diff --git a/packages/system/kubeovn/Makefile b/packages/system/kubeovn/Makefile index 7e6d0d34..45629042 100644 --- a/packages/system/kubeovn/Makefile +++ b/packages/system/kubeovn/Makefile @@ -1,5 +1,3 @@ -KUBEOVN_TAG=v0.40.0 - export NAME=kubeovn export NAMESPACE=cozy-$(NAME) @@ -8,6 +6,6 @@ include ../../../hack/package.mk update: rm -rf charts values.yaml Chart.yaml - tag=$(KUBEOVN_TAG) && \ - curl -sSL https://github.com/cozystack/kubeovn/archive/refs/tags/$${tag}.tar.gz | \ - tar xzvf - --strip 2 kubeovn-$${tag#*v}/chart + tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/kubeovn-chart | awk -F'[/^]' 'END{print $$3}') && \ + curl -sSL https://github.com/cozystack/kubeovn-chart/archive/refs/tags/$${tag}.tar.gz | \ + tar xzvf - --strip 2 kubeovn-chart-$${tag#*v}/chart diff --git a/packages/system/kubeovn/charts/kube-ovn/Chart.yaml b/packages/system/kubeovn/charts/kube-ovn/Chart.yaml index 0621c7c7..f0295b87 100644 --- a/packages/system/kubeovn/charts/kube-ovn/Chart.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/Chart.yaml @@ -15,12 +15,12 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: v1.14.25 +version: v1.15.3 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "1.14.25" +appVersion: "1.15.3" kubeVersion: ">= 1.29.0-0" diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/_helpers.tpl b/packages/system/kubeovn/charts/kube-ovn/templates/_helpers.tpl index fd6db240..ce144769 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/_helpers.tpl +++ b/packages/system/kubeovn/charts/kube-ovn/templates/_helpers.tpl @@ -69,7 +69,9 @@ Number of master nodes {{- $imageVersion := (index $ds.spec.template.spec.containers 0).image | splitList ":" | last | trimPrefix "v" -}} {{- $versionRegex := `^(?P0|[1-9]\d*)\.(?P0|[1-9]\d*)\.(?P0|[1-9]\d*)` -}} {{- if and (ne $newChartVersion $chartVersion) (regexMatch $versionRegex $imageVersion) -}} - {{- if regexFind $versionRegex $imageVersion | semverCompare ">= 1.13.0" -}} + {{- if regexFind $versionRegex $imageVersion | semverCompare ">= 1.15.0" -}} + 25.03 + {{- else if regexFind $versionRegex $imageVersion | semverCompare ">= 1.13.0" -}} 24.03 {{- else if regexFind $versionRegex $imageVersion | semverCompare ">= 1.12.0" -}} 22.12 diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/central-deploy.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/central-deploy.yaml index 505e0925..1bb0ece4 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/central-deploy.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/central-deploy.yaml @@ -122,6 +122,7 @@ spec: limits: cpu: {{ index .Values "ovn-central" "limits" "cpu" }} memory: {{ index .Values "ovn-central" "limits" "memory" }} + ephemeral-storage: {{ index .Values "ovn-central" "limits" "ephemeral-storage" }} volumeMounts: - mountPath: /var/run/ovn name: host-run-ovn diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy.yaml index 219e4ca0..69e27b23 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy.yaml @@ -76,18 +76,43 @@ spec: args: - /kube-ovn/start-controller.sh - --default-ls={{ .Values.networking.DEFAULT_SUBNET }} - - --default-cidr={{ .Values.ipv4.POD_CIDR }} - - --default-gateway={{ .Values.ipv4.POD_GATEWAY }} + - --default-cidr= + {{- if eq .Values.networking.NET_STACK "dual_stack" -}} + {{ .Values.dual_stack.POD_CIDR }} + {{- else if eq .Values.networking.NET_STACK "ipv4" -}} + {{ .Values.ipv4.POD_CIDR }} + {{- else if eq .Values.networking.NET_STACK "ipv6" -}} + {{ .Values.ipv6.POD_CIDR }} + {{- end }} + - --default-gateway= + {{- if eq .Values.networking.NET_STACK "dual_stack" -}} + {{ .Values.dual_stack.POD_GATEWAY }} + {{- else if eq .Values.networking.NET_STACK "ipv4" -}} + {{ .Values.ipv4.POD_GATEWAY }} + {{- else if eq .Values.networking.NET_STACK "ipv6" -}} + {{ .Values.ipv6.POD_GATEWAY }} + {{- end }} - --default-gateway-check={{- .Values.func.CHECK_GATEWAY }} - --default-logical-gateway={{- .Values.func.LOGICAL_GATEWAY }} - --default-u2o-interconnection={{- .Values.func.U2O_INTERCONNECTION }} - --default-exclude-ips={{- .Values.networking.EXCLUDE_IPS }} - --cluster-router={{ .Values.networking.DEFAULT_VPC }} - --node-switch={{ .Values.networking.NODE_SUBNET }} - - --node-switch-cidr={{ .Values.ipv4.JOIN_CIDR }} - - --service-cluster-ip-range={{ .Values.ipv4.SVC_CIDR }} - {{- if .Values.global.logVerbosity }} - - --v={{ .Values.global.logVerbosity }} + - --node-switch-cidr= + {{- if eq .Values.networking.NET_STACK "dual_stack" -}} + {{ .Values.dual_stack.JOIN_CIDR }} + {{- else if eq .Values.networking.NET_STACK "ipv4" -}} + {{ .Values.ipv4.JOIN_CIDR }} + {{- else if eq .Values.networking.NET_STACK "ipv6" -}} + {{ .Values.ipv6.JOIN_CIDR }} + {{- end }} + - --service-cluster-ip-range= + {{- if eq .Values.networking.NET_STACK "dual_stack" -}} + {{ .Values.dual_stack.SVC_CIDR }} + {{- else if eq .Values.networking.NET_STACK "ipv4" -}} + {{ .Values.ipv4.SVC_CIDR }} + {{- else if eq .Values.networking.NET_STACK "ipv6" -}} + {{ .Values.ipv6.SVC_CIDR }} {{- end }} - --network-type={{- .Values.networking.NETWORK_TYPE }} - --default-provider-name={{ .Values.networking.vlan.PROVIDER_NAME }} @@ -100,6 +125,7 @@ spec: - --pod-nic-type={{- .Values.networking.POD_NIC_TYPE }} - --enable-lb={{- .Values.func.ENABLE_LB }} - --enable-np={{- .Values.func.ENABLE_NP }} + - --np-enforcement={{- .Values.func.NP_ENFORCEMENT }} - --enable-eip-snat={{- .Values.networking.ENABLE_EIP_SNAT }} - --enable-external-vpc={{- .Values.func.ENABLE_EXTERNAL_VPC }} - --enable-ecmp={{- .Values.networking.ENABLE_ECMP }} @@ -116,11 +142,14 @@ spec: - --secure-serving={{- .Values.func.SECURE_SERVING }} - --enable-ovn-ipsec={{- .Values.func.ENABLE_OVN_IPSEC }} - --enable-anp={{- .Values.func.ENABLE_ANP }} + - --enable-dns-name-resolver={{- .Values.func.ENABLE_DNS_NAME_RESOLVER }} - --ovsdb-con-timeout={{- .Values.func.OVSDB_CON_TIMEOUT }} - --ovsdb-inactivity-timeout={{- .Values.func.OVSDB_INACTIVITY_TIMEOUT }} - --enable-live-migration-optimize={{- .Values.func.ENABLE_LIVE_MIGRATION_OPTIMIZE }} - --enable-ovn-lb-prefer-local={{- .Values.func.ENABLE_OVN_LB_PREFER_LOCAL }} - --image={{ .Values.global.registry.address }}/{{ .Values.global.images.kubeovn.repository }}:{{ .Values.global.images.kubeovn.tag }} + - --skip-conntrack-dst-cidrs={{- .Values.networking.SKIP_CONNTRACK_DST_CIDRS }} + - --non-primary-cni-mode={{- .Values.cni_conf.NON_PRIMARY_CNI }} securityContext: runAsUser: {{ include "kubeovn.runAsUser" . }} privileged: false @@ -139,11 +168,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - - name: KUBE_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: KUBE_NODE_NAME + - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName @@ -193,6 +218,7 @@ spec: limits: cpu: {{ index .Values "kube-ovn-controller" "limits" "cpu" }} memory: {{ index .Values "kube-ovn-controller" "limits" "memory" }} + ephemeral-storage: {{ index .Values "kube-ovn-controller" "limits" "ephemeral-storage" }} nodeSelector: kubernetes.io/os: "linux" volumes: diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/ic-controller-deploy.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/ic-controller-deploy.yaml index 53ecfa24..dc932a63 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/ic-controller-deploy.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/ic-controller-deploy.yaml @@ -100,6 +100,7 @@ spec: limits: cpu: 3 memory: 1Gi + ephemeral-storage: 1Gi volumeMounts: - mountPath: /var/run/ovn name: host-run-ovn diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml index 78ac7d38..5b093be6 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml @@ -37,10 +37,14 @@ spec: properties: vpc: type: string + description: VPC name for the DNS service. This field is immutable after creation. subnet: type: string + description: Subnet name for the DNS service. This field is immutable after creation. replicas: type: integer + description: Number of DNS server replicas (1-3) + format: int32 minimum: 1 maximum: 3 status: @@ -48,23 +52,31 @@ spec: properties: active: type: boolean + description: Whether the VPC DNS service is active conditions: type: array + description: Conditions represent the latest state of the VPC DNS items: type: object properties: type: type: string + description: Type of the condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -117,14 +129,20 @@ spec: properties: name: type: string + description: Port name port: type: integer + description: Service port number (1-65535) + format: int32 minimum: 1 maximum: 65535 protocol: type: string + description: Protocol (TCP or UDP) targetPort: type: integer + description: Target port number (1-65535) + format: int32 minimum: 1 maximum: 65535 type: object @@ -142,8 +160,10 @@ spec: properties: ports: type: string + description: Configured ports service: type: string + description: Associated service name --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -186,12 +206,15 @@ spec: items: type: string type: array + description: External subnets configured for the NAT gateway selector: type: array items: type: string + description: Pod selector configured for the NAT gateway qosPolicy: type: string + description: QoS policy applied to the NAT gateway tolerations: type: array items: @@ -204,6 +227,8 @@ spec: enum: - Equal - Exists + - Lt + - Gt value: type: string effect: @@ -213,6 +238,7 @@ spec: - NoSchedule - PreferNoSchedule tolerationSeconds: + format: int64 type: integer affinity: properties: @@ -258,6 +284,7 @@ spec: type: object weight: type: integer + format: int32 minimum: 1 maximum: 100 required: @@ -322,8 +349,6 @@ spec: properties: key: type: string - x-kubernetes-patch-strategy: merge - x-kubernetes-patch-merge-key: key operator: type: string values: @@ -335,6 +360,9 @@ spec: - operator type: object type: array + x-kubernetes-list-type: map + x-kubernetes-list-map-keys: + - key matchLabels: additionalProperties: type: string @@ -351,6 +379,7 @@ spec: type: object weight: type: integer + format: int32 minimum: 1 maximum: 100 required: @@ -368,8 +397,6 @@ spec: properties: key: type: string - x-kubernetes-patch-strategy: merge - x-kubernetes-patch-merge-key: key operator: type: string values: @@ -381,6 +408,9 @@ spec: - operator type: object type: array + x-kubernetes-list-type: map + x-kubernetes-list-map-keys: + - key matchLabels: additionalProperties: type: string @@ -411,8 +441,6 @@ spec: properties: key: type: string - x-kubernetes-patch-strategy: merge - x-kubernetes-patch-merge-key: key operator: type: string values: @@ -424,6 +452,9 @@ spec: - operator type: object type: array + x-kubernetes-list-type: map + x-kubernetes-list-map-keys: + - key matchLabels: additionalProperties: type: string @@ -440,6 +471,7 @@ spec: type: object weight: type: integer + format: int32 minimum: 1 maximum: 100 required: @@ -457,8 +489,6 @@ spec: properties: key: type: string - x-kubernetes-patch-strategy: merge - x-kubernetes-patch-merge-key: key operator: type: string values: @@ -470,6 +500,9 @@ spec: - operator type: object type: array + x-kubernetes-list-type: map + x-kubernetes-list-map-keys: + - key matchLabels: additionalProperties: type: string @@ -492,45 +525,79 @@ spec: properties: lanIp: type: string + description: LAN IP address for the NAT gateway. This field is immutable after creation. subnet: type: string + description: Subnet name for the NAT gateway. This field is immutable after creation. externalSubnets: items: type: string type: array + description: External subnets accessible through the NAT gateway vpc: type: string + description: VPC name for the NAT gateway. This field is immutable after creation. selector: type: array items: type: string + description: Pod selector for the NAT gateway qosPolicy: type: string + description: QoS policy name to apply to the NAT gateway + noDefaultEIP: + type: boolean + description: Disable default EIP assignment bgpSpeaker: type: object + description: BGP speaker configuration properties: enabled: type: boolean + description: Enable BGP speaker asn: type: integer + format: uint32 + description: Local AS number remoteAsn: type: integer + format: uint32 + description: Remote AS number neighbors: type: array items: type: string + description: BGP neighbor IP addresses holdTime: type: string + description: BGP hold time routerId: type: string + description: BGP router ID password: type: string + description: BGP authentication password enableGracefulRestart: type: boolean + description: Enable BGP graceful restart extraArgs: type: array items: type: string + description: Extra BGP arguments + routes: + type: array + description: Static routes for the NAT gateway + items: + type: object + properties: + cidr: + type: string + format: cidr + description: Destination CIDR for the route + nextHopIP: + type: string + description: Next hop IP address tolerations: type: array items: @@ -543,6 +610,8 @@ spec: enum: - Equal - Exists + - Lt + - Gt value: type: string effect: @@ -552,6 +621,7 @@ spec: - NoSchedule - PreferNoSchedule tolerationSeconds: + format: int64 type: integer affinity: properties: @@ -597,6 +667,7 @@ spec: type: object weight: type: integer + format: int32 minimum: 1 maximum: 100 required: @@ -661,8 +732,6 @@ spec: properties: key: type: string - x-kubernetes-patch-strategy: merge - x-kubernetes-patch-merge-key: key operator: type: string values: @@ -674,6 +743,9 @@ spec: - operator type: object type: array + x-kubernetes-list-type: map + x-kubernetes-list-map-keys: + - key matchLabels: additionalProperties: type: string @@ -690,6 +762,7 @@ spec: type: object weight: type: integer + format: int32 minimum: 1 maximum: 100 required: @@ -707,8 +780,6 @@ spec: properties: key: type: string - x-kubernetes-patch-strategy: merge - x-kubernetes-patch-merge-key: key operator: type: string values: @@ -720,6 +791,9 @@ spec: - operator type: object type: array + x-kubernetes-list-type: map + x-kubernetes-list-map-keys: + - key matchLabels: additionalProperties: type: string @@ -750,8 +824,6 @@ spec: properties: key: type: string - x-kubernetes-patch-strategy: merge - x-kubernetes-patch-merge-key: key operator: type: string values: @@ -763,6 +835,9 @@ spec: - operator type: object type: array + x-kubernetes-list-type: map + x-kubernetes-list-map-keys: + - key matchLabels: additionalProperties: type: string @@ -779,6 +854,7 @@ spec: type: object weight: type: integer + format: int32 minimum: 1 maximum: 100 required: @@ -796,8 +872,6 @@ spec: properties: key: type: string - x-kubernetes-patch-strategy: merge - x-kubernetes-patch-merge-key: key operator: type: string values: @@ -809,6 +883,9 @@ spec: - operator type: object type: array + x-kubernetes-list-type: map + x-kubernetes-list-map-keys: + - key matchLabels: additionalProperties: type: string @@ -897,10 +974,13 @@ spec: properties: replicas: type: integer + format: int32 minimum: 0 maximum: 10 + description: Number of egress gateway replicas labelSelector: type: string + description: Label selector for the egress gateway conditions: items: properties: @@ -914,6 +994,7 @@ spec: maxLength: 32768 type: string observedGeneration: + format: int64 minimum: 0 type: integer reason: @@ -940,6 +1021,7 @@ spec: - type type: object type: array + description: Conditions represent the latest available observations of the egress gateway's current state x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map @@ -947,12 +1029,15 @@ spec: items: type: string type: array + description: Internal IP addresses assigned to the egress gateway externalIPs: items: type: string type: array + description: External IP addresses assigned to the egress gateway phase: type: string + description: Current phase of the egress gateway (Pending, Processing, or Completed) default: Pending enum: - Pending @@ -960,9 +1045,11 @@ spec: - Completed ready: type: boolean + description: Indicates whether the egress gateway is ready default: false workload: type: object + description: Workload information for the egress gateway properties: apiVersion: type: string @@ -994,11 +1081,14 @@ spec: properties: replicas: type: integer + format: int32 default: 1 minimum: 0 maximum: 10 + description: Number of egress gateway replicas prefix: type: string + description: Name prefix for egress gateway pods. This field is immutable after creation. anyOf: - pattern: ^$ - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*[-\.]?$ @@ -1007,10 +1097,13 @@ spec: message: "This field is immutable." vpc: type: string + description: VPC name for the egress gateway. This field is immutable after creation. internalSubnet: type: string + description: Internal subnet name for the egress gateway. This field is immutable after creation. externalSubnet: type: string + description: External subnet name for the egress gateway. This field is immutable after creation and is required. internalIPs: items: type: string @@ -1021,6 +1114,7 @@ spec: - pattern: ^((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|:))),(?:(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])$ type: array x-kubernetes-list-type: set + description: Internal IP addresses for the egress gateway externalIPs: items: type: string @@ -1031,31 +1125,38 @@ spec: - pattern: ^((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|:))),(?:(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])$ type: array x-kubernetes-list-type: set + description: External IP addresses for the egress gateway image: type: string + description: Container image for the egress gateway bfd: type: object + description: BFD (Bidirectional Forwarding Detection) configuration properties: enabled: type: boolean default: false minRX: type: integer + format: int32 default: 1000 minimum: 1 maximum: 3600000 minTX: type: integer + format: int32 default: 1000 minimum: 1 maximum: 3600000 multiplier: type: integer + format: int32 default: 3 minimum: 1 maximum: 3600000 selectors: type: array + description: Selectors for pods to use this egress gateway items: type: object properties: @@ -1113,6 +1214,7 @@ spec: message: 'Each pod selector MUST have at least one matchLabels or matchExpressions' policies: type: array + description: Egress policies for the gateway items: type: object properties: @@ -1139,12 +1241,14 @@ spec: message: 'Each policy MUST have at least one ipBlock or subnet' trafficPolicy: type: string + description: Traffic policy for the egress gateway (Local or Cluster) enum: - Local - Cluster default: Cluster nodeSelector: type: array + description: Node selector for egress gateway placement items: type: object properties: @@ -1224,13 +1328,16 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string enum: - Exists - Equal + - Lt + - Gt tolerationSeconds: description: |- TolerationSeconds represents the period of time the toleration (which must be @@ -1292,46 +1399,64 @@ spec: properties: ready: type: boolean + description: Indicates whether the EIP is ready ip: type: string + description: IP address assigned to the EIP nat: type: string + description: NAT configuration status redo: type: string + description: Redo operation status qosPolicy: type: string + description: QoS policy applied to the EIP conditions: type: array + description: Conditions represent the latest available observations of the EIP's current state items: type: object properties: type: type: string + description: Type of condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: v4ip: type: string + description: IPv4 address for the EIP v6ip: type: string + description: IPv6 address for the EIP macAddress: type: string + description: MAC address for the EIP natGwDp: type: string + description: NAT gateway datapath where the EIP is assigned qosPolicy: type: string + description: QoS policy name to apply to the EIP externalSubnet: type: string + description: External subnet name. This field is immutable after creation. --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1381,40 +1506,55 @@ spec: properties: ready: type: boolean + description: Indicates whether the FIP rule is ready v4ip: type: string + description: IPv4 address of the EIP v6ip: type: string + description: IPv6 address of the EIP natGwDp: type: string + description: NAT gateway datapath where the FIP is configured redo: type: string + description: Redo operation status internalIp: type: string + description: Internal IP address mapped to the FIP conditions: type: array + description: Conditions represent the latest available observations of the FIP rule's current state items: type: object properties: type: type: string + description: Type of condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: eip: type: string + description: EIP name to use for floating IP internalIp: type: string + description: Internal IP address to map to the floating IP --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1473,52 +1613,73 @@ spec: properties: ready: type: boolean + description: Indicates whether the DNAT rule is ready v4ip: type: string + description: IPv4 address of the EIP v6ip: type: string + description: IPv6 address of the EIP natGwDp: type: string + description: NAT gateway datapath where the DNAT rule is configured redo: type: string + description: Redo operation status protocol: type: string + description: Protocol type of the DNAT rule internalIp: type: string + description: Internal IP address configured in the DNAT rule internalPort: type: string + description: Internal port configured in the DNAT rule externalPort: type: string + description: External port configured in the DNAT rule conditions: type: array + description: Conditions represent the latest available observations of the DNAT rule's current state items: type: object properties: type: type: string + description: Type of condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: eip: type: string + description: EIP name for DNAT rule externalPort: type: string + description: External port number protocol: type: string + description: Protocol type (TCP or UDP) internalIp: type: string + description: Internal IP address to forward traffic to internalPort: type: string + description: Internal port number to forward traffic to --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1568,40 +1729,55 @@ spec: properties: ready: type: boolean + description: Indicates whether the SNAT rule is ready v4ip: type: string + description: IPv4 address of the EIP v6ip: type: string + description: IPv6 address of the EIP natGwDp: type: string + description: NAT gateway datapath where the SNAT rule is configured redo: type: string + description: Redo operation status internalCIDR: type: string + description: Internal CIDR configured in the SNAT rule conditions: type: array + description: Conditions represent the latest available observations of the SNAT rule's current state items: type: object properties: type: type: string + description: Type of condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: eip: type: string + description: EIP name for SNAT rule internalCIDR: type: string + description: Internal CIDR to be translated via SNAT --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1654,46 +1830,64 @@ spec: properties: type: type: string + description: Type of the OVN EIP nat: type: string + description: NAT configuration status ready: type: boolean + description: Indicates whether the EIP is ready v4Ip: type: string + description: IPv4 address assigned to the EIP v6Ip: type: string + description: IPv6 address assigned to the EIP macAddress: type: string + description: MAC address assigned to the EIP conditions: type: array + description: Conditions represent the latest available observations of the EIP's current state items: type: object properties: type: type: string + description: Type of condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: externalSubnet: type: string + description: External subnet name. This field is immutable after creation. type: type: string + description: Type of the OVN EIP (e.g., normal, distributed) v4Ip: type: string + description: IPv4 address for the EIP v6Ip: type: string + description: IPv6 address for the EIP macAddress: type: string + description: MAC address for the EIP --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1752,50 +1946,70 @@ spec: properties: ready: type: boolean + description: Indicates whether the FIP is ready v4Eip: type: string + description: IPv4 EIP address assigned v6Eip: type: string + description: IPv6 EIP address assigned v4Ip: type: string + description: IPv4 address mapped to the FIP v6Ip: type: string + description: IPv6 address mapped to the FIP vpc: type: string + description: VPC name where the FIP is configured conditions: type: array + description: Conditions represent the latest available observations of the FIP's current state items: type: object properties: type: type: string + description: Type of condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: ovnEip: type: string + description: OVN EIP name to use for floating IP ipType: type: string + description: IP type (e.g., ipv4, ipv6, dual) type: type: string + description: FIP type ipName: type: string + description: IP resource name vpc: type: string + description: VPC name. This field is immutable after creation. v4Ip: type: string + description: IPv4 address for the floating IP v6Ip: type: string + description: IPv6 address for the floating IP --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1845,48 +2059,67 @@ spec: properties: ready: type: boolean + description: Indicates whether the SNAT rule is ready v4Eip: type: string + description: IPv4 EIP address assigned v6Eip: type: string + description: IPv6 EIP address assigned v4IpCidr: type: string + description: IPv4 CIDR configured in the SNAT rule v6IpCidr: type: string + description: IPv6 CIDR configured in the SNAT rule vpc: type: string + description: VPC name where the SNAT rule is configured conditions: type: array + description: Conditions represent the latest available observations of the SNAT rule's current state items: type: object properties: type: type: string + description: Type of condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: ovnEip: type: string + description: OVN EIP name for SNAT rule vpcSubnet: type: string + description: VPC subnet name for SNAT ipName: type: string + description: IP resource name vpc: type: string + description: VPC name. This field is immutable after creation. v4IpCidr: type: string + description: IPv4 CIDR for SNAT v6IpCidr: type: string + description: IPv6 CIDR for SNAT --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1951,62 +2184,88 @@ spec: properties: ready: type: boolean + description: Indicates whether the DNAT rule is ready v4Eip: type: string + description: IPv4 EIP address assigned v6Eip: type: string + description: IPv6 EIP address assigned v4Ip: type: string + description: IPv4 address configured in the DNAT rule v6Ip: type: string + description: IPv6 address configured in the DNAT rule vpc: type: string + description: VPC name where the DNAT rule is configured externalPort: type: string + description: External port configured in the DNAT rule internalPort: type: string + description: Internal port configured in the DNAT rule protocol: type: string + description: Protocol type configured in the DNAT rule ipName: type: string + description: IP resource name conditions: type: array + description: Conditions represent the latest available observations of the DNAT rule's current state items: type: object properties: type: type: string + description: Type of condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: ovnEip: type: string + description: OVN EIP name for DNAT rule ipType: type: string + description: IP type (e.g., ipv4, ipv6, dual) ipName: type: string + description: IP resource name externalPort: type: string + description: External port number internalPort: type: string + description: Internal port number to forward traffic to protocol: type: string + description: Protocol type (TCP or UDP) vpc: type: string + description: VPC name. This field is immutable after creation. v4Ip: type: string + description: IPv4 address for DNAT v6Ip: type: string + description: IPv6 address for DNAT --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -2045,19 +2304,25 @@ spec: properties: defaultSubnet: type: string + description: The default subnet name for the VPC enableExternal: type: boolean + description: Enable external network access for the VPC enableBfd: type: boolean + description: Enable BFD (Bidirectional Forwarding Detection) for the VPC namespaces: + description: List of namespaces that can use this VPC items: type: string type: array extraExternalSubnets: + description: Extra external subnets for provider-network VLAN. Immutable after creation. items: type: string type: array staticRoutes: + description: Static routes for the VPC. items: properties: policy: @@ -2075,10 +2340,14 @@ spec: type: object type: array policyRoutes: + description: Policy routes for the VPC. items: properties: priority: type: integer + description: Priority of the policy route (0-32767) + min: 0 + max: 32767 action: type: string match: @@ -2088,6 +2357,7 @@ spec: type: object type: array vpcPeerings: + description: VPC peering configurations. items: properties: remoteVpc: @@ -2100,9 +2370,11 @@ spec: properties: enabled: type: boolean + description: Enable BFD port default: false ip: type: string + description: IP address for BFD port (IPv4, IPv6, or comma-separated pair) anyOf: - pattern: ^$ - pattern: ^(?:(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])$ @@ -2116,8 +2388,10 @@ spec: properties: key: type: string + description: Label key operator: type: string + description: Label operator enum: - In - NotIn @@ -2162,6 +2436,7 @@ spec: type: object type: array default: + description: Whether this is the default subnet. type: boolean defaultLogicalSwitch: type: string @@ -2178,10 +2453,12 @@ spec: type: string type: array extraExternalSubnets: + description: Extra external subnets for provider-network VLAN. Immutable after creation. items: type: string type: array vpcPeerings: + description: VPC peering configurations. items: type: string type: array @@ -2202,10 +2479,13 @@ spec: properties: ip: type: string + description: BFD port IP address name: type: string + description: BFD port name nodes: type: array + description: Nodes where BFD port is deployed items: type: string type: object @@ -2258,36 +2538,49 @@ spec: properties: podName: type: string + description: Pod name that this IP belongs to namespace: type: string + description: Namespace of the pod subnet: type: string + description: Primary subnet name for the IP. This field is immutable after creation. attachSubnets: type: array + description: Additional attached subnets items: type: string nodeName: type: string + description: Node name where the pod resides ipAddress: type: string + description: IP address (deprecated, use v4IpAddress or v6IpAddress) v4IpAddress: type: string + description: IPv4 address v6IpAddress: type: string + description: IPv6 address attachIps: type: array + description: Additional IP addresses from attached subnets items: type: string macAddress: type: string + description: MAC address for the primary IP attachMacs: type: array + description: MAC addresses for attached IPs items: type: string containerID: type: string + description: Container ID podType: type: string + description: Pod type (e.g., pod, vm) scope: Cluster names: plural: ips @@ -2315,6 +2608,9 @@ spec: served: true storage: true additionalPrinterColumns: + - name: Namespace + type: string + jsonPath: .spec.namespace - name: V4IP type: string jsonPath: .status.v4ip @@ -2339,56 +2635,74 @@ spec: properties: type: type: string - ready: - type: boolean + description: Type of VIP (e.g., Layer2, HealthCheck) v4ip: type: string + description: Allocated IPv4 address v6ip: type: string + description: Allocated IPv6 address mac: type: string + description: MAC address associated with the VIP selector: type: array + description: Pod names selected by this VIP items: type: string conditions: type: array + description: Conditions represent the latest state of the VIP items: type: object properties: type: type: string + description: Type of the condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: namespace: type: string + description: Namespace where the VIP is created. This field is immutable after creation. subnet: type: string + description: Subnet name for the VIP. This field is immutable after creation. type: type: string + description: Type of VIP. This field is immutable after creation. attachSubnets: type: array + description: Additional subnets to attach items: type: string v4ip: type: string + description: Specific IPv4 address to use (optional, will be allocated if not specified) macAddress: type: string + description: MAC address for the VIP v6ip: type: string + description: Specific IPv6 address to use (optional, will be allocated if not specified) selector: type: array + description: Pod names to be selected by this VIP items: type: string --- @@ -2478,6 +2792,7 @@ spec: dhcpV6OptionsUUID: type: string u2oInterconnectionIP: + description: Underlay to overlay interconnection IP. type: string u2oInterconnectionMAC: type: string @@ -2496,6 +2811,7 @@ spec: v6availableIPrange: type: string natOutgoingPolicyRules: + description: NAT outgoing policy rules. type: array items: type: object @@ -2535,50 +2851,89 @@ spec: type: object properties: vpc: + description: VPC name for the subnet. Immutable after creation. type: string default: + description: Whether this is the default subnet. type: boolean protocol: + description: Network protocol (IPv4, IPv6, or Dual). Immutable after creation. type: string enum: - IPv4 - IPv6 - Dual cidrBlock: + description: CIDR block for the subnet. Immutable after creation. type: string namespaces: + description: List of namespaces associated with this subnet. type: array items: type: string gateway: + description: Gateway IP address for the subnet. type: string provider: + description: Provider network name. type: string excludeIps: + description: IP addresses to exclude from allocation. type: array items: type: string vips: + description: Virtual IP addresses for the subnet. type: array items: type: string gatewayType: + description: Gateway type (distributed or centralized). type: string allowSubnets: + description: Allowed subnets for east-west traffic. type: array items: type: string gatewayNode: + description: Gateway node for centralized gateway mode. type: string + gatewayNodeSelectors: + description: Node selectors for gateway placement. + type: array + items: + type: object + properties: + matchLabels: + type: object + additionalProperties: + type: string + matchExpressions: + type: array + items: + type: object + properties: + key: + type: string + operator: + type: string + values: + type: array + items: + type: string natOutgoing: + description: Enable NAT for outgoing traffic. type: boolean externalEgressGateway: + description: External egress gateway for the subnet. type: string policyRoutingPriority: + description: Policy routing priority. type: integer minimum: 1 maximum: 32765 policyRoutingTableID: + description: Policy routing table ID. type: integer minimum: 1 maximum: 2147483647 @@ -2589,32 +2944,45 @@ spec: - 254 # main - 255 # local mtu: + description: Maximum transmission unit for the subnet. type: integer minimum: 68 maximum: 65535 private: + description: Whether the subnet is private. type: boolean vlan: + description: VLAN ID for the subnet. Immutable after creation. type: string logicalGateway: + description: Whether to use logical gateway. type: boolean disableGatewayCheck: + description: Disable gateway connectivity check. type: boolean disableInterConnection: + description: Disable subnet interconnection. type: boolean enableDHCP: + description: Enable DHCP for the subnet. type: boolean dhcpV4Options: + description: DHCPv4 options for the subnet. type: string dhcpV6Options: + description: DHCPv6 options for the subnet. type: string enableIPv6RA: + description: Enable IPv6 router advertisement. type: boolean ipv6RAConfigs: + description: IPv6 router advertisement configurations. type: string allowEWTraffic: + description: Allow east-west traffic between pods. type: boolean acls: + description: Access control lists for the subnet. type: array items: type: object @@ -2639,6 +3007,7 @@ spec: - drop - reject natOutgoingPolicyRules: + description: NAT outgoing policy rules. type: array items: type: object @@ -2656,20 +3025,28 @@ spec: dstIPs: type: string u2oInterconnection: + description: Enable underlay to overlay interconnection. type: boolean u2oInterconnectionIP: + description: Underlay to overlay interconnection IP. type: string enableLb: + description: Enable load balancer for the subnet. type: boolean enableEcmp: + description: Enable ECMP for the subnet. type: boolean enableMulticastSnoop: + description: Enable multicast snooping. type: boolean enableExternalLBAddress: + description: Enable external load balancer address. type: boolean routeTable: + description: Route table for the subnet. type: string namespaceSelectors: + description: Namespace selectors for subnet association. type: array items: type: object @@ -2691,6 +3068,9 @@ spec: type: array items: type: string + nodeNetwork: + description: Node network for the subnet. + type: string scope: Cluster names: plural: subnets @@ -2715,6 +3095,9 @@ spec: - name: Subnet type: string jsonPath: .spec.subnet + - name: enableAddressSet + type: boolean + jsonPath: .spec.enableAddressSet - name: IPs type: string jsonPath: .spec.ips @@ -2739,10 +3122,12 @@ spec: properties: subnet: type: string + description: Subnet name for the IP pool. This field is immutable. x-kubernetes-validations: - rule: "self == oldSelf" message: "This field is immutable." namespaces: + description: Namespaces that can use this IP pool type: array x-kubernetes-list-type: set items: @@ -2751,6 +3136,7 @@ spec: type: array minItems: 1 x-kubernetes-list-type: set + description: IP addresses or ranges in the pool (IPv4/IPv6 addresses or CIDR ranges) items: type: string anyOf: @@ -2759,6 +3145,10 @@ spec: - format: cidr - pattern: ^(?:(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\.\.(?:(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])$ - pattern: ^((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|:)))\.\.((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|:)))$ + enableAddressSet: + type: boolean + default: false + description: EnableAddressSet to work with policy-based routing and ACL required: - subnet - ips @@ -2767,37 +3157,52 @@ spec: properties: v4AvailableIPs: type: number + description: Number of available IPv4 addresses v4UsingIPs: type: number + description: Number of using IPv4 addresses v6AvailableIPs: type: number + description: Number of available IPv6 addresses v6UsingIPs: type: number + description: Number of using IPv6 addresses v4AvailableIPRange: type: string + description: Available IPv4 address range v4UsingIPRange: type: string + description: IPv4 address range in use v6AvailableIPRange: type: string + description: Available IPv6 address range v6UsingIPRange: type: string + description: IPv6 address range in use conditions: type: array + description: Conditions represent the latest state of the IP pool items: type: object properties: type: type: string + description: Type of the condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another scope: Cluster names: plural: ippools @@ -2827,10 +3232,12 @@ spec: properties: id: type: integer + description: VLAN ID (0-4095). This field is immutable after creation. minimum: 0 maximum: 4095 provider: type: string + description: Provider network name. This field is immutable after creation. vlanId: type: integer description: Deprecated in favor of id @@ -2844,10 +3251,12 @@ spec: properties: subnets: type: array + description: List of subnet names using this VLAN items: type: string conflict: type: boolean + description: Whether there is a conflict with this VLAN additionalPrinterColumns: - name: ID type: string @@ -2896,29 +3305,69 @@ spec: properties: defaultInterface: type: string + description: Default interface name for the provider network. This field is immutable after creation. maxLength: 15 pattern: '^[^/\s]+$' customInterfaces: type: array + description: Custom interface configurations for specific nodes items: type: object properties: interface: type: string + description: Interface name maxLength: 15 pattern: '^[^/\s]+$' nodes: type: array + description: Nodes that use this custom interface items: type: string exchangeLinkName: type: boolean + nodeSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: map + x-kubernetes-list-map-keys: + - key + matchLabels: + additionalProperties: + type: string + type: object + type: object excludeNodes: type: array items: type: string autoCreateVlanSubinterfaces: type: boolean + description: Automatically create VLAN subinterfaces + preserveVlanInterfaces: + type: boolean + description: Enable automatic detection and preservation of VLAN interfaces + vlanInterfaces: + type: array + items: + type: string + pattern: '^[a-zA-Z0-9_-]+\.[0-9]{1,4}$' + description: Optional explicit list of VLAN interface names to preserve (e.g., eth0.10, bond0.20) required: - defaultInterface status: @@ -2926,37 +3375,49 @@ spec: properties: ready: type: boolean + description: Whether the provider network is ready readyNodes: type: array + description: Nodes that are ready items: type: string notReadyNodes: type: array + description: Nodes that are not ready items: type: string vlans: type: array + description: VLANs in use by this provider network items: type: string conditions: type: array + description: Conditions of nodes in the provider network items: type: object properties: node: type: string + description: Node name type: type: string + description: Type of the condition status: type: string + description: Status of the condition reason: type: string + description: Reason for the condition message: type: string + description: Message about the condition lastUpdateTime: type: string + description: Last update time lastTransitionTime: type: string + description: Last transition time additionalPrinterColumns: - name: DefaultInterface type: string @@ -2998,67 +3459,106 @@ spec: properties: ingressRules: type: array + description: Ingress traffic rules for the security group items: type: object properties: ipVersion: type: string + description: IP version (IPv4 or IPv6) protocol: type: string + description: Protocol (tcp, udp, icmp, or all) priority: type: integer + description: Rule priority (1-200) + min: 1 + max: 200 remoteType: type: string + description: Type of remote (address, cidr, or securityGroup) remoteAddress: type: string + description: Remote address or CIDR remoteSecurityGroup: type: string + description: Remote security group name portRangeMin: type: integer + description: Start of port range (1-65535) + min: 1 + max: 65535 portRangeMax: type: integer + description: End of port range (1-65535) + min: 1 + max: 65535 policy: type: string + description: Policy action (allow or deny) egressRules: type: array + description: Egress traffic rules for the security group items: type: object properties: ipVersion: type: string + description: IP version (IPv4 or IPv6) protocol: type: string + description: Protocol (tcp, udp, icmp, or all) priority: type: integer + description: Rule priority (1-200) + min: 1 + max: 200 remoteType: type: string + description: Type of remote (address, cidr, or securityGroup) remoteAddress: type: string + description: Remote address or CIDR remoteSecurityGroup: type: string + description: Remote security group name portRangeMin: type: integer + description: Start of port range (1-65535) + min: 1 + max: 65535 portRangeMax: type: integer + description: End of port range (1-65535) + min: 1 + max: 65535 policy: type: string + description: Policy action (allow or deny) allowSameGroupTraffic: type: boolean + description: Allow traffic between pods in the same security group status: type: object properties: portGroup: type: string + description: OVN port group name allowSameGroupTraffic: type: boolean + description: Current allow same group traffic setting ingressMd5: type: string + description: MD5 hash of ingress rules egressMd5: type: string + description: MD5 hash of egress rules ingressLastSyncSuccess: type: boolean + description: Last ingress sync success status egressLastSyncSuccess: type: boolean + description: Last egress sync success status subresources: status: {} conversion: @@ -3100,74 +3600,103 @@ spec: properties: shared: type: boolean + description: Whether the QoS policy is shared bindingType: type: string + description: Binding type of the QoS policy bandwidthLimitRules: type: array + description: Active bandwidth limit rules items: type: object properties: name: type: string + description: Rule name interface: type: string + description: Interface name rateMax: type: string + description: Maximum rate (e.g., 100Mbps) burstMax: type: string + description: Maximum burst rate priority: type: integer + description: Rule priority direction: type: string + description: Traffic direction (ingress/egress) matchType: type: string + description: Match type matchValue: type: string + description: Match value conditions: type: array + description: Conditions of the QoS policy items: type: object properties: type: type: string + description: Type of the condition status: type: string + description: Status of the condition (True, False, Unknown) reason: type: string + description: Reason for the condition's last transition message: type: string + description: Human-readable message indicating details about the condition lastUpdateTime: type: string + description: Last time this condition was updated lastTransitionTime: type: string + description: Last time the condition transitioned from one status to another spec: type: object properties: shared: type: boolean + description: Whether the QoS policy is shared across multiple pods bindingType: type: string + description: Binding type (e.g., pod, namespace) bandwidthLimitRules: type: array + description: Bandwidth limit rules to apply items: type: object properties: name: type: string + description: Rule name interface: type: string + description: Network interface to apply the rule rateMax: type: string + description: Maximum rate (e.g., 100Mbps, 1Gbps) burstMax: type: string + description: Maximum burst rate priority: type: integer + description: Rule priority for ordering direction: type: string + description: Traffic direction (ingress or egress) matchType: type: string + description: Type of traffic matching (e.g., pod, namespace) matchValue: type: string + description: Value to match for the rule required: - name x-kubernetes-list-map-keys: diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/monitor-deploy.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/monitor-deploy.yaml index dc4eac22..2d498098 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/monitor-deploy.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/monitor-deploy.yaml @@ -81,7 +81,7 @@ spec: env: - name: ENABLE_SSL value: "{{ .Values.networking.ENABLE_SSL }}" - - name: KUBE_NODE_NAME + - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName @@ -110,6 +110,7 @@ spec: limits: cpu: {{ index .Values "kube-ovn-monitor" "limits" "cpu" }} memory: {{ index .Values "kube-ovn-monitor" "limits" "memory" }} + ephemeral-storage: {{ index .Values "kube-ovn-monitor" "limits" "ephemeral-storage" }} volumeMounts: - mountPath: /var/run/ovn name: host-run-ovn diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/ovn-CR.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/ovn-CR.yaml index e89d8d46..1caaecdf 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/ovn-CR.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovn-CR.yaml @@ -48,10 +48,18 @@ rules: - switch-lb-rules/status - vpc-dnses - vpc-dnses/status + - dnsnameresolvers + - dnsnameresolvers/status - qos-policies - qos-policies/status verbs: - - "*" + - create + - get + - list + - update + - patch + - watch + - delete - apiGroups: - "" resources: @@ -84,6 +92,8 @@ rules: - network-attachment-definitions verbs: - get + - list + - watch - apiGroups: - "" - networking.k8s.io @@ -166,7 +176,11 @@ rules: resources: - leases verbs: - - "*" + - create + - update + - patch + - get + - watch - apiGroups: - "kubevirt.io" resources: @@ -181,6 +195,7 @@ rules: resources: - adminnetworkpolicies - baselineadminnetworkpolicies + - clusternetworkpolicies verbs: - get - list @@ -276,7 +291,6 @@ rules: verbs: - get - list - --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -355,12 +369,23 @@ rules: - "list" - "watch" - "delete" - - apiGroups: - - "" - resources: - - "secrets" - verbs: - - "get" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: secret-reader-ovn-ipsec + namespace: {{ .Values.namespace }} +rules: +- apiGroups: + - "" + resources: + - "secrets" + resourceNames: + - "ovn-ipsec-ca" + verbs: + - "get" + - "list" + - "watch" --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/ovn-CRB.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/ovn-CRB.yaml index 7cc43d84..638093ba 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/ovn-CRB.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovn-CRB.yaml @@ -67,6 +67,20 @@ subjects: namespace: {{ .Values.namespace }} --- apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kube-ovn-cni-secret-reader + namespace: {{ .Values.namespace }} +subjects: +- kind: ServiceAccount + name: kube-ovn-cni + namespace: {{ .Values.namespace }} +roleRef: + kind: Role + name: secret-reader-ovn-ipsec + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: kube-ovn-app diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/ovn-dpdk-ds.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/ovn-dpdk-ds.yaml index 330c9b6f..5e18230e 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/ovn-dpdk-ds.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovn-dpdk-ds.yaml @@ -54,7 +54,7 @@ spec: value: "{{- .Values.networking.TUNNEL_TYPE }}" - name: DPDK_TUNNEL_IFACE value: "{{- .Values.networking.DPDK_TUNNEL_IFACE }}" - - name: KUBE_NODE_NAME + - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml index d53c06c2..8be8eba6 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml @@ -98,9 +98,13 @@ spec: - --mirror-iface={{- .Values.debug.MIRROR_IFACE }} - --node-switch={{ .Values.networking.NODE_SUBNET }} - --encap-checksum=true - - --service-cluster-ip-range={{ .Values.ipv4.SVC_CIDR }} - {{- if .Values.global.logVerbosity }} - - --v={{ .Values.global.logVerbosity }} + - --service-cluster-ip-range= + {{- if eq .Values.networking.NET_STACK "dual_stack" -}} + {{ .Values.dual_stack.SVC_CIDR }} + {{- else if eq .Values.networking.NET_STACK "ipv4" -}} + {{ .Values.ipv4.SVC_CIDR }} + {{- else if eq .Values.networking.NET_STACK "ipv6" -}} + {{ .Values.ipv6.SVC_CIDR }} {{- end }} {{- if eq .Values.networking.NETWORK_TYPE "vlan" }} - --iface= @@ -121,9 +125,7 @@ spec: - --secure-serving={{- .Values.func.SECURE_SERVING }} - --enable-ovn-ipsec={{- .Values.func.ENABLE_OVN_IPSEC }} - --set-vxlan-tx-off={{- .Values.func.SET_VXLAN_TX_OFF }} - {{- with .Values.mtu }} - - --mtu={{ . }} - {{- end }} + - --non-primary-cni-mode={{- .Values.cni_conf.NON_PRIMARY_CNI }} securityContext: runAsUser: 0 privileged: false @@ -142,7 +144,7 @@ spec: valueFrom: fieldRef: fieldPath: status.podIP - - name: KUBE_NODE_NAME + - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName @@ -226,6 +228,7 @@ spec: limits: cpu: {{ index .Values "kube-ovn-cni" "limits" "cpu" }} memory: {{ index .Values "kube-ovn-cni" "limits" "memory" }} + ephemeral-storage: {{ index .Values "kube-ovn-cni" "limits" "ephemeral-storage" }} nodeSelector: kubernetes.io/os: "linux" volumes: diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/ovsovn-ds.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/ovsovn-ds.yaml index 7146ec71..b15fd24e 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/ovsovn-ds.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovsovn-ds.yaml @@ -115,7 +115,7 @@ spec: value: "{{- .Values.func.HW_OFFLOAD }}" - name: TUNNEL_TYPE value: "{{- .Values.networking.TUNNEL_TYPE }}" - - name: KUBE_NODE_NAME + - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName @@ -173,6 +173,7 @@ spec: limits: cpu: {{ index .Values "ovs-ovn" "limits" "cpu" }} memory: {{ index .Values "ovs-ovn" "limits" "memory" }} + ephemeral-storage: {{ index .Values "ovs-ovn" "limits" "ephemeral-storage" }} nodeSelector: kubernetes.io/os: "linux" volumes: diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/pinger-ds.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/pinger-ds.yaml index fbc82171..e52cf45d 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/pinger-ds.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/pinger-ds.yaml @@ -73,7 +73,6 @@ spec: {{- else if eq .Values.networking.NET_STACK "ipv6" -}} {{ .Values.ipv6.PINGER_EXTERNAL_DOMAIN }} {{- end }} - - --ds-namespace={{ .Values.namespace }} - --logtostderr=false - --alsologtostderr=true - --log_file=/var/log/kube-ovn/kube-ovn-pinger.log @@ -102,6 +101,10 @@ spec: valueFrom: fieldRef: fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace - name: NODE_NAME valueFrom: fieldRef: @@ -133,6 +136,7 @@ spec: limits: cpu: {{ index .Values "kube-ovn-pinger" "limits" "cpu" }} memory: {{ index .Values "kube-ovn-pinger" "limits" "memory" }} + ephemeral-storage: {{ index .Values "kube-ovn-pinger" "limits" "ephemeral-storage" }} livenessProbe: httpGet: path: /metrics diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/post-delete-hook.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/post-delete-hook.yaml index 682b5a96..1272257f 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/post-delete-hook.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/post-delete-hook.yaml @@ -120,6 +120,14 @@ spec: - sh - -c - /kube-ovn/remove-finalizer.sh 2>&1 | tee -a /var/log/kube-ovn/remove-finalizer.log + resources: + requests: + cpu: 100m + memory: 200Mi + limits: + cpu: 1 + memory: 500Mi + ephemeral-storage: 1Gi volumeMounts: - mountPath: /var/log/kube-ovn name: kube-ovn-log diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/upgrade-ovs-ovn.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/upgrade-ovs-ovn.yaml index ab646e03..b85ce8fa 100644 --- a/packages/system/kubeovn/charts/kube-ovn/templates/upgrade-ovs-ovn.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/upgrade-ovs-ovn.yaml @@ -31,6 +31,8 @@ rules: - daemonsets verbs: - list + - get + - watch - apiGroups: - apps resources: diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/vpc-nat-config.yaml b/packages/system/kubeovn/charts/kube-ovn/templates/vpc-nat-config.yaml index ae9a0ce8..92e2fd94 100755 --- a/packages/system/kubeovn/charts/kube-ovn/templates/vpc-nat-config.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/templates/vpc-nat-config.yaml @@ -7,7 +7,7 @@ metadata: kubernetes.io/description: | kube-ovn vpc-nat common config data: - image: {{ .Values.global.registry.address }}/{{ .Values.global.images.kubeovn.vpcRepository }}:{{ .Values.global.images.kubeovn.tag }} + image: {{ .Values.global.registry.address }}/{{ .Values.global.images.natgateway.repository }}:{{ or .Values.global.images.natgateway.tag .Values.global.images.kubeovn.tag }} --- kind: ConfigMap diff --git a/packages/system/kubeovn/charts/kube-ovn/values.yaml b/packages/system/kubeovn/charts/kube-ovn/values.yaml index 430ea428..3ffb7750 100644 --- a/packages/system/kubeovn/charts/kube-ovn/values.yaml +++ b/packages/system/kubeovn/charts/kube-ovn/values.yaml @@ -8,10 +8,11 @@ global: images: kubeovn: repository: kube-ovn - vpcRepository: vpc-nat-gateway - tag: v1.14.25 - support_arm: true - thirdparty: true + tag: v1.15.3 + natgateway: + repository: vpc-nat-gateway + # Falls back to the same tag as kubeovn if empty + tag: v1.15.3 image: pullPolicy: IfNotPresent @@ -46,6 +47,8 @@ networking: ENABLE_METRICS: true # comma-separated string of nodelocal DNS ip addresses NODE_LOCAL_DNS_IP: "" + # comma-separated list of destination IP CIDRs that should skip conntrack processing + SKIP_CONNTRACK_DST_CIDRS: "" PROBE_INTERVAL: 180000 OVN_NORTHD_PROBE_INTERVAL: 5000 OVN_LEADER_PROBE_INTERVAL: 5 @@ -57,6 +60,7 @@ networking: func: ENABLE_LB: true ENABLE_NP: true + NP_ENFORCEMENT: standard ENABLE_EXTERNAL_VPC: false HW_OFFLOAD: false ENABLE_LB_SVC: false @@ -73,6 +77,7 @@ func: ENABLE_NAT_GW: true ENABLE_OVN_IPSEC: false ENABLE_ANP: false + ENABLE_DNS_NAME_RESOLVER: false SET_VXLAN_TX_OFF: false OVSDB_CON_TIMEOUT: 3 OVSDB_INACTIVITY_TIMEOUT: 10 @@ -80,6 +85,10 @@ func: ENABLE_OVN_LB_PREFER_LOCAL: false ipv4: + POD_CIDR: "10.16.0.0/16" + POD_GATEWAY: "10.16.0.1" + SVC_CIDR: "10.96.0.0/12" + JOIN_CIDR: "100.64.0.0/16" PINGER_EXTERNAL_ADDRESS: "1.1.1.1" PINGER_EXTERNAL_DOMAIN: "kube-ovn.io." @@ -116,6 +125,7 @@ cni_conf: CNI_CONF_FILE: "/kube-ovn/01-kube-ovn.conflist" LOCAL_BIN_DIR: "/usr/local/bin" MOUNT_LOCAL_BIN_DIR: false + NON_PRIMARY_CNI: false kubelet_conf: KUBELET_DIR: "/var/lib/kubelet" @@ -135,7 +145,7 @@ fullnameOverride: "" HYBRID_DPDK: false HUGEPAGE_SIZE_TYPE: hugepages-2Mi # Default HUGEPAGES: 1Gi -DPDK_IMAGE_TAG: "v1.14.0-dpdk" +DPDK_IMAGE_TAG: "v1.15.0-dpdk" DPDK_CPU: "1000m" # Default CPU configuration DPDK_MEMORY: "2Gi" # Default Memory configuration @@ -146,6 +156,7 @@ ovn-central: limits: cpu: "3" memory: "4Gi" + ephemeral-storage: 1Gi ovs-ovn: requests: cpu: "200m" @@ -153,6 +164,7 @@ ovs-ovn: limits: cpu: "2" memory: "1000Mi" + ephemeral-storage: 1Gi kube-ovn-controller: requests: cpu: "200m" @@ -160,6 +172,7 @@ kube-ovn-controller: limits: cpu: "1000m" memory: "1Gi" + ephemeral-storage: 1Gi kube-ovn-cni: requests: cpu: "100m" @@ -167,6 +180,7 @@ kube-ovn-cni: limits: cpu: "1000m" memory: "1Gi" + ephemeral-storage: 1Gi kube-ovn-pinger: requests: cpu: "100m" @@ -174,6 +188,7 @@ kube-ovn-pinger: limits: cpu: "200m" memory: "400Mi" + ephemeral-storage: 1Gi kube-ovn-monitor: requests: cpu: "200m" @@ -181,3 +196,4 @@ kube-ovn-monitor: limits: cpu: "200m" memory: "200Mi" + ephemeral-storage: 1Gi diff --git a/packages/system/kubeovn/values.yaml b/packages/system/kubeovn/values.yaml index 700960ee..6911f8aa 100644 --- a/packages/system/kubeovn/values.yaml +++ b/packages/system/kubeovn/values.yaml @@ -65,4 +65,4 @@ global: images: kubeovn: repository: kubeovn - tag: v1.14.25@sha256:d0b29daaf36e81cac0f9fb15d0ea6b1b49f1abba81a14c73b88a2e60ffcc5978 + tag: v1.15.3@sha256:fa53d5f254f640cb626329ad35d9e7aad647dd8e1e645e68f3f13c3659472a30