gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

actualized for kubespray version 2.28.0

Browse Source
This commit is contained in:
George Stykalin
2025-06-15 20:25:45 +03:00
parent c819d4f51f
commit c2df2abc78
366 changed files with 9939 additions and 40388 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
kubespray/project/roles/network_plugin/calico/templates/calico-apiserver.yml.j2
View File

@@ -72,7 +72,7 @@ spec:
initialDelaySeconds: 90
periodSeconds: 10
name: calico-apiserver
{% if calico_version is version('v3.28.0', '>=') %}
{% if calico_version is version('3.28.0', '>=') %}
readinessProbe:
httpGet:
path: /readyz
@@ -176,6 +176,7 @@ rules:
- ipamblocks
- blockaffinities
- caliconodestatuses
- tiers
verbs:
- get
- list
@@ -183,7 +184,7 @@ rules:
- create
- update
- delete
{% if calico_version is version('v3.28.0', '>=') %}
{% if calico_version is version('3.28.0', '>=') %}
- apiGroups:
- policy
resourceNames:

12
kubespray/project/roles/network_plugin/calico/templates/calico-config.yml.j2
View File

@@ -53,13 +53,15 @@ data:
"type": "host-local",
"subnet": "usePodCidr"
},
{% else %}
{% else %}
"ipam": {
"type": "calico-ipam",
{% if enable_dual_stack_networks %}
"assign_ipv6": "true",
{% endif %}
"assign_ipv4": "true"
{% if ipv4_stack %}
"assign_ipv4": "true"{{ ',' if (ipv6_stack and ipv4_stack) }}
{% endif %}
{% if ipv6_stack %}
"assign_ipv6": "true"
{% endif %}
},
{% endif %}
{% if calico_allow_ip_forwarding %}

14
kubespray/project/roles/network_plugin/calico/templates/calico-cr.yml.j2
View File

@@ -86,6 +86,13 @@ rules:
verbs:
- watch
- list
# Watch for changes to Kubernetes AdminNetworkPolicies.
- apiGroups: ["policy.networking.k8s.io"]
resources:
- adminnetworkpolicies
verbs:
- watch
- list
# Used by Calico for policy information.
- apiGroups: [""]
resources:
@@ -121,10 +128,17 @@ rules:
- hostendpoints
- blockaffinities
- caliconodestatuses
- tiers
verbs:
- get
- list
- watch
# Calico creates some tiers on startup.
- apiGroups: ["crd.projectcalico.org"]
resources:
- tiers
verbs:
- create
# Calico must create and update some CRDs on startup.
- apiGroups: ["crd.projectcalico.org"]
resources:

117
kubespray/project/roles/network_plugin/calico/templates/calico-node.yml.j2
View File

@@ -1,7 +1,7 @@
---
# This manifest installs the calico/node container, as well
# as the Calico CNI plugins and network config on
# each master and worker node in a Kubernetes cluster.
# each control plane and worker node in a Kubernetes cluster.
kind: DaemonSet
apiVersion: apps/v1
metadata:
@@ -13,6 +13,10 @@ spec:
selector:
matchLabels:
k8s-app: calico-node
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
template:
metadata:
labels:
@@ -30,10 +34,16 @@ spec:
{{ calico_ds_nodeselector }}
priorityClassName: system-node-critical
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: calico-node
tolerations:
- operator: Exists
# Make sure calico-node gets scheduled on all nodes.
- effect: NoSchedule
operator: Exists
# Mark the pod as a critical add-on for rescheduling.
- key: CriticalAddonsOnly
operator: Exists
- effect: NoExecute
operator: Exists
# Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
# deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
terminationGracePeriodSeconds: 0
@@ -90,9 +100,11 @@ spec:
# Name of the CNI config file to create.
- name: CNI_CONF_NAME
value: "10-calico.conflist"
# Install CNI binaries
- name: UPDATE_CNI_BINARIES
value: "true"
{% if calico_mtu is defined %}
# CNI MTU Config variable
- name: CNI_MTU
value: "{{ calico_veth_mtu | default(calico_mtu) }}"
{% endif %}
# Prevents the container from sleeping forever.
- name: SLEEP
value: "false"
@@ -117,14 +129,29 @@ spec:
name: cni-bin-dir
securityContext:
privileged: true
# Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
# to communicate with Felix over the Policy Sync API.
- name: flexvol-driver
image: {{ calico_flexvol_image_repo }}:{{ calico_flexvol_image_tag }}
# This init container mounts the necessary filesystems needed by the BPF data plane
# i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed
# in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode.
- name: "mount-bpffs"
image: {{ calico_node_image_repo }}:{{ calico_node_image_tag }}
imagePullPolicy: {{ k8s_image_pull_policy }}
command: ["calico-node", "-init", "-best-effort"]
volumeMounts:
- name: flexvol-driver-host
mountPath: /host/driver
- mountPath: /sys/fs
name: sys-fs
# Bidirectional is required to ensure that the new mount we make at /sys/fs/bpf propagates to the host
# so that it outlives the init container.
mountPropagation: Bidirectional
- mountPath: /var/run/calico
name: var-run-calico
# Bidirectional is required to ensure that the new mount we make at /run/calico/cgroup propagates to the host
# so that it outlives the init container.
mountPropagation: Bidirectional
# Mount /proc/ from host which usually is an init program at /nodeproc. It's needed by mountns binary,
# executed by calico-node, to mount root cgroup2 fs at /run/calico/cgroup to attach CTLB programs correctly.
- mountPath: /nodeproc
name: nodeproc
readOnly: true
securityContext:
privileged: true
containers:
@@ -205,10 +232,7 @@ spec:
key: calico_backend
# Cluster type to identify the deployment type
- name: CLUSTER_TYPE
valueFrom:
configMapKeyRef:
name: calico-config
key: cluster_type
value: "k8s,bgp"
# Set noderef for node controller.
- name: CALICO_K8S_NODE_REF
valueFrom:
@@ -230,14 +254,18 @@ spec:
value: "{{ calico_iptables_backend }}"
- name: FELIX_IPTABLESLOCKTIMEOUTSECS
value: "{{ calico_iptables_lock_timeout_secs }}"
# should be set in etcd before deployment
# # Configure the IP Pool from which Pod IPs will be chosen.
# - name: CALICO_IPV4POOL_CIDR
# value: "{{ calico_pool_cidr | default(kube_pods_subnet) }}"
# The default IPv4 pool to create on startup if none exists. Pod IPs will be
# chosen from this range. Changing this value after installation will have
# no effect. This should fall within `--cluster-cidr`.
# - name: CALICO_IPV4POOL_CIDR
# value: "192.168.0.0/16"
- name: CALICO_IPV4POOL_IPIP
value: "{{ calico_ipv4pool_ipip }}"
# Enable or Disable VXLAN on the default IP pool.
- name: CALICO_IPV4POOL_VXLAN
value: "Never"
- name: FELIX_IPV6SUPPORT
value: "{{ enable_dual_stack_networks | default(false) }}"
value: "{{ ipv6_stack | default(false) }}"
# Set Felix logging to "info"
- name: FELIX_LOGSEVERITYSCREEN
value: "{{ calico_loglevel }}"
@@ -280,9 +308,18 @@ spec:
- name: IP_AUTODETECTION_METHOD
value: "can-reach=$(NODEIP)"
{% endif %}
{% if ipv4_stack %}
- name: IP
value: "autodetect"
{% if calico_ip6_auto_method is defined and enable_dual_stack_networks %}
{% else %}
- name: IP
value: none
{% endif %}
{% if ipv6_stack %}
- name: IP6
value: autodetect
{% endif %}
{% if calico_ip6_auto_method is defined and ipv6_stack %}
- name: IP6_AUTODETECTION_METHOD
value: "{{ calico_ip6_auto_method }}"
{% endif %}
@@ -290,10 +327,6 @@ spec:
- name: FELIX_MTUIFACEPATTERN
value: "{{ calico_felix_mtu_iface_pattern }}"
{% endif %}
{% if enable_dual_stack_networks %}
- name: IP6
value: autodetect
{% endif %}
{% if calico_use_default_route_src_ipaddr | default(false) %}
- name: FELIX_DEVICEROUTESOURCEADDRESS
valueFrom:
@@ -324,7 +357,9 @@ spec:
privileged: true
resources:
limits:
{% if calico_node_cpu_limit != "0" %}
cpu: {{ calico_node_cpu_limit }}
{% endif %}
memory: {{ calico_node_memory_limit }}
requests:
cpu: {{ calico_node_cpu_requests }}
@@ -391,15 +426,10 @@ spec:
{% endif %}
- name: policysync
mountPath: /var/run/nodeagent
{% if calico_bpf_enabled %}
# For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the
# parent directory.
- name: sysfs
mountPath: /sys/fs/
# Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host.
# If the host is known to mount that filesystem already then Bidirectional can be omitted.
mountPropagation: Bidirectional
{% endif %}
- name: bpffs
mountPath: /sys/fs/bpf
- name: cni-log-dir
mountPath: /var/log/calico/cni
readOnly: true
@@ -456,12 +486,18 @@ spec:
hostPath:
path: "/etc/kubernetes/ssl/"
{% endif %}
{% if calico_bpf_enabled %}
- name: sysfs
- name: sys-fs
hostPath:
path: /sys/fs/
type: DirectoryOrCreate
{% endif %}
- name: bpffs
hostPath:
path: /sys/fs/bpf
type: Directory
# mount /proc at /nodeproc to be used by mount-bpffs initContainer to mount root cgroup2 fs.
- name: nodeproc
hostPath:
path: /proc
# Used to access CNI logs.
- name: cni-log-dir
hostPath:
@@ -471,12 +507,3 @@ spec:
hostPath:
type: DirectoryOrCreate
path: /var/run/nodeagent
# Used to install Flex Volume Driver
- name: flexvol-driver-host
hostPath:
type: DirectoryOrCreate
path: "{{ kubelet_flexvolumes_plugins_dir | default('/usr/libexec/kubernetes/kubelet-plugins/volume/exec') }}/nodeagent~uds"
updateStrategy:
rollingUpdate:
maxUnavailable: {{ serial | default('20%') }}
type: RollingUpdate

8
kubespray/project/roles/network_plugin/calico/templates/calico-typha.yml.j2
View File

@@ -126,6 +126,10 @@ spec:
- name: TYPHA_PROMETHEUSMETRICSPORT
value: "{{ typha_prometheusmetricsport }}"
{% endif %}
{% if calico_ipam_host_local %}
- name: USE_POD_CIDR
value: "true"
{% endif %}
{% if typha_secure %}
volumeMounts:
- mountPath: /etc/typha
@@ -135,10 +139,6 @@ spec:
subPath: ca.crt
name: cacert
readOnly: true
{% endif %}
{% if calico_ipam_host_local %}
- name: USE_POD_CIDR
value: "true"
{% endif %}
livenessProbe:
httpGet: