
  3661.             - name: FELIX_VXLANMTU
  3662.               valueFrom:
  3663.                 configMapKeyRef:
  3664.                   name: calico-config
  3665.                   key: veth_mtu
  3666.             # Set MTU for the Wireguard tunnel device.
  3667.             - name: FELIX_WIREGUARDMTU
  3668.               valueFrom:
  3669.                 configMapKeyRef:
  3670.                   name: calico-config
  3671.                   key: veth_mtu
  3672.             # The default IPv4 pool to create on startup if none exists. Pod IPs will be
  3673.             # chosen from this range. Changing this value after installation will have
  3674.             # no effect. This should fall within `--cluster-cidr`.
  3675.             # - name: CALICO_IPV4POOL_CIDR
  3676.             #   value: "192.168.0.0/16"
  3677.             # Disable file logging so `kubectl logs` works.
  3678.             - name: CALICO_DISABLE_FILE_LOGGING
  3679.               value: "true"
  3680.             # Set Felix endpoint to host default action to ACCEPT.
  3681.             - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
  3682.               value: "ACCEPT"
  3683.             # Disable IPv6 on Kubernetes.
  3684.             - name: FELIX_IPV6SUPPORT
  3685.               value: "false"
  3686.             # Set Felix logging to "info"
  3687.             - name: FELIX_LOGSEVERITYSCREEN
  3688.               value: "info"
  3689.             - name: FELIX_HEALTHENABLED
  3690.               value: "true"
  3691.           securityContext:
  3692.             privileged: true
  3693.           resources:
  3694.             requests:
  3695.               cpu: 250m
  3696.           livenessProbe:
  3697.             exec:
  3698.               command:
  3699.               - /bin/calico-node
  3700.               - -felix-live
  3701.               - -bird-live
  3702.             periodSeconds: 10
  3703.             initialDelaySeconds: 10
  3704.             failureThreshold: 6
  3705.           readinessProbe:
  3706.             exec:
  3707.               command:
  3708.               - /bin/calico-node
  3709.               - -felix-ready
  3710.               - -bird-ready
  3711.             periodSeconds: 10
  3712.           volumeMounts:
  3713.             - mountPath: /lib/modules
  3714.               name: lib-modules
  3715.               readOnly: true
  3716.             - mountPath: /run/xtables.lock
  3717.               name: xtables-lock
  3718.               readOnly: false
  3719.             - mountPath: /var/run/calico
  3720.               name: var-run-calico
  3721.               readOnly: false
  3722.             - mountPath: /var/lib/calico
  3723.               name: var-lib-calico
  3724.               readOnly: false
  3725.             - name: policysync
  3726.               mountPath: /var/run/nodeagent
  3727.             # For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the
  3728.             # parent directory.
  3729.             - name: sysfs
  3730.               mountPath: /sys/fs/
  3731.               # Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host.
  3732.               # If the host is known to mount that filesystem already then Bidirectional can be omitted.
  3733.               mountPropagation: Bidirectional
  3734.             - name: cni-log-dir
  3735.               mountPath: /var/log/calico/cni
  3736.               readOnly: true
  3737.       volumes:
  3738.         # Used by calico-node.
  3739.         - name: lib-modules
  3740.           hostPath:
  3741.             path: /lib/modules
  3742.         - name: var-run-calico
  3743.           hostPath:
  3744.             path: /var/run/calico
  3745.         - name: var-lib-calico
  3746.           hostPath:
  3747.             path: /var/lib/calico
  3748.         - name: xtables-lock
  3749.           hostPath:
  3750.             path: /run/xtables.lock
  3751.             type: FileOrCreate
  3752.         - name: sysfs
  3753.           hostPath:
  3754.             path: /sys/fs/
  3755.             type: DirectoryOrCreate
  3756.         # Used to install CNI.
  3757.         - name: cni-bin-dir
  3758.           hostPath:
  3759.             path: /opt/cni/bin
  3760.         - name: cni-net-dir
  3761.           hostPath:
  3762.             path: /etc/cni/net.d
  3763.         # Used to access CNI logs.
  3764.         - name: cni-log-dir
  3765.           hostPath:
  3766.             path: /var/log/calico/cni
  3767.         # Mount in the directory for host-local IPAM allocations. This is
  3768.         # used when upgrading from host-local to calico-ipam, and can be removed
  3769.         # if not using the upgrade-ipam init container.
  3770.         - name: host-local-net-dir
  3771.           hostPath:
  3772.             path: /var/lib/cni/networks
  3773.         # Used to create per-pod Unix Domain Sockets
  3774.         - name: policysync
  3775.           hostPath:
  3776.             type: DirectoryOrCreate
  3777.             path: /var/run/nodeagent
  3778.         # Used to install Flex Volume Driver
  3779.         - name: flexvol-driver-host
  3780.           hostPath:
  3781.             type: DirectoryOrCreate
  3782.             path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
  3783. ---
  3784.  
  3785. apiVersion: v1
  3786. kind: ServiceAccount
  3787. metadata:
  3788.   name: calico-node
  3789.   namespace: kube-system
  3790.  
  3791. ---
  3792. # Source: calico/templates/calico-kube-controllers.yaml
  3793. # See https://github.com/projectcalico/kube-controllers
  3794. apiVersion: apps/v1
  3795. kind: Deployment
  3796. metadata:
  3797.   name: calico-kube-controllers
  3798.   namespace: kube-system
  3799.   labels:
  3800.     k8s-app: calico-kube-controllers
  3801. spec:
  3802.   # The controllers can only have a single active instance.
  3803.   replicas: 1
  3804.   selector:
  3805.     matchLabels:
  3806.       k8s-app: calico-kube-controllers
  3807.   strategy:
  3808.     type: Recreate
  3809.   template:
  3810.     metadata:
  3811.       name: calico-kube-controllers
  3812.       namespace: kube-system
  3813.       labels:
  3814.         k8s-app: calico-kube-controllers
  3815.     spec:
  3816.       nodeSelector:
  3817.         kubernetes.io/os: linux
  3818.       tolerations:
  3819.         # Mark the pod as a critical add-on for rescheduling.
  3820.         - key: CriticalAddonsOnly
  3821.           operator: Exists
  3822.         - key: node-role.kubernetes.io/master
  3823.           effect: NoSchedule
  3824.       serviceAccountName: calico-kube-controllers
  3825.       priorityClassName: system-cluster-critical
  3826.       containers:
  3827.         - name: calico-kube-controllers
  3828.           image: docker.io/calico/kube-controllers:v3.18.0
  3829.           imagePullPolicy: IfNotPresent
  3830.           env:
  3831.             # Choose which controllers to run.
  3832.             - name: ENABLED_CONTROLLERS
  3833.               value: node
  3834.             - name: DATASTORE_TYPE
  3835.               value: kubernetes
  3836.           readinessProbe:
  3837.             exec:
  3838.               command:
  3839.               - /usr/bin/check-status
  3840.               - -r
  3841.  
  3842. ---
  3843.  
  3844. apiVersion: v1
  3845. kind: ServiceAccount
  3846. metadata:
  3847.   name: calico-kube-controllers
  3848.   namespace: kube-system
  3849.  
  3850. ---
  3851.  
  3852. # This manifest creates a Pod Disruption Budget for Controller to allow K8s Cluster Autoscaler to evict
  3853.  
  3854. apiVersion: policy/v1
  3855. kind: PodDisruptionBudget
  3856. metadata:
  3857.   name: calico-kube-controllers
  3858.   namespace: kube-system
  3859.   labels:
  3860.     k8s-app: calico-kube-controllers
  3861. spec:
  3862.   maxUnavailable: 1
  3863.   selector:
  3864.     matchLabels:
  3865.       k8s-app: calico-kube-controllers
  3866.  
  3867. ---
  3868. # Source: calico/templates/calico-etcd-secrets.yaml
  3869.  
  3870. ---
  3871. # Source: calico/templates/calico-typha.yaml
  3872.  
  3873. ---
  3874. # Source: calico/templates/configure-canal.yaml
  3875.  
  3876.

如果机器有多个网卡，需要在 calico 配置文件里指定可以联网的网卡，在3644行后面指定你网卡

            - name: IP_AUTODETECTION_METHOD
              value: "interface=ens33"

假如机器只有一个网卡，也要指定下，这样就直接找到可以用的网卡了（也可以指定，上面的没子指定）。

[root@xuegod63 ~]# kubectl apply -f calico.yaml （只在一台机器上安装就可以）

[root@xuegod63 ~]# kubectl get nodes

查看

查看各节点状态kubectl get pods -n kube-system

5、测试 k8s 集群的 DNS 解析和网络是否正常

#把 busybox-1-28.tar.gz 上传到 xuegod65 工作节点 pod在工作节点运行，手动解压
[root@xuegod65 ~]# ctr -n=k8s.io images import busybox-1-28.tar.gz


[root@xuegod63 ~]# 

kubectl run busybox --image docker.io/library/busybox:1.28 --image-pull-policy=IfNotPresent --restart=Never --rm -it busybox -- sh

/ # ping www.baidu.com
PING www.baidu.com (39.156.66.18): 56 data bytes
64 bytes from 39.156.66.18: seq=0 ttl=127 time=39.3 ms
#通过上面可以看到能访问网络，说明 calico 网络插件已经被正常安装了

 6.etcd 配置成高可用状态

修改 xuegod63、xuegod64 上的 etcd.yaml 文件
vim /etc/kubernetes/manifests/etcd.yaml 

把- --initial-cluster=xuegod63=https://192.168.1.63:2380
变成如下：
- -nitialcluster=xuegod63=https://192.168.1.63:2380,xuegod62=https://192.168.1.62:2380,xuegod
64=https://192.168.1.64:2380 

修改成功之后重启 kubelet：
[root@xuegod63 ~]# systemctl restart kubelet
[root@xuegod62 ~]# systemctl restart kubelet
[root@xuegod64 ~]# systemctl restart kubele

测试 etcd 集群是否配置成功：
[root@xuegod63 ~]# docker run --rm -it --net host -v /etc/kubernetes:/etc/kubernetes 
registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.5.4-0 etcdctl --cert 
/etc/kubernetes/pki/etcd/peer.crt --key /etc/kubernetes/pki/etcd/peer.key --cacert 
/etc/kubernetes/pki/etcd/ca.crt member list

[root@xuegod63 ~]# docker run --rm -it --net host -v /etc/kubernetes:/etc/kubernetes 
registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.5.4-0 etcdctl --cert 
/etc/kubernetes/pki/etcd/peer.crt --key /etc/kubernetes/pki/etcd/peer.key --cacert 
/etc/kubernetes/pki/etcd/ca.crt --
endpoints=https://192.168.1.63:2379,https://192.168.1.62:2379,https://192.168.1.64:2379 
endpoint health --cluster

显示如下，说明 etcd 集群配置成功：

[root@xuegod63 ~]# docker run --rm -it --net host -v /etc/kubernetes:/etc/kubernetes 
registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.5.4-0 etcdctl -w table --cert 
/etc/kubernetes/pki/etcd/peer.crt --key /etc/kubernetes/pki/etcd/peer.key --cacert 
/etc/kubernetes/pki/etcd/ca.crt --
endpoints=https://192.168.1.63:2379,https://192.168.1.62:2379,https://192.168.1.64:2379 
endpoint status --cluster

本文内容由网友自发贡献，转载请注明出处：【wpsshop博客】
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号