[cilium] Update Cilium to v1.18.5 (#1769)
## What this PR does - Update Cilium from v1.17.8 to v1.18.5 - Add `SED_INPLACE` variable to `scripts/common-envs.mk` for macOS compatibility - Remove deprecated `enableRuntimeDeviceDetection` option (now default behavior in 1.18) Cilium 1.18 requires Linux kernel 5.10+ (compatible with Talos). References: - [Cilium 1.18 Upgrade Guide](https://docs.cilium.io/en/stable/operations/upgrade/) - [Cilium 1.18 Release Blog](https://isovalent.com/blog/post/cilium-1-18/) ### Release note ```release-note [cilium] Update Cilium to v1.18.5 ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added configurable Kubernetes service discovery with ConfigMap-based endpoint source * Introduced exponential backoff settings for Kubernetes API client connections * Added metrics sampling interval configuration for internal agent metrics * Implemented identity management mode options for endpoint slices and DNS proxy pre-allocation * Enhanced Prometheus scrape timeout configuration across monitoring components * **Improvements** * Upgraded core components to v1.18.5 * Strengthened security defaults by disabling privilege escalation across pods * Added startup and liveness probe configurations for improved health monitoring * Extended network policy correlation capabilities in Hubble <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Aleksei Sviridkin
Andrei Kvapil
parent
654eb7c3f9
commit
f3c178e30d
82 changed files with 2605 additions and 1992 deletions
|
|
@ -10,10 +10,10 @@ update:
|
|||
rm -rf charts
|
||||
helm repo add cilium https://helm.cilium.io/
|
||||
helm repo update cilium
|
||||
helm pull cilium/cilium --untar --untardir charts --version 1.17
|
||||
sed -i -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
|
||||
helm pull cilium/cilium --untar --untardir charts --version 1.18
|
||||
$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
|
||||
version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
|
||||
sed -i "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
|
||||
$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
|
||||
|
||||
image:
|
||||
docker buildx build images/cilium \
|
||||
|
|
|
|||
|
|
@ -7,67 +7,64 @@ annotations:
|
|||
ciliumclusterwidenetworkpolicies.cilium.io\n displayName: Cilium Clusterwide
|
||||
Network Policy\n description: |\n Cilium Clusterwide Network Policies support
|
||||
configuring network traffic\n policiies across the entire cluster, including
|
||||
applying node firewalls.\n- kind: CiliumExternalWorkload\n version: v2\n name:
|
||||
ciliumexternalworkloads.cilium.io\n displayName: Cilium External Workload\n description:
|
||||
|\n Cilium External Workload supports configuring the ability for external\n
|
||||
\ non-Kubernetes workloads to join the cluster.\n- kind: CiliumLocalRedirectPolicy\n
|
||||
\ version: v2\n name: ciliumlocalredirectpolicies.cilium.io\n displayName: Cilium
|
||||
Local Redirect Policy\n description: |\n Cilium Local Redirect Policy allows
|
||||
local redirects to be configured\n within a node to support use cases like
|
||||
Node-Local DNS or KIAM.\n- kind: CiliumNode\n version: v2\n name: ciliumnodes.cilium.io\n
|
||||
\ displayName: Cilium Node\n description: |\n Cilium Node represents a node
|
||||
managed by Cilium. It contains a\n specification to control various node specific
|
||||
configuration aspects\n and a status section to represent the status of the
|
||||
node.\n- kind: CiliumIdentity\n version: v2\n name: ciliumidentities.cilium.io\n
|
||||
\ displayName: Cilium Identity\n description: |\n Cilium Identity allows introspection
|
||||
into security identities that\n Cilium allocates which identify sets of labels
|
||||
that are assigned to\n individual endpoints in the cluster.\n- kind: CiliumEndpoint\n
|
||||
\ version: v2\n name: ciliumendpoints.cilium.io\n displayName: Cilium Endpoint\n
|
||||
\ description: |\n Cilium Endpoint represents the status of individual pods
|
||||
or nodes in\n the cluster which are managed by Cilium, including enforcement
|
||||
status,\n IP addressing and whether the networking is successfully operational.\n-
|
||||
kind: CiliumEndpointSlice\n version: v2alpha1\n name: ciliumendpointslices.cilium.io\n
|
||||
\ displayName: Cilium Endpoint Slice\n description: |\n Cilium Endpoint Slice
|
||||
represents the status of groups of pods or nodes\n in the cluster which are
|
||||
managed by Cilium, including enforcement status,\n IP addressing and whether
|
||||
the networking is successfully operational.\n- kind: CiliumEgressGatewayPolicy\n
|
||||
\ version: v2\n name: ciliumegressgatewaypolicies.cilium.io\n displayName: Cilium
|
||||
Egress Gateway Policy\n description: |\n Cilium Egress Gateway Policy provides
|
||||
control over the way that traffic\n leaves the cluster and which source addresses
|
||||
to use for that traffic.\n- kind: CiliumClusterwideEnvoyConfig\n version: v2\n
|
||||
\ name: ciliumclusterwideenvoyconfigs.cilium.io\n displayName: Cilium Clusterwide
|
||||
Envoy Config\n description: |\n Cilium Clusterwide Envoy Config specifies
|
||||
Envoy resources and K8s service mappings\n to be provisioned into Cilium host
|
||||
proxy instances in cluster context.\n- kind: CiliumEnvoyConfig\n version: v2\n
|
||||
\ name: ciliumenvoyconfigs.cilium.io\n displayName: Cilium Envoy Config\n description:
|
||||
|\n Cilium Envoy Config specifies Envoy resources and K8s service mappings\n
|
||||
\ to be provisioned into Cilium host proxy instances in namespace context.\n-
|
||||
kind: CiliumNodeConfig\n version: v2\n name: ciliumnodeconfigs.cilium.io\n displayName:
|
||||
Cilium Node Configuration\n description: |\n CiliumNodeConfig is a list of
|
||||
configuration key-value pairs. It is applied to\n nodes indicated by a label
|
||||
selector.\n- kind: CiliumBGPPeeringPolicy\n version: v2alpha1\n name: ciliumbgppeeringpolicies.cilium.io\n
|
||||
\ displayName: Cilium BGP Peering Policy\n description: |\n Cilium BGP Peering
|
||||
Policy instructs Cilium to create specific BGP peering\n configurations.\n-
|
||||
kind: CiliumBGPClusterConfig\n version: v2alpha1\n name: ciliumbgpclusterconfigs.cilium.io\n
|
||||
\ displayName: Cilium BGP Cluster Config\n description: |\n Cilium BGP Cluster
|
||||
Config instructs Cilium operator to create specific BGP cluster\n configurations.\n-
|
||||
kind: CiliumBGPPeerConfig\n version: v2alpha1\n name: ciliumbgppeerconfigs.cilium.io\n
|
||||
\ displayName: Cilium BGP Peer Config\n description: |\n CiliumBGPPeerConfig
|
||||
is a common set of BGP peer configurations. It can be referenced \n by multiple
|
||||
peers from CiliumBGPClusterConfig.\n- kind: CiliumBGPAdvertisement\n version:
|
||||
v2alpha1\n name: ciliumbgpadvertisements.cilium.io\n displayName: Cilium BGP
|
||||
Advertisement\n description: |\n CiliumBGPAdvertisement is used to define
|
||||
source of BGP advertisement as well as BGP attributes \n to be advertised with
|
||||
those prefixes.\n- kind: CiliumBGPNodeConfig\n version: v2alpha1\n name: ciliumbgpnodeconfigs.cilium.io\n
|
||||
\ displayName: Cilium BGP Node Config\n description: |\n CiliumBGPNodeConfig
|
||||
is read only node specific BGP configuration. It is constructed by Cilium operator.\n
|
||||
\ It will also contain node local BGP state information.\n- kind: CiliumBGPNodeConfigOverride\n
|
||||
\ version: v2alpha1\n name: ciliumbgpnodeconfigoverrides.cilium.io\n displayName:
|
||||
Cilium BGP Node Config Override\n description: |\n CiliumBGPNodeConfigOverride
|
||||
can be used to override node specific BGP configuration.\n- kind: CiliumLoadBalancerIPPool\n
|
||||
\ version: v2alpha1\n name: ciliumloadbalancerippools.cilium.io\n displayName:
|
||||
Cilium Load Balancer IP Pool\n description: |\n Defining a Cilium Load Balancer
|
||||
IP Pool instructs Cilium to assign IPs to LoadBalancer Services.\n- kind: CiliumCIDRGroup\n
|
||||
applying node firewalls.\n- kind: CiliumLocalRedirectPolicy\n version: v2\n name:
|
||||
ciliumlocalredirectpolicies.cilium.io\n displayName: Cilium Local Redirect Policy\n
|
||||
\ description: |\n Cilium Local Redirect Policy allows local redirects to be
|
||||
configured\n within a node to support use cases like Node-Local DNS.\n- kind:
|
||||
CiliumNode\n version: v2\n name: ciliumnodes.cilium.io\n displayName: Cilium
|
||||
Node\n description: |\n Cilium Node represents a node managed by Cilium. It
|
||||
contains a\n specification to control various node specific configuration aspects\n
|
||||
\ and a status section to represent the status of the node.\n- kind: CiliumIdentity\n
|
||||
\ version: v2\n name: ciliumidentities.cilium.io\n displayName: Cilium Identity\n
|
||||
\ description: |\n Cilium Identity allows introspection into security identities
|
||||
that\n Cilium allocates which identify sets of labels that are assigned to\n
|
||||
\ individual endpoints in the cluster.\n- kind: CiliumEndpoint\n version: v2\n
|
||||
\ name: ciliumendpoints.cilium.io\n displayName: Cilium Endpoint\n description:
|
||||
|\n Cilium Endpoint represents the status of individual pods or nodes in\n
|
||||
\ the cluster which are managed by Cilium, including enforcement status,\n IP
|
||||
addressing and whether the networking is successfully operational.\n- kind: CiliumEndpointSlice\n
|
||||
\ version: v2alpha1\n name: ciliumendpointslices.cilium.io\n displayName: Cilium
|
||||
Endpoint Slice\n description: |\n Cilium Endpoint Slice represents the status
|
||||
of groups of pods or nodes\n in the cluster which are managed by Cilium, including
|
||||
enforcement status,\n IP addressing and whether the networking is successfully
|
||||
operational.\n- kind: CiliumEgressGatewayPolicy\n version: v2\n name: ciliumegressgatewaypolicies.cilium.io\n
|
||||
\ displayName: Cilium Egress Gateway Policy\n description: |\n Cilium Egress
|
||||
Gateway Policy provides control over the way that traffic\n leaves the cluster
|
||||
and which source addresses to use for that traffic.\n- kind: CiliumClusterwideEnvoyConfig\n
|
||||
\ version: v2\n name: ciliumclusterwideenvoyconfigs.cilium.io\n displayName:
|
||||
Cilium Clusterwide Envoy Config\n description: |\n Cilium Clusterwide Envoy
|
||||
Config specifies Envoy resources and K8s service mappings\n to be provisioned
|
||||
into Cilium host proxy instances in cluster context.\n- kind: CiliumEnvoyConfig\n
|
||||
\ version: v2\n name: ciliumenvoyconfigs.cilium.io\n displayName: Cilium Envoy
|
||||
Config\n description: |\n Cilium Envoy Config specifies Envoy resources and
|
||||
K8s service mappings\n to be provisioned into Cilium host proxy instances in
|
||||
namespace context.\n- kind: CiliumNodeConfig\n version: v2\n name: ciliumnodeconfigs.cilium.io\n
|
||||
\ displayName: Cilium Node Configuration\n description: |\n CiliumNodeConfig
|
||||
is a list of configuration key-value pairs. It is applied to\n nodes indicated
|
||||
by a label selector.\n- kind: CiliumBGPPeeringPolicy\n version: v2alpha1\n name:
|
||||
ciliumbgppeeringpolicies.cilium.io\n displayName: Cilium BGP Peering Policy\n
|
||||
\ description: |\n Cilium BGP Peering Policy instructs Cilium to create specific
|
||||
BGP peering\n configurations.\n- kind: CiliumBGPClusterConfig\n version: v2alpha1\n
|
||||
\ name: ciliumbgpclusterconfigs.cilium.io\n displayName: Cilium BGP Cluster Config\n
|
||||
\ description: |\n Cilium BGP Cluster Config instructs Cilium operator to create
|
||||
specific BGP cluster\n configurations.\n- kind: CiliumBGPPeerConfig\n version:
|
||||
v2alpha1\n name: ciliumbgppeerconfigs.cilium.io\n displayName: Cilium BGP Peer
|
||||
Config\n description: |\n CiliumBGPPeerConfig is a common set of BGP peer
|
||||
configurations. It can be referenced \n by multiple peers from CiliumBGPClusterConfig.\n-
|
||||
kind: CiliumBGPAdvertisement\n version: v2alpha1\n name: ciliumbgpadvertisements.cilium.io\n
|
||||
\ displayName: Cilium BGP Advertisement\n description: |\n CiliumBGPAdvertisement
|
||||
is used to define source of BGP advertisement as well as BGP attributes \n to
|
||||
be advertised with those prefixes.\n- kind: CiliumBGPNodeConfig\n version: v2alpha1\n
|
||||
\ name: ciliumbgpnodeconfigs.cilium.io\n displayName: Cilium BGP Node Config\n
|
||||
\ description: |\n CiliumBGPNodeConfig is read only node specific BGP configuration.
|
||||
It is constructed by Cilium operator.\n It will also contain node local BGP
|
||||
state information.\n- kind: CiliumBGPNodeConfigOverride\n version: v2alpha1\n
|
||||
\ name: ciliumbgpnodeconfigoverrides.cilium.io\n displayName: Cilium BGP Node
|
||||
Config Override\n description: |\n CiliumBGPNodeConfigOverride can be used
|
||||
to override node specific BGP configuration.\n- kind: CiliumLoadBalancerIPPool\n
|
||||
\ version: v2\n name: ciliumloadbalancerippools.cilium.io\n displayName: Cilium
|
||||
Load Balancer IP Pool\n description: |\n Defining a Cilium Load Balancer IP
|
||||
Pool instructs Cilium to assign IPs to LoadBalancer Services.\n- kind: CiliumCIDRGroup\n
|
||||
\ version: v2alpha1\n name: ciliumcidrgroups.cilium.io\n displayName: Cilium
|
||||
CIDR Group\n description: |\n CiliumCIDRGroup is a list of CIDRs that can
|
||||
be referenced as a single entity from CiliumNetworkPolicies.\n- kind: CiliumL2AnnouncementPolicy\n
|
||||
|
|
@ -77,9 +74,12 @@ annotations:
|
|||
area network, by which nodes, and via which interfaces.\n- kind: CiliumPodIPPool\n
|
||||
\ version: v2alpha1\n name: ciliumpodippools.cilium.io\n displayName: Cilium
|
||||
Pod IP Pool\n description: |\n CiliumPodIPPool defines an IP pool that can
|
||||
be used for pooled IPAM (i.e. the multi-pool IPAM mode).\n"
|
||||
be used for pooled IPAM (i.e. the multi-pool IPAM mode).\n- kind: CiliumGatewayClassConfig\n
|
||||
\ version: v2alpha1\n name: ciliumgatewayclassconfigs.cilium.io\n displayName:
|
||||
Cilium Gateway Class Config\n description: |\n CiliumGatewayClassConfig defines
|
||||
a configuration for Gateway API GatewayClass.\n"
|
||||
apiVersion: v2
|
||||
appVersion: 1.17.8
|
||||
appVersion: 1.18.5
|
||||
description: eBPF-based Networking, Security, and Observability
|
||||
home: https://cilium.io/
|
||||
icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg
|
||||
|
|
@ -95,4 +95,4 @@ kubeVersion: '>= 1.21.0-0'
|
|||
name: cilium
|
||||
sources:
|
||||
- https://github.com/cilium/cilium
|
||||
version: 1.17.8
|
||||
version: 1.18.5
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# cilium
|
||||
|
||||
 
|
||||
 
|
||||
|
||||
Cilium is open source software for providing and transparently securing
|
||||
network connectivity and loadbalancing between application workloads such as
|
||||
|
|
@ -73,7 +73,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| authentication.mutual.spire.enabled | bool | `false` | Enable SPIRE integration (beta) |
|
||||
| authentication.mutual.spire.install.agent.affinity | object | `{}` | SPIRE agent affinity configuration |
|
||||
| authentication.mutual.spire.install.agent.annotations | object | `{}` | SPIRE agent annotations |
|
||||
| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:5106ac601272a88684db14daf7f54b9a45f31f77bb16a906bd5e87756ee7b97c","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-agent","tag":"1.9.6","useDigest":true}` | SPIRE agent image |
|
||||
| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:163970884fba18860cac93655dc32b6af85a5dcf2ebb7e3e119a10888eff8fcd","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-agent","tag":"1.12.4","useDigest":true}` | SPIRE agent image |
|
||||
| authentication.mutual.spire.install.agent.labels | object | `{}` | SPIRE agent labels |
|
||||
| authentication.mutual.spire.install.agent.nodeSelector | object | `{}` | SPIRE agent nodeSelector configuration ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
| authentication.mutual.spire.install.agent.podSecurityContext | object | `{}` | Security context to be added to spire agent pods. SecurityContext holds pod-level security attributes and common container settings. ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod |
|
||||
|
|
@ -85,7 +85,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| authentication.mutual.spire.install.agent.tolerations | list | `[{"effect":"NoSchedule","key":"node.kubernetes.io/not-ready"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/control-plane"},{"effect":"NoSchedule","key":"node.cloudprovider.kubernetes.io/uninitialized","value":"true"},{"key":"CriticalAddonsOnly","operator":"Exists"}]` | SPIRE agent tolerations configuration By default it follows the same tolerations as the agent itself to allow the Cilium agent on this node to connect to SPIRE. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
|
||||
| authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true |
|
||||
| authentication.mutual.spire.install.existingNamespace | bool | `false` | SPIRE namespace already exists. Set to true if Helm should not create, manage, and import the SPIRE namespace. |
|
||||
| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
|
||||
| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:d80cd694d3e9467884fcb94b8ca1e20437d8a501096cdf367a5a1918a34fc2fd","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
|
||||
| authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into |
|
||||
| authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration |
|
||||
| authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations |
|
||||
|
|
@ -95,7 +95,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| authentication.mutual.spire.install.server.dataStorage.enabled | bool | `true` | Enable SPIRE server data storage |
|
||||
| authentication.mutual.spire.install.server.dataStorage.size | string | `"1Gi"` | Size of the SPIRE server data storage |
|
||||
| authentication.mutual.spire.install.server.dataStorage.storageClass | string | `nil` | StorageClass of the SPIRE server data storage |
|
||||
| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:59a0b92b39773515e25e68a46c40d3b931b9c1860bc445a79ceb45a805cab8b4","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-server","tag":"1.9.6","useDigest":true}` | SPIRE server image |
|
||||
| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:34147f27066ab2be5cc10ca1d4bfd361144196467155d46c45f3519f41596e49","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-server","tag":"1.12.4","useDigest":true}` | SPIRE server image |
|
||||
| authentication.mutual.spire.install.server.initContainers | list | `[]` | SPIRE server init containers |
|
||||
| authentication.mutual.spire.install.server.labels | object | `{}` | SPIRE server labels |
|
||||
| authentication.mutual.spire.install.server.nodeSelector | object | `{}` | SPIRE server nodeSelector configuration ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
|
|
@ -114,11 +114,17 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| authentication.rotatedIdentitiesQueueSize | int | `1024` | Buffer size of the channel Cilium uses to receive certificate expiration events from auth handlers. |
|
||||
| autoDirectNodeRoutes | bool | `false` | Enable installation of PodCIDR routes between worker nodes if worker nodes share a common L2 network segment. |
|
||||
| azure.enabled | bool | `false` | Enable Azure integration. Note that this is incompatible with AKS clusters created in BYOCNI mode: use AKS BYOCNI integration (`aksbyocni.enabled`) instead. |
|
||||
| bandwidthManager | object | `{"bbr":false,"enabled":false}` | Enable bandwidth manager to optimize TCP and UDP workloads and allow for rate-limiting traffic from individual Pods with EDT (Earliest Departure Time) through the "kubernetes.io/egress-bandwidth" Pod annotation. |
|
||||
| bandwidthManager | object | `{"bbr":false,"bbrHostNamespaceOnly":false,"enabled":false}` | Enable bandwidth manager to optimize TCP and UDP workloads and allow for rate-limiting traffic from individual Pods with EDT (Earliest Departure Time) through the "kubernetes.io/egress-bandwidth" Pod annotation. |
|
||||
| bandwidthManager.bbr | bool | `false` | Activate BBR TCP congestion control for Pods |
|
||||
| bandwidthManager.bbrHostNamespaceOnly | bool | `false` | Activate BBR TCP congestion control for Pods in the host namespace only. |
|
||||
| bandwidthManager.enabled | bool | `false` | Enable bandwidth manager infrastructure (also prerequirement for BBR) |
|
||||
| bgpControlPlane | object | `{"enabled":false,"secretsNamespace":{"create":false,"name":"kube-system"},"statusReport":{"enabled":true}}` | This feature set enables virtual BGP routers to be created via CiliumBGPPeeringPolicy CRDs. |
|
||||
| bgpControlPlane | object | `{"enabled":false,"legacyOriginAttribute":{"enabled":false},"routerIDAllocation":{"ipPool":"","mode":"default"},"secretsNamespace":{"create":false,"name":"kube-system"},"statusReport":{"enabled":true}}` | This feature set enables virtual BGP routers to be created via CiliumBGPPeeringPolicy CRDs. |
|
||||
| bgpControlPlane.enabled | bool | `false` | Enables the BGP control plane. |
|
||||
| bgpControlPlane.legacyOriginAttribute | object | `{"enabled":false}` | Legacy BGP ORIGIN attribute settings (BGPv2 only) |
|
||||
| bgpControlPlane.legacyOriginAttribute.enabled | bool | `false` | Enable/Disable advertising LoadBalancerIP routes with the legacy BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0). Enable for compatibility with the legacy behavior of MetalLB integration. |
|
||||
| bgpControlPlane.routerIDAllocation | object | `{"ipPool":"","mode":"default"}` | BGP router-id allocation mode |
|
||||
| bgpControlPlane.routerIDAllocation.ipPool | string | `""` | IP pool to allocate the BGP router-id from when the mode is ip-pool. |
|
||||
| bgpControlPlane.routerIDAllocation.mode | string | `"default"` | BGP router-id allocation mode. In default mode, the router-id is derived from the IPv4 address if it is available, or else it is determined by the lower 32 bits of the MAC address. |
|
||||
| bgpControlPlane.secretsNamespace | object | `{"create":false,"name":"kube-system"}` | SecretsNamespace is the namespace which BGP support will retrieve secrets from. |
|
||||
| bgpControlPlane.secretsNamespace.create | bool | `false` | Create secrets namespace for BGP secrets. |
|
||||
| bgpControlPlane.secretsNamespace.name | string | `"kube-system"` | The name of the secret namespace to which Cilium agents are given read access |
|
||||
|
|
@ -129,7 +135,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| bpf.ctAccounting | bool | `false` | Enable CT accounting for packets and bytes |
|
||||
| bpf.ctAnyMax | int | `262144` | Configure the maximum number of entries for the non-TCP connection tracking table. |
|
||||
| bpf.ctTcpMax | int | `524288` | Configure the maximum number of entries in the TCP connection tracking table. |
|
||||
| bpf.datapathMode | string | `veth` | Mode for Pod devices for the core datapath (veth, netkit, netkit-l2, lb-only) |
|
||||
| bpf.datapathMode | string | `veth` | Mode for Pod devices for the core datapath (veth, netkit, netkit-l2) |
|
||||
| bpf.disableExternalIPMitigation | bool | `false` | Disable ExternalIP mitigation (CVE-2020-8554) |
|
||||
| bpf.distributedLRU | object | `{"enabled":false}` | Control to use a distributed per-CPU backend memory for the core BPF LRU maps which Cilium uses. This improves performance significantly, but it is also recommended to increase BPF map sizing along with that. |
|
||||
| bpf.distributedLRU.enabled | bool | `false` | Enable distributed LRU backend memory. For compatibility with existing installations it is off by default. |
|
||||
|
|
@ -156,12 +162,13 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| bpf.neighMax | int | `524288` | Configure the maximum number of entries for the neighbor table. |
|
||||
| bpf.nodeMapMax | int | `nil` | Configures the maximum number of entries for the node table. |
|
||||
| bpf.policyMapMax | int | `16384` | Configure the maximum number of entries in endpoint policy map (per endpoint). @schema type: [null, integer] @schema |
|
||||
| bpf.policyStatsMapMax | int | `65536` | Configure the maximum number of entries in global policy stats map. @schema type: [null, integer] @schema |
|
||||
| bpf.preallocateMaps | bool | `false` | Enables pre-allocation of eBPF map values. This increases memory usage but can reduce latency. |
|
||||
| bpf.root | string | `"/sys/fs/bpf"` | Configure the mount point for the BPF filesystem |
|
||||
| bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules for implementing Layer 7 policy. |
|
||||
| bpf.vlanBypass | list | `[]` | Configure explicitly allowed VLAN id's for bpf logic bypass. [0] will allow all VLAN id's without any filtering. |
|
||||
| bpfClockProbe | bool | `false` | Enable BPF clock source probing for more efficient tick retrieval. |
|
||||
| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:ab6b1928e9c5f424f6b0f51c68065b9fd85e2f8d3e5f21fbd1a3cb27e6fb9321","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.2.1","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","tolerations":[],"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
|
||||
| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.3.1","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
|
||||
| certgen.affinity | object | `{}` | Affinity for certgen |
|
||||
| certgen.annotations | object | `{"cronJob":{},"job":{}}` | Annotations to be added to the hubble-certgen initial Job and CronJob |
|
||||
| certgen.extraVolumeMounts | list | `[]` | Additional certgen volumeMounts. |
|
||||
|
|
@ -170,15 +177,16 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| certgen.nodeSelector | object | `{}` | Node selector for certgen ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
| certgen.podLabels | object | `{}` | Labels to be added to hubble-certgen pods |
|
||||
| certgen.priorityClassName | string | `""` | Priority class for certgen ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass |
|
||||
| certgen.resources | object | `{}` | Resource limits for certgen ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers |
|
||||
| certgen.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
|
||||
| certgen.ttlSecondsAfterFinished | int | `1800` | Seconds after which the completed job pod will be deleted |
|
||||
| cgroup | object | `{"autoMount":{"enabled":true,"resources":{}},"hostRoot":"/run/cilium/cgroupv2"}` | Configure cgroup related configuration |
|
||||
| cgroup.autoMount.enabled | bool | `true` | Enable auto mount of cgroup2 filesystem. When `autoMount` is enabled, cgroup2 filesystem is mounted at `cgroup.hostRoot` path on the underlying host and inside the cilium agent pod. If users disable `autoMount`, it's expected that users have mounted cgroup2 filesystem at the specified `cgroup.hostRoot` volume, and then the volume will be mounted inside the cilium agent pod at the same path. |
|
||||
| cgroup.autoMount.resources | object | `{}` | Init Container Cgroup Automount resource limits & requests |
|
||||
| cgroup.hostRoot | string | `"/run/cilium/cgroupv2"` | Configure cgroup root where cgroup2 filesystem is mounted on the host (see also: `cgroup.autoMount`) |
|
||||
| ciliumEndpointSlice | object | `{"enabled":false,"rateLimits":[{"burst":20,"limit":10,"nodes":0},{"burst":100,"limit":50,"nodes":100}]}` | CiliumEndpointSlice configuration options. |
|
||||
| ciliumEndpointSlice.enabled | bool | `false` | Enable Cilium EndpointSlice feature. |
|
||||
| ciliumEndpointSlice.rateLimits | list | `[{"burst":20,"limit":10,"nodes":0},{"burst":100,"limit":50,"nodes":100}]` | List of rate limit options to be used for the CiliumEndpointSlice controller. Each object in the list must have the following fields: nodes: Count of nodes at which to apply the rate limit. limit: The sustained request rate in requests per second. The maximum rate that can be configured is 50. burst: The burst request rate in requests per second. The maximum burst that can be configured is 100. |
|
||||
| ciliumEndpointSlice.sliceMode | string | `"identity"` | The slicing mode to use for CiliumEndpointSlices. identity groups together CiliumEndpoints that share the same identity. fcfs groups together CiliumEndpoints in a first-come-first-serve basis, filling in the largest non-full slice first. |
|
||||
| cleanBpfState | bool | `false` | Clean all eBPF datapath state from the initContainer of the cilium-agent DaemonSet. WARNING: Use with care! |
|
||||
| cleanState | bool | `false` | Clean all local Cilium state from the initContainer of the cilium-agent DaemonSet. Implies cleanBpfState: true. WARNING: Use with care! |
|
||||
| cluster.id | int | `0` | Unique ID of the cluster. Must be unique across all connected clusters and in the range of 1 to 255. Only required for Cluster Mesh, may be 0 if Cluster Mesh is not used. |
|
||||
|
|
@ -197,12 +205,13 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
|
||||
| clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
|
||||
| clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. |
|
||||
| clustermesh.apiserver.image | object | `{"digest":"sha256:3ac210d94d37a77ec010f9ac4c705edc8f15f22afa2b9a6f0e2a7d64d2360586","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.17.8","useDigest":true}` | Clustermesh API server image. |
|
||||
| clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance. |
|
||||
| clustermesh.apiserver.image | object | `{"digest":"sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.18.5","useDigest":true}` | Clustermesh API server image. |
|
||||
| clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance (deprecated - KVStoreMesh will always be enabled once the option is removed). |
|
||||
| clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |
|
||||
| clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |
|
||||
| clustermesh.apiserver.kvstoremesh.extraVolumeMounts | list | `[]` | Additional KVStoreMesh volumeMounts. |
|
||||
| clustermesh.apiserver.kvstoremesh.healthPort | int | `9881` | TCP port for the KVStoreMesh health API. |
|
||||
| clustermesh.apiserver.kvstoremesh.kvstoreMode | string | `"internal"` | Specify the KVStore mode when running KVStoreMesh Supported values: - "internal": remote cluster identities are cached in etcd that runs as a sidecar within ``clustermesh-apiserver`` pod. - "external": ``clustermesh-apiserver`` will sync remote cluster information to the etcd used as kvstore. This can't be enabled with crd identity allocation mode. |
|
||||
| clustermesh.apiserver.kvstoremesh.lifecycle | object | `{}` | lifecycle setting for the KVStoreMesh container |
|
||||
| clustermesh.apiserver.kvstoremesh.readinessProbe | object | `{}` | Configuration for the KVStoreMesh readiness probe. |
|
||||
| clustermesh.apiserver.kvstoremesh.resources | object | `{}` | Resource requests and limits for the KVStoreMesh container |
|
||||
|
|
@ -220,18 +229,22 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| clustermesh.apiserver.metrics.serviceMonitor.etcd.interval | string | `"10s"` | Interval for scrape metrics (etcd metrics) |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.etcd.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor clustermesh-apiserver (etcd metrics) |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.etcd.relabelings | string | `nil` | Relabeling configs for the ServiceMonitor clustermesh-apiserver (etcd metrics) |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.etcd.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.interval | string | `"10s"` | Interval for scrape metrics (apiserver metrics) |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.kvstoremesh.interval | string | `"10s"` | Interval for scrape metrics (KVStoreMesh metrics) |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.kvstoremesh.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor clustermesh-apiserver (KVStoreMesh metrics) |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.kvstoremesh.relabelings | string | `nil` | Relabeling configs for the ServiceMonitor clustermesh-apiserver (KVStoreMesh metrics) |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.kvstoremesh.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.labels | object | `{}` | Labels to add to ServiceMonitor clustermesh-apiserver |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor clustermesh-apiserver (apiserver metrics) |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.relabelings | string | `nil` | Relabeling configs for the ServiceMonitor clustermesh-apiserver (apiserver metrics) |
|
||||
| clustermesh.apiserver.metrics.serviceMonitor.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
|
||||
| clustermesh.apiserver.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
| clustermesh.apiserver.podAnnotations | object | `{}` | Annotations to be added to clustermesh-apiserver pods |
|
||||
| clustermesh.apiserver.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
|
||||
| clustermesh.apiserver.podDisruptionBudget.maxUnavailable | int | `1` | Maximum number/percentage of pods that may be made unavailable |
|
||||
| clustermesh.apiserver.podDisruptionBudget.minAvailable | string | `nil` | Minimum number/percentage of pods that should remain scheduled. When it's set, maxUnavailable must be disabled by `maxUnavailable: null` |
|
||||
| clustermesh.apiserver.podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | How are unhealthy, but running, pods counted for eviction |
|
||||
| clustermesh.apiserver.podLabels | object | `{}` | Labels to be added to clustermesh-apiserver pods |
|
||||
| clustermesh.apiserver.podSecurityContext | object | `{"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532}` | Security context to be added to clustermesh-apiserver pods |
|
||||
| clustermesh.apiserver.priorityClassName | string | `""` | The priority class to use for clustermesh-apiserver |
|
||||
|
|
@ -272,22 +285,26 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| clustermesh.enableEndpointSliceSynchronization | bool | `false` | Enable the synchronization of Kubernetes EndpointSlices corresponding to the remote endpoints of appropriately-annotated global services through ClusterMesh |
|
||||
| clustermesh.enableMCSAPISupport | bool | `false` | Enable Multi-Cluster Services API support |
|
||||
| clustermesh.maxConnectedClusters | int | `255` | The maximum number of clusters to support in a ClusterMesh. This value cannot be changed on running clusters, and all clusters in a ClusterMesh must be configured with the same value. Values > 255 will decrease the maximum allocatable cluster-local identities. Supported values are 255 and 511. |
|
||||
| clustermesh.policyDefaultLocalCluster | bool | `false` | Control whether policy rules assume by default the local cluster if not explicitly selected |
|
||||
| clustermesh.useAPIServer | bool | `false` | Deploy clustermesh-apiserver for clustermesh |
|
||||
| cni.binPath | string | `"/opt/cni/bin"` | Configure the path to the CNI binary directory on the host. |
|
||||
| cni.chainingMode | string | `nil` | Configure chaining on top of other CNI plugins. Possible values: - none - aws-cni - flannel - generic-veth - portmap |
|
||||
| cni.chainingTarget | string | `nil` | A CNI network name in to which the Cilium plugin should be added as a chained plugin. This will cause the agent to watch for a CNI network with this network name. When it is found, this will be used as the basis for Cilium's CNI configuration file. If this is set, it assumes a chaining mode of generic-veth. As a special case, a chaining mode of aws-cni implies a chainingTarget of aws-cni. |
|
||||
| cni.confFileMountPath | string | `"/tmp/cni-configuration"` | Configure the path to where to mount the ConfigMap inside the agent pod. |
|
||||
| cni.confPath | string | `"/etc/cni/net.d"` | Configure the path to the CNI configuration directory on the host. |
|
||||
| cni.configMapKey | string | `"cni-config"` | Configure the key in the CNI ConfigMap to read the contents of the CNI configuration from. |
|
||||
| cni.configMap | string | `""` | When defined, configMap will mount the provided value as ConfigMap and interpret the 'cni.configMapKey' value as CNI configuration file and write it when the agent starts up. |
|
||||
| cni.configMapKey | string | `"cni-config"` | Configure the key in the CNI ConfigMap to read the contents of the CNI configuration from. For this to be effective, the 'cni.configMap' parameter must be specified too. Note that the 'cni.configMap' parameter is the name of the ConfigMap, while 'cni.configMapKey' is the name of the key in the ConfigMap data containing the actual configuration. |
|
||||
| cni.customConf | bool | `false` | Skip writing of the CNI configuration. This can be used if writing of the CNI configuration is performed by external automation. |
|
||||
| cni.enableRouteMTUForCNIChaining | bool | `false` | Enable route MTU for pod netns when CNI chaining is used |
|
||||
| cni.exclusive | bool | `true` | Make Cilium take ownership over the `/etc/cni/net.d` directory on the node, renaming all non-Cilium CNI configurations to `*.cilium_bak`. This ensures no Pods can be scheduled using other CNI plugins during Cilium agent downtime. |
|
||||
| cni.hostConfDirMountPath | string | `"/host/etc/cni/net.d"` | Configure the path to where the CNI configuration directory is mounted inside the agent pod. |
|
||||
| cni.install | bool | `true` | Install the CNI configuration and binary files into the filesystem. |
|
||||
| cni.iptablesRemoveAWSRules | bool | `true` | Enable the removal of iptables rules created by the AWS CNI VPC plugin. |
|
||||
| cni.logFile | string | `"/var/run/cilium/cilium-cni.log"` | Configure the log file for CNI logging with retention policy of 7 days. Disable CNI file logging by setting this field to empty explicitly. |
|
||||
| cni.resources | object | `{"requests":{"cpu":"100m","memory":"10Mi"}}` | Specifies the resources for the cni initContainer |
|
||||
| cni.uninstall | bool | `false` | Remove the CNI configuration and binary files on agent shutdown. Enable this if you're removing Cilium from the cluster. Disable this to prevent the CNI configuration file from being removed during agent upgrade, which can cause nodes to go unmanageable. |
|
||||
| commonLabels | object | `{}` | commonLabels allows users to add common labels for all Cilium resources. |
|
||||
| connectivityProbeFrequencyRatio | float64 | `0.5` | Ratio of the connectivity probe frequency vs resource usage, a float in [0, 1]. 0 will give more frequent probing, 1 will give less frequent probing. Probing frequency is dynamically adjusted based on the cluster size. |
|
||||
| conntrackGCInterval | string | `"0s"` | Configure how frequently garbage collection should occur for the datapath connection tracking table. |
|
||||
| conntrackGCMaxInterval | string | `""` | Configure the maximum frequency for the garbage collection of the connection tracking table. Only affects the automatic computation for the frequency and has no effect when 'conntrackGCInterval' is set. This can be set to more frequently clean up unused identities created from ToFQDN policies. |
|
||||
| crdWaitTimeout | string | `"5m"` | Configure timeout in which Cilium will exit if CRDs are not available |
|
||||
|
|
@ -300,6 +317,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| daemon.runPath | string | `"/var/run/cilium"` | Configure where Cilium runtime state should be stored. |
|
||||
| dashboards | object | `{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null}` | Grafana dashboards for cilium-agent grafana can import dashboards based on the label and value ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards |
|
||||
| debug.enabled | bool | `false` | Enable debug logging |
|
||||
| debug.metricsSamplingInterval | string | `"5m"` | Set the agent-internal metrics sampling frequency. This sets the frequency of the internal sampling of the agent metrics. These are available via the "cilium-dbg shell -- metrics -s" command and are part of the metrics HTML page included in the sysdump. @schema type: [null, string] @schema |
|
||||
| debug.verbose | string | `nil` | Configure verbosity levels for debug logging This option is used to enable debug messages for operations related to such sub-system such as (e.g. kvstore, envoy, datapath or policy), and flow is for enabling debug messages emitted per request, message and connection. Multiple values can be set via a space-separated string (e.g. "datapath envoy"). Applicable values: - flow - kvstore - envoy - datapath - policy |
|
||||
| defaultLBServiceIPAM | string | `"lbipam"` | defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none @schema type: [string] @schema |
|
||||
| directRoutingSkipUnreachable | bool | `false` | Enable skipping of PodCIDR routes between worker nodes if the worker nodes are in a different L2 network segment. |
|
||||
|
|
@ -311,24 +329,22 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| dnsProxy.idleConnectionGracePeriod | string | `"0s"` | Time during which idle but previously active connections with expired DNS lookups are still considered alive. |
|
||||
| dnsProxy.maxDeferredConnectionDeletes | int | `10000` | Maximum number of IPs to retain for expired DNS lookups with still-active connections. |
|
||||
| dnsProxy.minTtl | int | `0` | The minimum time, in seconds, to use DNS data for toFQDNs policies. If the upstream DNS server returns a DNS record with a shorter TTL, Cilium overwrites the TTL with this value. Setting this value to zero means that Cilium will honor the TTLs returned by the upstream DNS server. |
|
||||
| dnsProxy.preAllocateIdentities | bool | `true` | Pre-allocate ToFQDN identities. This reduces DNS proxy tail latency, at the potential cost of some unnecessary policymap entries. Disable this if you have a large (200+) number of unique ToFQDN selectors. |
|
||||
| dnsProxy.preCache | string | `""` | DNS cache data at this path is preloaded on agent startup. |
|
||||
| dnsProxy.proxyPort | int | `0` | Global port on which the in-agent DNS proxy should listen. Default 0 is a OS-assigned port. |
|
||||
| dnsProxy.proxyResponseMaxDelay | string | `"100ms"` | The maximum time the DNS proxy holds an allowed DNS response before sending it along. Responses are sent as soon as the datapath is updated with the new IP information. |
|
||||
| dnsProxy.socketLingerTimeout | int | `10` | Timeout (in seconds) when closing the connection between the DNS proxy and the upstream server. If set to 0, the connection is closed immediately (with TCP RST). If set to -1, the connection is closed asynchronously in the background. |
|
||||
| egressGateway.enabled | bool | `false` | Enables egress gateway to redirect and SNAT the traffic that leaves the cluster. |
|
||||
| egressGateway.reconciliationTriggerInterval | string | `"1s"` | Time between triggers of egress gateway state reconciliations |
|
||||
| enableCiliumEndpointSlice | bool | `false` | Enable CiliumEndpointSlice feature (deprecated, please use `ciliumEndpointSlice.enabled` instead). |
|
||||
| enableCriticalPriorityClass | bool | `true` | Explicitly enable or disable priority class. .Capabilities.KubeVersion is unsettable in `helm template` calls, it depends on k8s libraries version that Helm was compiled against. This option allows to explicitly disable setting the priority class, which is useful for rendering charts for gke clusters in advance. |
|
||||
| enableIPv4BIGTCP | bool | `false` | Enables IPv4 BIG TCP support which increases maximum IPv4 GSO/GRO limits for nodes and pods |
|
||||
| enableIPv4Masquerade | bool | `true` | Enables masquerading of IPv4 traffic leaving the node from endpoints. |
|
||||
| enableIPv4Masquerade | bool | `true` unless ipam eni mode is active | Enables masquerading of IPv4 traffic leaving the node from endpoints. |
|
||||
| enableIPv6BIGTCP | bool | `false` | Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods |
|
||||
| enableIPv6Masquerade | bool | `true` | Enables masquerading of IPv6 traffic leaving the node from endpoints. |
|
||||
| enableInternalTrafficPolicy | bool | `true` | Enable Internal Traffic Policy |
|
||||
| enableK8sTerminatingEndpoint | bool | `true` | Configure whether to enable auto detect of terminating state for endpoints in order to support graceful termination. |
|
||||
| enableLBIPAM | bool | `true` | Enable LoadBalancer IP Address Management |
|
||||
| enableMasqueradeRouteSource | bool | `false` | Enables masquerading to the source of the route for traffic leaving the node from endpoints. |
|
||||
| enableNonDefaultDenyPolicies | bool | `true` | Enable Non-Default-Deny policies |
|
||||
| enableRuntimeDeviceDetection | bool | `true` | Enables experimental support for the detection of new and removed datapath devices. When devices change the eBPF datapath is reloaded and services updated. If "devices" is set then only those devices, or devices matching a wildcard will be considered. This option has been deprecated and is a no-op. |
|
||||
| enableXTSocketFallback | bool | `true` | Enables the fallback compatibility solution for when the xt_socket kernel module is missing and it is needed for the datapath L7 redirection to work properly. See documentation for details on when this can be disabled: https://docs.cilium.io/en/stable/operations/system_requirements/#linux-kernel. |
|
||||
| encryption.enabled | bool | `false` | Enable transparent network encryption. |
|
||||
| encryption.ipsec.encryptedOverlay | bool | `false` | Enable IPsec encrypted overlay |
|
||||
|
|
@ -359,7 +375,6 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| eni.instanceTagsFilter | list | `[]` | Filter via AWS EC2 Instance tags (k=v) which will dictate which AWS EC2 Instances are going to be used to create new ENIs |
|
||||
| eni.subnetIDsFilter | list | `[]` | Filter via subnet IDs which will dictate which subnets are going to be used to create new ENIs Important note: This requires that each instance has an ENI with a matching subnet attached when Cilium is deployed. If you only want to control subnets for ENIs attached by Cilium, use the CNI configuration file settings (cni.customConf) instead. |
|
||||
| eni.subnetTagsFilter | list | `[]` | Filter via tags (k=v) which will dictate which subnets are going to be used to create new ENIs Important note: This requires that each instance has an ENI with a matching subnet attached when Cilium is deployed. If you only want to control subnets for ENIs attached by Cilium, use the CNI configuration file settings (cni.customConf) instead. |
|
||||
| eni.updateEC2AdapterLimitViaAPI | bool | `true` | Update ENI Adapter limits from the EC2 API |
|
||||
| envoy.affinity | object | `{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"cilium.io/no-schedule","operator":"NotIn","values":["true"]}]}]}},"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]},"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium-envoy"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-envoy. |
|
||||
| envoy.annotations | object | `{}` | Annotations to be added to all top-level cilium-envoy objects (resources under templates/cilium-envoy) |
|
||||
| envoy.baseID | int | `0` | Set Envoy'--base-id' to use when allocating shared memory regions. Only needs to be changed if multiple Envoy instances will run on the same node and may have conflicts. Supported values: 0 - 4294967295. Defaults to '0' |
|
||||
|
|
@ -377,9 +392,11 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| envoy.extraVolumes | list | `[]` | Additional envoy volumes. |
|
||||
| envoy.healthPort | int | `9878` | TCP port for the health API. |
|
||||
| envoy.httpRetryCount | int | `3` | Maximum number of retries for each HTTP request |
|
||||
| envoy.httpUpstreamLingerTimeout | string | `nil` | Time in seconds to block Envoy worker thread while an upstream HTTP connection is closing. If set to 0, the connection is closed immediately (with TCP RST). If set to -1, the connection is closed asynchronously in the background. |
|
||||
| envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |
|
||||
| envoy.image | object | `{"digest":"sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece","useDigest":true}` | Envoy container image. |
|
||||
| envoy.image | object | `{"digest":"sha256:3108521821c6922695ff1f6ef24b09026c94b195283f8bfbfc0fa49356a156e1","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.34.12-1765374555-6a93b0bbba8d6dc75b651cbafeedb062b2997716","useDigest":true}` | Envoy container image. |
|
||||
| envoy.initialFetchTimeoutSeconds | int | `30` | Time in seconds after which the initial fetch on an xDS stream is considered timed out |
|
||||
| envoy.livenessProbe.enabled | bool | `true` | Enable liveness probe for cilium-envoy |
|
||||
| envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
|
||||
| envoy.livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe |
|
||||
| envoy.log.accessLogBufferSize | int | `4096` | Size of the Envoy access log buffer created within the agent in bytes. Tune this value up if you encounter "Envoy: Discarded truncated access log message" errors. Large request/response header sizes (e.g. 16KiB) will require a larger buffer size. |
|
||||
|
|
@ -397,7 +414,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| envoy.podSecurityContext.appArmorProfile | object | `{"type":"Unconfined"}` | AppArmorProfile options for the `cilium-agent` and init containers |
|
||||
| envoy.policyRestoreTimeoutDuration | string | `nil` | Max duration to wait for endpoint policies to be restored on restart. Default "3m". |
|
||||
| envoy.priorityClassName | string | `nil` | The priority class to use for cilium-envoy. |
|
||||
| envoy.prometheus | object | `{"enabled":true,"port":"9964","serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","labels":{},"metricRelabelings":null,"relabelings":[{"replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}]}}` | Configure Cilium Envoy Prometheus options. Note that some of these apply to either cilium-agent or cilium-envoy. |
|
||||
| envoy.prometheus | object | `{"enabled":true,"port":"9964","serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","labels":{},"metricRelabelings":null,"relabelings":[{"action":"replace","replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}],"scrapeTimeout":null}}` | Configure Cilium Envoy Prometheus options. Note that some of these apply to either cilium-agent or cilium-envoy. |
|
||||
| envoy.prometheus.enabled | bool | `true` | Enable prometheus metrics for cilium-envoy |
|
||||
| envoy.prometheus.port | string | `"9964"` | Serve prometheus metrics for cilium-envoy on the configured port |
|
||||
| envoy.prometheus.serviceMonitor.annotations | object | `{}` | Annotations to add to ServiceMonitor cilium-envoy |
|
||||
|
|
@ -405,7 +422,8 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| envoy.prometheus.serviceMonitor.interval | string | `"10s"` | Interval for scrape metrics. |
|
||||
| envoy.prometheus.serviceMonitor.labels | object | `{}` | Labels to add to ServiceMonitor cilium-envoy |
|
||||
| envoy.prometheus.serviceMonitor.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor cilium-envoy or for cilium-agent with Envoy configured. |
|
||||
| envoy.prometheus.serviceMonitor.relabelings | list | `[{"replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}]` | Relabeling configs for the ServiceMonitor cilium-envoy or for cilium-agent with Envoy configured. |
|
||||
| envoy.prometheus.serviceMonitor.relabelings | list | `[{"action":"replace","replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}]` | Relabeling configs for the ServiceMonitor cilium-envoy or for cilium-agent with Envoy configured. |
|
||||
| envoy.prometheus.serviceMonitor.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
|
||||
| envoy.readinessProbe.failureThreshold | int | `3` | failure threshold of readiness probe |
|
||||
| envoy.readinessProbe.periodSeconds | int | `30` | interval between checks of the readiness probe |
|
||||
| envoy.resources | object | `{}` | Envoy resource limits & requests ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
||||
|
|
@ -414,8 +432,10 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| envoy.securityContext.capabilities.keepCapNetBindService | bool | `false` | Keep capability `NET_BIND_SERVICE` for Envoy process. |
|
||||
| envoy.securityContext.privileged | bool | `false` | Run the pod with elevated privileges |
|
||||
| envoy.securityContext.seLinuxOptions | object | `{"level":"s0","type":"spc_t"}` | SELinux options for the `cilium-envoy` container |
|
||||
| envoy.startupProbe.enabled | bool | `true` | Enable startup probe for cilium-envoy |
|
||||
| envoy.startupProbe.failureThreshold | int | `105` | failure threshold of startup probe. 105 x 2s translates to the old behaviour of the readiness probe (120s delay + 30 x 3s) |
|
||||
| envoy.startupProbe.periodSeconds | int | `2` | interval between checks of the startup probe |
|
||||
| envoy.streamIdleTimeoutDurationSeconds | int | `300` | Set Envoy the amount of time that the connection manager will allow a stream to exist with no upstream or downstream activity. default 5 minutes |
|
||||
| envoy.terminationGracePeriodSeconds | int | `1` | Configure termination grace period for cilium-envoy DaemonSet. |
|
||||
| envoy.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for envoy scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
|
||||
| envoy.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":2},"type":"RollingUpdate"}` | cilium-envoy update strategy ref: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/#updating-a-daemonset |
|
||||
|
|
@ -429,8 +449,6 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| etcd.enabled | bool | `false` | Enable etcd mode for the agent. |
|
||||
| etcd.endpoints | list | `["https://CHANGE-ME:2379"]` | List of etcd endpoints |
|
||||
| etcd.ssl | bool | `false` | Enable use of TLS/SSL for connectivity to etcd. |
|
||||
| externalWorkloads | object | `{"enabled":false}` | Configure external workloads support |
|
||||
| externalWorkloads.enabled | bool | `false` | Enable support for external workloads, such as VMs (false by default). |
|
||||
| extraArgs | list | `[]` | Additional agent container arguments. |
|
||||
| extraConfig | object | `{}` | extraConfig allows you to specify additional configuration parameters to be included in the cilium-config configmap. |
|
||||
| extraContainers | list | `[]` | Additional containers added to the cilium DaemonSet. |
|
||||
|
|
@ -457,26 +475,24 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| healthCheckICMPFailureThreshold | int | `3` | Number of ICMP requests sent for each health check before marking a node or endpoint unreachable. |
|
||||
| healthChecking | bool | `true` | Enable connectivity health checking. |
|
||||
| healthPort | int | `9879` | TCP port for the agent health API. This is not the port for cilium-health. |
|
||||
| highScaleIPcache | object | `{"enabled":false}` | EnableHighScaleIPcache enables the special ipcache mode for high scale clusters. The ipcache content will be reduced to the strict minimum and traffic will be encapsulated to carry security identities. |
|
||||
| highScaleIPcache.enabled | bool | `false` | Enable the high scale mode for the ipcache. |
|
||||
| hostFirewall | object | `{"enabled":false}` | Configure the host firewall. |
|
||||
| hostFirewall.enabled | bool | `false` | Enables the enforcement of host policies in the eBPF datapath. |
|
||||
| hostPort.enabled | bool | `false` | Enable hostPort service support. |
|
||||
| hubble.annotations | object | `{}` | Annotations to be added to all top-level hubble objects (resources under templates/hubble) |
|
||||
| hubble.dropEventEmitter | object | `{"enabled":false,"interval":"2m","reasons":["auth_required","policy_denied"]}` | Emit v1.Events related to pods on detection of packet drops. This feature is alpha, please provide feedback at https://github.com/cilium/cilium/issues/33975. |
|
||||
| hubble.dropEventEmitter.interval | string | `"2m"` | - Minimum time between emitting same events. |
|
||||
| hubble.dropEventEmitter.reasons | list | `["auth_required","policy_denied"]` | - Drop reasons to emit events for. ref: https://docs.cilium.io/en/stable/_api/v1/flow/README/#dropreason |
|
||||
| hubble.enabled | bool | `true` | Enable Hubble (true by default). |
|
||||
| hubble.export | object | `{"dynamic":{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false},"fileMaxBackups":5,"fileMaxSizeMb":10,"static":{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"filePath":"/var/run/cilium/hubble/events.log"}}` | Hubble flows export. |
|
||||
| hubble.export.dynamic | object | `{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false}` | - Dynamic exporters configuration. Dynamic exporters may be reconfigured without a need of agent restarts. |
|
||||
| hubble.export | object | `{"dynamic":{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false},"static":{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}}` | Hubble flows export. |
|
||||
| hubble.export.dynamic | object | `{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false}` | - Dynamic exporters configuration. Dynamic exporters may be reconfigured without a need of agent restarts. |
|
||||
| hubble.export.dynamic.config.configMapName | string | `"cilium-flowlog-config"` | -- Name of configmap with configuration that may be altered to reconfigure exporters within a running agents. |
|
||||
| hubble.export.dynamic.config.content | list | `[{"excludeFilters":[],"fieldMask":[],"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}]` | -- Exporters configuration in YAML format. |
|
||||
| hubble.export.dynamic.config.content | list | `[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}]` | -- Exporters configuration in YAML format. |
|
||||
| hubble.export.dynamic.config.createConfigMap | bool | `true` | -- True if helm installer should create config map. Switch to false if you want to self maintain the file content. |
|
||||
| hubble.export.fileMaxBackups | int | `5` | - Defines max number of backup/rotated files. |
|
||||
| hubble.export.fileMaxSizeMb | int | `10` | - Defines max file size of output file before it gets rotated. |
|
||||
| hubble.export.static | object | `{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"filePath":"/var/run/cilium/hubble/events.log"}` | - Static exporter configuration. Static exporter is bound to agent lifecycle. |
|
||||
| hubble.export.static | object | `{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}` | - Static exporter configuration. Static exporter is bound to agent lifecycle. |
|
||||
| hubble.export.static.fileCompress | bool | `false` | - Enable compression of rotated files. |
|
||||
| hubble.export.static.fileMaxBackups | int | `5` | - Defines max number of backup/rotated files. |
|
||||
| hubble.export.static.fileMaxSizeMb | int | `10` | - Defines max file size of output file before it gets rotated. |
|
||||
| hubble.listenAddress | string | `":4244"` | An additional address for Hubble to listen to. Set this field ":4244" if you are enabling Hubble Relay, as it assumes that Hubble is listening on port 4244. |
|
||||
| hubble.metrics | object | `{"dashboards":{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null},"dynamic":{"config":{"configMapName":"cilium-dynamic-metrics-config","content":[],"createConfigMap":true},"enabled":false},"enableOpenMetrics":false,"enabled":null,"port":9965,"serviceAnnotations":{},"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":[{"replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}],"tlsConfig":{}},"tls":{"enabled":false,"server":{"cert":"","existingSecret":"","extraDnsNames":[],"extraIpAddresses":[],"key":"","mtls":{"enabled":false,"key":"ca.crt","name":null,"useSecret":false}}}}` | Hubble metrics configuration. See https://docs.cilium.io/en/stable/observability/metrics/#hubble-metrics for more comprehensive documentation about Hubble metrics. |
|
||||
| hubble.metrics | object | `{"dashboards":{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null},"dynamic":{"config":{"configMapName":"cilium-dynamic-metrics-config","content":[],"createConfigMap":true},"enabled":false},"enableOpenMetrics":false,"enabled":null,"port":9965,"serviceAnnotations":{},"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":[{"action":"replace","replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}],"scrapeTimeout":null,"tlsConfig":{}},"tls":{"enabled":false,"server":{"cert":"","existingSecret":"","extraDnsNames":[],"extraIpAddresses":[],"key":"","mtls":{"enabled":false,"key":"ca.crt","name":null,"useSecret":false}}}}` | Hubble metrics configuration. See https://docs.cilium.io/en/stable/observability/metrics/#hubble-metrics for more comprehensive documentation about Hubble metrics. |
|
||||
| hubble.metrics.dashboards | object | `{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null}` | Grafana dashboards for hubble grafana can import dashboards based on the label and value ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards |
|
||||
| hubble.metrics.dynamic.config.configMapName | string | `"cilium-dynamic-metrics-config"` | -- Name of configmap with configuration that may be altered to reconfigure metric handlers within a running agent. |
|
||||
| hubble.metrics.dynamic.config.content | list | `[]` | -- Exporters configuration in YAML format. |
|
||||
|
|
@ -491,7 +507,8 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| hubble.metrics.serviceMonitor.jobLabel | string | `""` | jobLabel to add for ServiceMonitor hubble |
|
||||
| hubble.metrics.serviceMonitor.labels | object | `{}` | Labels to add to ServiceMonitor hubble |
|
||||
| hubble.metrics.serviceMonitor.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor hubble |
|
||||
| hubble.metrics.serviceMonitor.relabelings | list | `[{"replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}]` | Relabeling configs for the ServiceMonitor hubble |
|
||||
| hubble.metrics.serviceMonitor.relabelings | list | `[{"action":"replace","replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}]` | Relabeling configs for the ServiceMonitor hubble |
|
||||
| hubble.metrics.serviceMonitor.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
|
||||
| hubble.metrics.tls.server.cert | string | `""` | base64 encoded PEM values for the Hubble metrics server certificate (deprecated). Use existingSecret instead. |
|
||||
| hubble.metrics.tls.server.existingSecret | string | `""` | Name of the Secret containing the certificate and key for the Hubble metrics server. If specified, cert and key are ignored. |
|
||||
| hubble.metrics.tls.server.extraDnsNames | list | `[]` | Extra DNS names added to certificate when it's auto generated |
|
||||
|
|
@ -500,6 +517,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| hubble.metrics.tls.server.mtls | object | `{"enabled":false,"key":"ca.crt","name":null,"useSecret":false}` | Configure mTLS for the Hubble metrics server. |
|
||||
| hubble.metrics.tls.server.mtls.key | string | `"ca.crt"` | Entry of the ConfigMap containing the CA. |
|
||||
| hubble.metrics.tls.server.mtls.name | string | `nil` | Name of the ConfigMap containing the CA to validate client certificates against. If mTLS is enabled and this is unspecified, it will default to the same CA used for Hubble metrics server certificates. |
|
||||
| hubble.networkPolicyCorrelation | object | `{"enabled":true}` | Enables network policy correlation of Hubble flows, i.e. populating `egress_allowed_by`, `ingress_denied_by` fields with policy information. |
|
||||
| hubble.peerService.clusterDomain | string | `"cluster.local"` | The cluster domain to use to query the Hubble Peer service. It should be the local cluster. |
|
||||
| hubble.peerService.targetPort | int | `4244` | Target Port for the Peer service, must match the hubble.listenAddress' port. |
|
||||
| hubble.preferIpv6 | bool | `false` | Whether Hubble should prefer to announce IPv6 or IPv4 addresses if both are available. |
|
||||
|
|
@ -508,17 +526,16 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| hubble.redact.http.headers.deny | list | `[]` | List of HTTP headers to deny: matching headers will be redacted. Note: `allow` and `deny` lists cannot be used both at the same time, only one can be present. Example: redact: enabled: true http: headers: deny: - Authorization - Proxy-Authorization You can specify the options from the helm CLI: --set hubble.redact.enabled="true" --set hubble.redact.http.headers.deny="Authorization,Proxy-Authorization" |
|
||||
| hubble.redact.http.urlQuery | bool | `false` | Enables redacting URL query (GET) parameters. Example: redact: enabled: true http: urlQuery: true You can specify the options from the helm CLI: --set hubble.redact.enabled="true" --set hubble.redact.http.urlQuery="true" |
|
||||
| hubble.redact.http.userInfo | bool | `true` | Enables redacting user info, e.g., password when basic auth is used. Example: redact: enabled: true http: userInfo: true You can specify the options from the helm CLI: --set hubble.redact.enabled="true" --set hubble.redact.http.userInfo="true" |
|
||||
| hubble.redact.kafka.apiKey | bool | `true` | Enables redacting Kafka's API key. Example: redact: enabled: true kafka: apiKey: true You can specify the options from the helm CLI: --set hubble.redact.enabled="true" --set hubble.redact.kafka.apiKey="true" |
|
||||
| hubble.redact.kafka.apiKey | bool | `true` | Enables redacting Kafka's API key (deprecated, will be removed in v1.19). Example: redact: enabled: true kafka: apiKey: true You can specify the options from the helm CLI: --set hubble.redact.enabled="true" --set hubble.redact.kafka.apiKey="true" |
|
||||
| hubble.relay.affinity | object | `{"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for hubble-replay |
|
||||
| hubble.relay.annotations | object | `{}` | Annotations to be added to all top-level hubble-relay objects (resources under templates/hubble-relay) |
|
||||
| hubble.relay.dialTimeout | string | `nil` | Dial timeout to connect to the local hubble instance to receive peer information (e.g. "30s"). This option has been deprecated and is a no-op. |
|
||||
| hubble.relay.enabled | bool | `false` | Enable Hubble Relay (requires hubble.enabled=true) |
|
||||
| hubble.relay.extraEnv | list | `[]` | Additional hubble-relay environment variables. |
|
||||
| hubble.relay.extraVolumeMounts | list | `[]` | Additional hubble-relay volumeMounts. |
|
||||
| hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
|
||||
| hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |
|
||||
| hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |
|
||||
| hubble.relay.image | object | `{"digest":"sha256:2e576bf7a02291c07bffbc1ca0a66a6c70f4c3eb155480e5b3ac027bedd2858b","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.17.8","useDigest":true}` | Hubble-relay container image. |
|
||||
| hubble.relay.image | object | `{"digest":"sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.18.5","useDigest":true}` | Hubble-relay container image. |
|
||||
| hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
|
||||
| hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
|
||||
| hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
|
|
@ -526,24 +543,26 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| hubble.relay.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
|
||||
| hubble.relay.podDisruptionBudget.maxUnavailable | int | `1` | Maximum number/percentage of pods that may be made unavailable |
|
||||
| hubble.relay.podDisruptionBudget.minAvailable | string | `nil` | Minimum number/percentage of pods that should remain scheduled. When it's set, maxUnavailable must be disabled by `maxUnavailable: null` |
|
||||
| hubble.relay.podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | How are unhealthy, but running, pods counted for eviction |
|
||||
| hubble.relay.podLabels | object | `{}` | Labels to be added to hubble-relay pods |
|
||||
| hubble.relay.podSecurityContext | object | `{"fsGroup":65532}` | hubble-relay pod security context |
|
||||
| hubble.relay.podSecurityContext | object | `{"fsGroup":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | hubble-relay pod security context |
|
||||
| hubble.relay.pprof.address | string | `"localhost"` | Configure pprof listen address for hubble-relay |
|
||||
| hubble.relay.pprof.enabled | bool | `false` | Enable pprof for hubble-relay |
|
||||
| hubble.relay.pprof.port | int | `6062` | Configure pprof listen port for hubble-relay |
|
||||
| hubble.relay.priorityClassName | string | `""` | The priority class to use for hubble-relay |
|
||||
| hubble.relay.prometheus | object | `{"enabled":false,"port":9966,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","labels":{},"metricRelabelings":null,"relabelings":null}}` | Enable prometheus metrics for hubble-relay on the configured port at /metrics |
|
||||
| hubble.relay.prometheus | object | `{"enabled":false,"port":9966,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null}}` | Enable prometheus metrics for hubble-relay on the configured port at /metrics |
|
||||
| hubble.relay.prometheus.serviceMonitor.annotations | object | `{}` | Annotations to add to ServiceMonitor hubble-relay |
|
||||
| hubble.relay.prometheus.serviceMonitor.enabled | bool | `false` | Enable service monitors. This requires the prometheus CRDs to be available (see https://github.com/prometheus-operator/prometheus-operator/blob/main/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml) |
|
||||
| hubble.relay.prometheus.serviceMonitor.interval | string | `"10s"` | Interval for scrape metrics. |
|
||||
| hubble.relay.prometheus.serviceMonitor.labels | object | `{}` | Labels to add to ServiceMonitor hubble-relay |
|
||||
| hubble.relay.prometheus.serviceMonitor.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor hubble-relay |
|
||||
| hubble.relay.prometheus.serviceMonitor.relabelings | string | `nil` | Relabeling configs for the ServiceMonitor hubble-relay |
|
||||
| hubble.relay.prometheus.serviceMonitor.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
|
||||
| hubble.relay.replicas | int | `1` | Number of replicas run for the hubble-relay deployment. |
|
||||
| hubble.relay.resources | object | `{}` | Specifies the resources for the hubble-relay pods |
|
||||
| hubble.relay.retryTimeout | string | `nil` | Backoff duration to retry connecting to the local hubble instance in case of failure (e.g. "30s"). |
|
||||
| hubble.relay.rollOutPods | bool | `false` | Roll out Hubble Relay pods automatically when configmap is updated. |
|
||||
| hubble.relay.securityContext | object | `{"capabilities":{"drop":["ALL"]},"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532}` | hubble-relay container security context |
|
||||
| hubble.relay.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | hubble-relay container security context |
|
||||
| hubble.relay.service | object | `{"nodePort":31234,"type":"ClusterIP"}` | hubble-relay service configuration. |
|
||||
| hubble.relay.service.nodePort | int | `31234` | - The port to use when the service type is set to NodePort. |
|
||||
| hubble.relay.service.type | string | `"ClusterIP"` | - The type of service used for Hubble Relay access, either ClusterIP, NodePort or LoadBalancer. |
|
||||
|
|
@ -589,7 +608,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| hubble.ui.backend.livenessProbe.enabled | bool | `false` | Enable liveness probe for Hubble-ui backend (requires Hubble-ui 0.12+) |
|
||||
| hubble.ui.backend.readinessProbe.enabled | bool | `false` | Enable readiness probe for Hubble-ui backend (requires Hubble-ui 0.12+) |
|
||||
| hubble.ui.backend.resources | object | `{}` | Resource requests and limits for the 'backend' container of the 'hubble-ui' deployment. |
|
||||
| hubble.ui.backend.securityContext | object | `{}` | Hubble-ui backend security context. |
|
||||
| hubble.ui.backend.securityContext | object | `{"allowPrivilegeEscalation":false}` | Hubble-ui backend security context. |
|
||||
| hubble.ui.baseUrl | string | `"/"` | Defines base url prefix for all hubble-ui http requests. It needs to be changed in case if ingress for hubble-ui is configured under some sub-path. Trailing `/` is required for custom path, ex. `/service-map/` |
|
||||
| hubble.ui.enabled | bool | `false` | Whether to enable the Hubble UI. |
|
||||
| hubble.ui.frontend.extraEnv | list | `[]` | Additional hubble-ui frontend environment variables. |
|
||||
|
|
@ -597,7 +616,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| hubble.ui.frontend.extraVolumes | list | `[]` | Additional hubble-ui frontend volumes. |
|
||||
| hubble.ui.frontend.image | object | `{"digest":"sha256:661d5de7050182d495c6497ff0b007a7a1e379648e60830dd68c4d78ae21761d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-ui","tag":"v0.13.3","useDigest":true}` | Hubble-ui frontend image. |
|
||||
| hubble.ui.frontend.resources | object | `{}` | Resource requests and limits for the 'frontend' container of the 'hubble-ui' deployment. |
|
||||
| hubble.ui.frontend.securityContext | object | `{}` | Hubble-ui frontend security context. |
|
||||
| hubble.ui.frontend.securityContext | object | `{"allowPrivilegeEscalation":false}` | Hubble-ui frontend security context. |
|
||||
| hubble.ui.frontend.server.ipv6 | object | `{"enabled":true}` | Controls server listener for ipv6 |
|
||||
| hubble.ui.ingress | object | `{"annotations":{},"className":"","enabled":false,"hosts":["chart-example.local"],"labels":{},"tls":[]}` | hubble-ui ingress configuration. |
|
||||
| hubble.ui.labels | object | `{}` | Additional labels to be added to 'hubble-ui' deployment object |
|
||||
|
|
@ -606,13 +625,15 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| hubble.ui.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
|
||||
| hubble.ui.podDisruptionBudget.maxUnavailable | int | `1` | Maximum number/percentage of pods that may be made unavailable |
|
||||
| hubble.ui.podDisruptionBudget.minAvailable | string | `nil` | Minimum number/percentage of pods that should remain scheduled. When it's set, maxUnavailable must be disabled by `maxUnavailable: null` |
|
||||
| hubble.ui.podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | How are unhealthy, but running, pods counted for eviction |
|
||||
| hubble.ui.podLabels | object | `{}` | Labels to be added to hubble-ui pods |
|
||||
| hubble.ui.priorityClassName | string | `""` | The priority class to use for hubble-ui |
|
||||
| hubble.ui.replicas | int | `1` | The number of replicas of Hubble UI to deploy. |
|
||||
| hubble.ui.rollOutPods | bool | `false` | Roll out Hubble-ui pods automatically when configmap is updated. |
|
||||
| hubble.ui.securityContext | object | `{"fsGroup":1001,"runAsGroup":1001,"runAsUser":1001}` | Security context to be added to Hubble UI pods |
|
||||
| hubble.ui.service | object | `{"annotations":{},"nodePort":31235,"type":"ClusterIP"}` | hubble-ui service configuration. |
|
||||
| hubble.ui.service | object | `{"annotations":{},"labels":{},"nodePort":31235,"type":"ClusterIP"}` | hubble-ui service configuration. |
|
||||
| hubble.ui.service.annotations | object | `{}` | Annotations to be added for the Hubble UI service |
|
||||
| hubble.ui.service.labels | object | `{}` | Labels to be added for the Hubble UI service |
|
||||
| hubble.ui.service.nodePort | int | `31235` | - The port to use when the service type is set to NodePort. |
|
||||
| hubble.ui.service.type | string | `"ClusterIP"` | - The type of service used for Hubble UI access, either ClusterIP or NodePort. |
|
||||
| hubble.ui.standalone.enabled | bool | `false` | When true, it will allow installing the Hubble UI only, without checking dependencies. It is useful if a cluster already has cilium and Hubble relay installed and you just want Hubble UI to be deployed. When installed via helm, installing UI should be done via `helm upgrade` and when installed via the cilium cli, then `cilium hubble enable --ui` |
|
||||
|
|
@ -625,7 +646,8 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |
|
||||
| identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd`, `kvstore` or `doublewrite-readkvstore` / `doublewrite-readcrd` for migrating between identity backends). |
|
||||
| identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
|
||||
| image | object | `{"digest":"sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.17.8","useDigest":true}` | Agent container image. |
|
||||
| identityManagementMode | string | `"agent"` | Control whether CiliumIdentities are created by the agent ("agent"), the operator ("operator") or both ("both"). "Both" should be used only to migrate between "agent" and "operator". Operator-managed identities is a beta feature. |
|
||||
| image | object | `{"digest":"sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.18.5","useDigest":true}` | Agent container image. |
|
||||
| imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images |
|
||||
| ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |
|
||||
| ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |
|
||||
|
|
@ -675,6 +697,10 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| k8s | object | `{"requireIPv4PodCIDR":false,"requireIPv6PodCIDR":false}` | Configure Kubernetes specific configuration |
|
||||
| k8s.requireIPv4PodCIDR | bool | `false` | requireIPv4PodCIDR enables waiting for Kubernetes to provide the PodCIDR range via the Kubernetes node resource |
|
||||
| k8s.requireIPv6PodCIDR | bool | `false` | requireIPv6PodCIDR enables waiting for Kubernetes to provide the PodCIDR range via the Kubernetes node resource |
|
||||
| k8sClientExponentialBackoff | object | `{"backoffBaseSeconds":1,"backoffMaxDurationSeconds":120,"enabled":true}` | Configure exponential backoff for client-go in Cilium agent. |
|
||||
| k8sClientExponentialBackoff.backoffBaseSeconds | int | `1` | Configure base (in seconds) for exponential backoff. |
|
||||
| k8sClientExponentialBackoff.backoffMaxDurationSeconds | int | `120` | Configure maximum duration (in seconds) for exponential backoff. |
|
||||
| k8sClientExponentialBackoff.enabled | bool | `true` | Enable exponential backoff for client-go in Cilium agent. |
|
||||
| k8sClientRateLimit | object | `{"burst":null,"operator":{"burst":null,"qps":null},"qps":null}` | Configure the client side rate limit for the agent If the amount of requests to the Kubernetes API server exceeds the configured rate limit, the agent will start to throttle requests by delaying them until there is budget or the request times out. |
|
||||
| k8sClientRateLimit.burst | int | 20 | The burst request rate in requests per second. The rate limiter will allow short bursts with a higher rate. |
|
||||
| k8sClientRateLimit.operator | object | `{"burst":null,"qps":null}` | Configure the client side rate limit for the Cilium Operator |
|
||||
|
|
@ -683,15 +709,18 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| k8sClientRateLimit.qps | int | 10 | The sustained request rate in requests per second. |
|
||||
| k8sNetworkPolicy.enabled | bool | `true` | Enable support for K8s NetworkPolicy |
|
||||
| k8sServiceHost | string | `""` | Kubernetes service host - use "auto" for automatic lookup from the cluster-info ConfigMap |
|
||||
| k8sServiceHostRef | object | `{"key":null,"name":null}` | Configure the Kubernetes service endpoint dynamically using a ConfigMap. Mutually exclusive with `k8sServiceHost`. |
|
||||
| k8sServiceHostRef.key | string | `nil` | Key in the ConfigMap containing the Kubernetes service endpoint |
|
||||
| k8sServiceHostRef.name | string | `nil` | name of the ConfigMap containing the Kubernetes service endpoint |
|
||||
| k8sServiceLookupConfigMapName | string | `""` | When `k8sServiceHost=auto`, allows to customize the configMap name. It defaults to `cluster-info`. |
|
||||
| k8sServiceLookupNamespace | string | `""` | When `k8sServiceHost=auto`, allows to customize the namespace that contains `k8sServiceLookupConfigMapName`. It defaults to `kube-public`. |
|
||||
| k8sServicePort | string | `""` | Kubernetes service port |
|
||||
| keepDeprecatedLabels | bool | `false` | Keep the deprecated selector labels when deploying Cilium DaemonSet. |
|
||||
| keepDeprecatedProbes | bool | `false` | Keep the deprecated probes when deploying Cilium DaemonSet |
|
||||
| kubeConfigPath | string | `"~/.kube/config"` | Kubernetes config path |
|
||||
| kubeProxyReplacement | string | `"false"` | Configure the kube-proxy replacement in Cilium BPF datapath Valid options are "true" or "false". ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/ @schema@ type: [string, boolean] @schema@ |
|
||||
| kubeProxyReplacementHealthzBindAddr | string | `""` | healthz server bind address for the kube-proxy replacement. To enable set the value to '0.0.0.0:10256' for all ipv4 addresses and this '[::]:10256' for all ipv6 addresses. By default it is disabled. |
|
||||
| l2NeighDiscovery.enabled | bool | `true` | Enable L2 neighbor discovery in the agent |
|
||||
| l2NeighDiscovery.refreshPeriod | string | `"30s"` | Override the agent's default neighbor resolution refresh period. |
|
||||
| l2NeighDiscovery.enabled | bool | `false` | Enable L2 neighbor discovery in the agent |
|
||||
| l2announcements | object | `{"enabled":false}` | Configure L2 announcements |
|
||||
| l2announcements.enabled | bool | `false` | Enable L2 announcements |
|
||||
| l2podAnnouncements | object | `{"enabled":false,"interface":"eth0"}` | Configure L2 pod announcements |
|
||||
|
|
@ -701,24 +730,25 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
|
||||
| livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe |
|
||||
| livenessProbe.requireK8sConnectivity | bool | `false` | whether to require k8s connectivity as part of the check. |
|
||||
| loadBalancer | object | `{"acceleration":"disabled","experimental":false,"l7":{"algorithm":"round_robin","backend":"disabled","ports":[]}}` | Configure service load balancing |
|
||||
| loadBalancer | object | `{"acceleration":"disabled","l7":{"algorithm":"round_robin","backend":"disabled","ports":[]}}` | Configure service load balancing |
|
||||
| loadBalancer.acceleration | string | `"disabled"` | acceleration is the option to accelerate service handling via XDP Applicable values can be: disabled (do not use XDP), native (XDP BPF program is run directly out of the networking driver's early receive path), or best-effort (use native mode XDP acceleration on devices that support it). |
|
||||
| loadBalancer.experimental | bool | `false` | experimental enables support for the experimental load-balancing control-plane. |
|
||||
| loadBalancer.l7 | object | `{"algorithm":"round_robin","backend":"disabled","ports":[]}` | L7 LoadBalancer |
|
||||
| loadBalancer.l7.algorithm | string | `"round_robin"` | Default LB algorithm The default LB algorithm to be used for services, which can be overridden by the service annotation (e.g. service.cilium.io/lb-l7-algorithm) Applicable values: round_robin, least_request, random |
|
||||
| loadBalancer.l7.backend | string | `"disabled"` | Enable L7 service load balancing via envoy proxy. The request to a k8s service, which has specific annotation e.g. service.cilium.io/lb-l7, will be forwarded to the local backend proxy to be load balanced to the service endpoints. Please refer to docs for supported annotations for more configuration. Applicable values: - envoy: Enable L7 load balancing via envoy proxy. This will automatically set enable-envoy-config as well. - disabled: Disable L7 load balancing by way of service annotation. |
|
||||
| loadBalancer.l7.ports | list | `[]` | List of ports from service to be automatically redirected to above backend. Any service exposing one of these ports will be automatically redirected. Fine-grained control can be achieved by using the service annotation. |
|
||||
| localRedirectPolicy | bool | `false` | Enable Local Redirect Policy. |
|
||||
| localRedirectPolicies.addressMatcherCIDRs | string | `nil` | Limit the allowed addresses in Address Matcher rule of Local Redirect Policies to the given CIDRs. @schema@ type: [null, array] @schema@ |
|
||||
| localRedirectPolicies.enabled | bool | `false` | Enable local redirect policies. |
|
||||
| localRedirectPolicy | bool | `false` | Enable Local Redirect Policy (deprecated, please use 'localRedirectPolicies.enabled' instead) |
|
||||
| logSystemLoad | bool | `false` | Enables periodic logging of system load |
|
||||
| maglev | object | `{}` | Configure maglev consistent hashing |
|
||||
| monitor | object | `{"enabled":false}` | cilium-monitor sidecar. |
|
||||
| monitor.enabled | bool | `false` | Enable the cilium-monitor sidecar. |
|
||||
| name | string | `"cilium"` | Agent container name. |
|
||||
| name | string | `"cilium"` | Agent daemonset name. |
|
||||
| namespaceOverride | string | `""` | namespaceOverride allows to override the destination namespace for Cilium resources. This property allows to use Cilium as part of an Umbrella Chart with different targets. |
|
||||
| nat.mapStatsEntries | int | `32` | Number of the top-k SNAT map connections to track in Cilium statedb. |
|
||||
| nat.mapStatsInterval | string | `"30s"` | Interval between how often SNAT map is counted for stats. |
|
||||
| nat46x64Gateway | object | `{"enabled":false}` | Configure standalone NAT46/NAT64 gateway |
|
||||
| nat46x64Gateway.enabled | bool | `false` | Enable RFC8215-prefixed translation |
|
||||
| nat46x64Gateway.enabled | bool | `false` | Enable RFC6052-prefixed translation |
|
||||
| nodeIPAM.enabled | bool | `false` | Configure Node IPAM ref: https://docs.cilium.io/en/stable/network/node-ipam/ |
|
||||
| nodePort | object | `{"addresses":null,"autoProtectPortRange":true,"bindProtection":true,"enableHealthCheck":true,"enableHealthCheckLoadBalancerIP":false,"enabled":false}` | Configure N-S k8s service loadbalancing |
|
||||
| nodePort.addresses | string | `nil` | List of CIDRs for choosing which IP addresses assigned to native devices are used for NodePort load-balancing. By default this is empty and the first suitable, preferably private, IPv4 and IPv6 address assigned to each device is used. Example: addresses: ["192.168.1.0/24", "2001::/64"] |
|
||||
|
|
@ -745,7 +775,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| nodeinit.prestop | object | `{"postScript":"","preScript":""}` | prestop offers way to customize prestop nodeinit script (pre and post position) |
|
||||
| nodeinit.priorityClassName | string | `""` | The priority class to use for the nodeinit pod. |
|
||||
| nodeinit.resources | object | `{"requests":{"cpu":"100m","memory":"100Mi"}}` | nodeinit resource limits & requests ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
||||
| nodeinit.securityContext | object | `{"capabilities":{"add":["SYS_MODULE","NET_ADMIN","SYS_ADMIN","SYS_CHROOT","SYS_PTRACE"]},"privileged":false,"seLinuxOptions":{"level":"s0","type":"spc_t"}}` | Security context to be added to nodeinit pods. |
|
||||
| nodeinit.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"add":["SYS_MODULE","NET_ADMIN","SYS_ADMIN","SYS_CHROOT","SYS_PTRACE"]},"privileged":false,"seLinuxOptions":{"level":"s0","type":"spc_t"}}` | Security context to be added to nodeinit pods. |
|
||||
| nodeinit.startup | object | `{"postScript":"","preScript":""}` | startup offers way to customize startup nodeinit script (pre and post position) |
|
||||
| nodeinit.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for nodeinit scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
|
||||
| nodeinit.updateStrategy | object | `{"type":"RollingUpdate"}` | node-init update strategy |
|
||||
|
|
@ -763,20 +793,21 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| operator.hostNetwork | bool | `true` | HostNetwork setting |
|
||||
| operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
|
||||
| operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
|
||||
| operator.image | object | `{"alibabacloudDigest":"sha256:72c25a405ad8e58d2cf03f7ea2b6696ed1edcfb51716b5f85e45c6c4fcaa6056","awsDigest":"sha256:28012f7d0f4f23e9f6c7d6a5dd931afa326bbac3e8103f3f6f22b9670847dffa","azureDigest":"sha256:619f9febf3efef2724a26522b253e4595cd33c274f5f49925e29a795fdc2d2d7","genericDigest":"sha256:5468807b9c31997f3a1a14558ec7c20c5b962a2df6db633b7afbe2f45a15da1c","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.17.8","useDigest":true}` | cilium-operator image. |
|
||||
| operator.image | object | `{"alibabacloudDigest":"sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c","awsDigest":"sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52","azureDigest":"sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6","genericDigest":"sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.18.5","useDigest":true}` | cilium-operator image. |
|
||||
| operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
|
||||
| operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
| operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
|
||||
| operator.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
|
||||
| operator.podDisruptionBudget.maxUnavailable | int | `1` | Maximum number/percentage of pods that may be made unavailable |
|
||||
| operator.podDisruptionBudget.minAvailable | string | `nil` | Minimum number/percentage of pods that should remain scheduled. When it's set, maxUnavailable must be disabled by `maxUnavailable: null` |
|
||||
| operator.podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | How are unhealthy, but running, pods counted for eviction |
|
||||
| operator.podLabels | object | `{}` | Labels to be added to cilium-operator pods |
|
||||
| operator.podSecurityContext | object | `{}` | Security context to be added to cilium-operator pods |
|
||||
| operator.podSecurityContext | object | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Security context to be added to cilium-operator pods |
|
||||
| operator.pprof.address | string | `"localhost"` | Configure pprof listen address for cilium-operator |
|
||||
| operator.pprof.enabled | bool | `false` | Enable pprof for cilium-operator |
|
||||
| operator.pprof.port | int | `6061` | Configure pprof listen port for cilium-operator |
|
||||
| operator.priorityClassName | string | `""` | The priority class to use for cilium-operator |
|
||||
| operator.prometheus | object | `{"enabled":true,"metricsService":false,"port":9963,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":null}}` | Enable prometheus metrics for cilium-operator on the configured port at /metrics |
|
||||
| operator.prometheus | object | `{"enabled":true,"metricsService":false,"port":9963,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null}}` | Enable prometheus metrics for cilium-operator on the configured port at /metrics |
|
||||
| operator.prometheus.serviceMonitor.annotations | object | `{}` | Annotations to add to ServiceMonitor cilium-operator |
|
||||
| operator.prometheus.serviceMonitor.enabled | bool | `false` | Enable service monitors. This requires the prometheus CRDs to be available (see https://github.com/prometheus-operator/prometheus-operator/blob/main/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml) |
|
||||
| operator.prometheus.serviceMonitor.interval | string | `"10s"` | Interval for scrape metrics. |
|
||||
|
|
@ -784,15 +815,16 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| operator.prometheus.serviceMonitor.labels | object | `{}` | Labels to add to ServiceMonitor cilium-operator |
|
||||
| operator.prometheus.serviceMonitor.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor cilium-operator |
|
||||
| operator.prometheus.serviceMonitor.relabelings | string | `nil` | Relabeling configs for the ServiceMonitor cilium-operator |
|
||||
| operator.prometheus.serviceMonitor.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
|
||||
| operator.removeNodeTaints | bool | `true` | Remove Cilium node taint from Kubernetes nodes that have a healthy Cilium pod running. |
|
||||
| operator.replicas | int | `2` | Number of replicas to run for the cilium-operator deployment |
|
||||
| operator.resources | object | `{}` | cilium-operator resource limits & requests ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
||||
| operator.rollOutPods | bool | `false` | Roll out cilium-operator pods automatically when configmap is updated. |
|
||||
| operator.securityContext | object | `{}` | Security context to be added to cilium-operator pods |
|
||||
| operator.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}}` | Security context to be added to cilium-operator pods |
|
||||
| operator.setNodeNetworkStatus | bool | `true` | Set Node condition NetworkUnavailable to 'false' with the reason 'CiliumIsUp' for nodes that have a healthy Cilium pod. |
|
||||
| operator.setNodeTaints | string | same as removeNodeTaints | Taint nodes where Cilium is scheduled but not running. This prevents pods from being scheduled to nodes where Cilium is not the default CNI provider. |
|
||||
| operator.skipCRDCreation | bool | `false` | Skip CRDs creation for cilium-operator |
|
||||
| operator.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for cilium-operator scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
|
||||
| operator.tolerations | list | `[{"key":"node-role.kubernetes.io/control-plane","operator":"Exists"},{"key":"node-role.kubernetes.io/master","operator":"Exists"},{"key":"node.kubernetes.io/not-ready","operator":"Exists"},{"key":"node.cloudprovider.kubernetes.io/uninitialized","operator":"Exists"}]` | Node tolerations for cilium-operator scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ Toleration for agentNotReadyTaintKey taint is always added to cilium-operator pods. @schema type: [null, array] @schema |
|
||||
| operator.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for cilium-operator |
|
||||
| operator.unmanagedPodWatcher.intervalSeconds | int | `15` | Interval, in seconds, to check if there are any pods that are not managed by Cilium. |
|
||||
| operator.unmanagedPodWatcher.restart | bool | `true` | Restart any pod that are not managed by Cilium. |
|
||||
|
|
@ -810,29 +842,31 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| preflight.affinity | object | `{"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-preflight |
|
||||
| preflight.annotations | object | `{}` | Annotations to be added to all top-level preflight objects (resources under templates/cilium-preflight) |
|
||||
| preflight.enabled | bool | `false` | Enable Cilium pre-flight resources (required for upgrade) |
|
||||
| preflight.envoy.image | object | `{"digest":"sha256:3108521821c6922695ff1f6ef24b09026c94b195283f8bfbfc0fa49356a156e1","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.34.12-1765374555-6a93b0bbba8d6dc75b651cbafeedb062b2997716","useDigest":true}` | Envoy pre-flight image. |
|
||||
| preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
|
||||
| preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
|
||||
| preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
|
||||
| preflight.image | object | `{"digest":"sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.17.8","useDigest":true}` | Cilium pre-flight image. |
|
||||
| preflight.image | object | `{"digest":"sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.18.5","useDigest":true}` | Cilium pre-flight image. |
|
||||
| preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
| preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
|
||||
| preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
|
||||
| preflight.podDisruptionBudget.maxUnavailable | int | `1` | Maximum number/percentage of pods that may be made unavailable |
|
||||
| preflight.podDisruptionBudget.minAvailable | string | `nil` | Minimum number/percentage of pods that should remain scheduled. When it's set, maxUnavailable must be disabled by `maxUnavailable: null` |
|
||||
| preflight.podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | How are unhealthy, but running, pods counted for eviction |
|
||||
| preflight.podLabels | object | `{}` | Labels to be added to the preflight pod. |
|
||||
| preflight.podSecurityContext | object | `{}` | Security context to be added to preflight pods. |
|
||||
| preflight.priorityClassName | string | `""` | The priority class to use for the preflight pod. |
|
||||
| preflight.readinessProbe.initialDelaySeconds | int | `5` | For how long kubelet should wait before performing the first probe |
|
||||
| preflight.readinessProbe.periodSeconds | int | `5` | interval between checks of the readiness probe |
|
||||
| preflight.resources | object | `{}` | preflight resource limits & requests ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
||||
| preflight.securityContext | object | `{}` | Security context to be added to preflight pods |
|
||||
| preflight.securityContext | object | `{"allowPrivilegeEscalation":false}` | Security context to be added to preflight pods |
|
||||
| preflight.terminationGracePeriodSeconds | int | `1` | Configure termination grace period for preflight Deployment and DaemonSet. |
|
||||
| preflight.tofqdnsPreCache | string | `""` | Path to write the `--tofqdns-pre-cache` file to. |
|
||||
| preflight.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for preflight scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
|
||||
| preflight.updateStrategy | object | `{"type":"RollingUpdate"}` | preflight update strategy |
|
||||
| preflight.validateCNPs | bool | `true` | By default we should always validate the installed CNPs before upgrading Cilium. This will make sure the user will have the policies deployed in the cluster with the right schema. |
|
||||
| priorityClassName | string | `""` | The priority class to use for cilium-agent. |
|
||||
| prometheus | object | `{"controllerGroupMetrics":["write-cni-file","sync-host-ips","sync-lb-maps-with-k8s-services"],"enabled":false,"metrics":null,"metricsService":false,"port":9962,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":[{"replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}],"trustCRDsExist":false}}` | Configure prometheus metrics on the configured port at /metrics |
|
||||
| prometheus | object | `{"controllerGroupMetrics":["write-cni-file","sync-host-ips","sync-lb-maps-with-k8s-services"],"enabled":false,"metrics":null,"metricsService":false,"port":9962,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":[{"action":"replace","replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}],"scrapeTimeout":null,"trustCRDsExist":false}}` | Configure prometheus metrics on the configured port at /metrics |
|
||||
| prometheus.controllerGroupMetrics | list | `["write-cni-file","sync-host-ips","sync-lb-maps-with-k8s-services"]` | - Enable controller group metrics for monitoring specific Cilium subsystems. The list is a list of controller group names. The special values of "all" and "none" are supported. The set of controller group names is not guaranteed to be stable between Cilium versions. |
|
||||
| prometheus.metrics | string | `nil` | Metrics that should be enabled or disabled from the default metric list. The list is expected to be separated by a space. (+metric_foo to enable metric_foo , -metric_bar to disable metric_bar). ref: https://docs.cilium.io/en/stable/observability/metrics/ |
|
||||
| prometheus.serviceMonitor.annotations | object | `{}` | Annotations to add to ServiceMonitor cilium-agent |
|
||||
|
|
@ -841,7 +875,8 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| prometheus.serviceMonitor.jobLabel | string | `""` | jobLabel to add for ServiceMonitor cilium-agent |
|
||||
| prometheus.serviceMonitor.labels | object | `{}` | Labels to add to ServiceMonitor cilium-agent |
|
||||
| prometheus.serviceMonitor.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor cilium-agent |
|
||||
| prometheus.serviceMonitor.relabelings | list | `[{"replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}]` | Relabeling configs for the ServiceMonitor cilium-agent |
|
||||
| prometheus.serviceMonitor.relabelings | list | `[{"action":"replace","replacement":"${1}","sourceLabels":["__meta_kubernetes_pod_node_name"],"targetLabel":"node"}]` | Relabeling configs for the ServiceMonitor cilium-agent |
|
||||
| prometheus.serviceMonitor.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
|
||||
| prometheus.serviceMonitor.trustCRDsExist | bool | `false` | Set to `true` and helm will not check for monitoring.coreos.com/v1 CRDs before deploying |
|
||||
| rbac.create | bool | `true` | Enable creation of Resource-Based Access Control configuration. |
|
||||
| readinessProbe.failureThreshold | int | `3` | failure threshold of readiness probe |
|
||||
|
|
@ -854,6 +889,8 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| scheduling.mode | string | Defaults to apply a pod anti-affinity rule to the agent pod - `anti-affinity` | Mode specifies how Cilium daemonset pods should be scheduled to Nodes. `anti-affinity` mode applies a pod anti-affinity rule to the cilium daemonset. Pod anti-affinity may significantly impact scheduling throughput for large clusters. See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity `kube-scheduler` mode forgoes the anti-affinity rule for full scheduling throughput. Kube-scheduler avoids host port conflict when scheduling pods. |
|
||||
| sctp | object | `{"enabled":false}` | SCTP Configuration Values |
|
||||
| sctp.enabled | bool | `false` | Enable SCTP support. NOTE: Currently, SCTP support does not support rewriting ports or multihoming. |
|
||||
| secretsNamespaceAnnotations | object | `{}` | Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) |
|
||||
| securityContext.allowPrivilegeEscalation | bool | `false` | disable privilege escalation |
|
||||
| securityContext.capabilities.applySysctlOverwrites | list | `["SYS_ADMIN","SYS_CHROOT","SYS_PTRACE"]` | capabilities for the `apply-sysctl-overwrites` init container |
|
||||
| securityContext.capabilities.ciliumAgent | list | `["CHOWN","KILL","NET_ADMIN","NET_RAW","IPC_LOCK","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE","DAC_OVERRIDE","FOWNER","SETGID","SETUID"]` | Capabilities for the `cilium-agent` container |
|
||||
| securityContext.capabilities.cleanCiliumState | list | `["NET_ADMIN","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE"]` | Capabilities for the `clean-cilium-state` init container |
|
||||
|
|
@ -868,7 +905,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| sleepAfterInit | bool | `false` | Do not run Cilium agent when running with clean mode. Useful to completely uninstall Cilium as it will stop Cilium from starting and create artifacts in the node. |
|
||||
| socketLB | object | `{"enabled":false}` | Configure socket LB |
|
||||
| socketLB.enabled | bool | `false` | Enable socket LB |
|
||||
| startupProbe.failureThreshold | int | `105` | failure threshold of startup probe. 105 x 2s translates to the old behaviour of the readiness probe (120s delay + 30 x 3s) |
|
||||
| startupProbe.failureThreshold | int | `300` | failure threshold of startup probe. Allow Cilium to take up to 600s to start up (300 attempts with 2s between attempts). |
|
||||
| startupProbe.periodSeconds | int | `2` | interval between checks of the startup probe |
|
||||
| svcSourceRangeCheck | bool | `true` | Enable check of service source ranges (currently, only for LoadBalancer). |
|
||||
| synchronizeK8sNodes | bool | `true` | Synchronize Kubernetes nodes to kvstore and perform CNP GC. |
|
||||
|
|
@ -896,6 +933,7 @@ contributors across the globe, there is almost always someone available to help.
|
|||
| tunnelPort | int | Port 8472 for VXLAN, Port 6081 for Geneve | Configure VXLAN and Geneve tunnel port. |
|
||||
| tunnelProtocol | string | `"vxlan"` | Tunneling protocol to use in tunneling mode and for ad-hoc tunnels. Possible values: - "" - vxlan - geneve |
|
||||
| tunnelSourcePortRange | string | 0-0 to let the kernel driver decide the range | Configure VXLAN and Geneve tunnel source port range hint. |
|
||||
| underlayProtocol | string | `"ipv4"` | IP family for the underlay. |
|
||||
| updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":2},"type":"RollingUpdate"}` | Cilium agent update strategy |
|
||||
| upgradeCompatibility | string | `nil` | upgradeCompatibility helps users upgrading to ensure that the configMap for Cilium will not change critical values to ensure continued operation This flag is not required for new installations. For example: '1.7', '1.8', '1.9' |
|
||||
| vtep.cidr | string | `""` | A space separated list of VTEP device CIDRs, for example "1.1.1.0/24 1.1.2.0/24" |
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -54,7 +54,7 @@ staticResources:
|
|||
- addressPrefix: "::1"
|
||||
prefixLen: 128
|
||||
{{- end }}
|
||||
streamIdleTimeout: "0s"
|
||||
streamIdleTimeout: "{{ .Values.envoy.streamIdleTimeoutDurationSeconds }}s"
|
||||
{{- end }}
|
||||
{{- if and .Values.envoy.debug.admin.enabled }}
|
||||
- name: "envoy-admin-listener"
|
||||
|
|
@ -107,7 +107,7 @@ staticResources:
|
|||
- addressPrefix: "::1"
|
||||
prefixLen: 128
|
||||
{{- end }}
|
||||
streamIdleTimeout: "0s"
|
||||
streamIdleTimeout: "{{ .Values.envoy.streamIdleTimeoutDurationSeconds }}s"
|
||||
{{- end }}
|
||||
- name: "envoy-health-listener"
|
||||
address:
|
||||
|
|
@ -159,7 +159,7 @@ staticResources:
|
|||
- addressPrefix: "::1"
|
||||
prefixLen: 128
|
||||
{{- end }}
|
||||
streamIdleTimeout: "0s"
|
||||
streamIdleTimeout: "{{ .Values.envoy.streamIdleTimeoutDurationSeconds }}s"
|
||||
clusters:
|
||||
- name: "ingress-cluster"
|
||||
type: "ORIGINAL_DST"
|
||||
|
|
|
|||
|
|
@ -17,6 +17,13 @@
|
|||
You have successfully installed {{ title .Chart.Name }}.
|
||||
{{- end }}
|
||||
|
||||
{{- $warnings := include "cilium.warnings" . }}
|
||||
{{- if $warnings }}
|
||||
|
||||
WARNINGS:
|
||||
{{ $warnings }}
|
||||
{{- end }}
|
||||
|
||||
Your release version is {{ .Chart.Version }}.
|
||||
|
||||
For any further help, visit https://docs.cilium.io/en/v{{ (semver .Chart.Version).Major }}.{{ (semver .Chart.Version).Minor }}/gettinghelp
|
||||
|
|
|
|||
|
|
@ -209,4 +209,11 @@ Return user specify tls.secretSync.enabled or default value based on the upgrade
|
|||
{{- false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Determine if CRDs are used for identity allocation
|
||||
*/}}
|
||||
{{- define "identityAllocationCRD" }}
|
||||
{{- list "crd" "doublewrite-readkvstore" "doublewrite-readcrd" | has .Values.identityAllocationMode }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -42,6 +42,9 @@ rules:
|
|||
- pods
|
||||
- endpoints
|
||||
- nodes
|
||||
{{- if not $readSecretsOnlyFromSecretsNamespace }}
|
||||
- secrets
|
||||
{{- end }}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
|
|
@ -87,14 +90,6 @@ rules:
|
|||
# until we figure out how to avoid "get" inside the preflight, and then
|
||||
# should be removed ideally.
|
||||
- get
|
||||
{{- if not $readSecretsOnlyFromSecretsNamespace }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: cilium
|
||||
name: {{ .Values.name }}
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
|
|
@ -72,6 +72,7 @@ spec:
|
|||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
kubectl.kubernetes.io/default-container: cilium-agent
|
||||
labels:
|
||||
k8s-app: cilium
|
||||
app.kubernetes.io/name: cilium-agent
|
||||
|
|
@ -205,18 +206,33 @@ spec:
|
|||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
divisor: '1'
|
||||
{{- if and .Values.k8sServiceHostRef.name .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Values.k8sServiceHostRef.name }}
|
||||
key: {{ .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: {{ include "k8sServicePort" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.k8sServiceHost }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: {{ include "k8sServiceHost" . }}
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: {{ include "k8sServicePort" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.k8sClientExponentialBackoff.enabled }}
|
||||
- name: KUBE_CLIENT_BACKOFF_BASE
|
||||
value: {{ .Values.k8sClientExponentialBackoff.backoffBaseSeconds | quote }}
|
||||
- name: KUBE_CLIENT_BACKOFF_DURATION
|
||||
value: {{ .Values.k8sClientExponentialBackoff.backoffMaxDurationSeconds | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.cni.install }}
|
||||
lifecycle:
|
||||
{{- if ne .Values.cni.chainingMode "aws-cni" }}
|
||||
{{- if and .Values.cni.iptablesRemoveAWSRules (ne .Values.cni.chainingMode "aws-cni") }}
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
|
|
@ -251,7 +267,7 @@ spec:
|
|||
hostPort: {{ .Values.envoy.prometheus.port }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if and .Values.envoy.debug.admin.port (not $envoyDS) }}
|
||||
{{- if and .Values.envoy.debug.admin.enabled .Values.envoy.debug.admin.port (not $envoyDS) }}
|
||||
- name: envoy-admin
|
||||
containerPort: {{ .Values.envoy.debug.admin.port }}
|
||||
hostPort: {{ .Values.envoy.debug.admin.port }}
|
||||
|
|
@ -303,7 +319,6 @@ spec:
|
|||
- mountPath: /host/proc/sys/kernel
|
||||
name: host-proc-sys-kernel
|
||||
{{- end}}
|
||||
{{- if .Values.bpf.autoMount.enabled }}
|
||||
- name: bpf-maps
|
||||
mountPath: /sys/fs/bpf
|
||||
{{- if .Values.securityContext.privileged }}
|
||||
|
|
@ -315,7 +330,6 @@ spec:
|
|||
# in Cilium.
|
||||
mountPropagation: HostToContainer
|
||||
{{- end}}
|
||||
{{- end }}
|
||||
{{- if not (contains "/run/cilium/cgroupv2" .Values.cgroup.hostRoot) }}
|
||||
# Check for duplicate mounts before mounting
|
||||
- name: cilium-cgroup
|
||||
|
|
@ -436,6 +450,10 @@ spec:
|
|||
- name: config
|
||||
image: {{ include "cilium.image" .Values.image | quote }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- with .Values.initResources }}
|
||||
resources:
|
||||
{{- toYaml . | trim | nindent 10 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- cilium-dbg
|
||||
- build-config
|
||||
|
|
@ -451,6 +469,9 @@ spec:
|
|||
{{- if .Values.kubeConfigPath }}
|
||||
- "--k8s-kubeconfig-path={{ .Values.kubeConfigPath }}"
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.k8s "apiServerURLs" }}
|
||||
- "--k8s-api-server-urls={{ .Values.k8s.apiServerURLs }}"
|
||||
{{- end }}
|
||||
env:
|
||||
- name: K8S_NODE_NAME
|
||||
valueFrom:
|
||||
|
|
@ -462,6 +483,15 @@ spec:
|
|||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- if and .Values.k8sServiceHostRef.name .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Values.k8sServiceHostRef.name }}
|
||||
key: {{ .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: {{ include "k8sServicePort" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.k8sServiceHost }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: {{ include "k8sServiceHost" . }}
|
||||
|
|
@ -599,12 +629,10 @@ spec:
|
|||
terminationMessagePolicy: FallbackToLogsOnError
|
||||
securityContext:
|
||||
privileged: true
|
||||
{{- if and .Values.bpf.autoMount.enabled }}
|
||||
volumeMounts:
|
||||
- name: bpf-maps
|
||||
mountPath: /sys/fs/bpf
|
||||
mountPropagation: Bidirectional
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.nodeinit.enabled .Values.nodeinit.bootstrapFile }}
|
||||
- name: wait-for-node-init
|
||||
|
|
@ -651,6 +679,15 @@ spec:
|
|||
name: cilium-config
|
||||
key: write-cni-conf-when-ready
|
||||
optional: true
|
||||
{{- if and .Values.k8sServiceHostRef.name .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Values.k8sServiceHostRef.name }}
|
||||
key: {{ .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: {{ include "k8sServicePort" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.k8sServiceHost }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: {{ include "k8sServiceHost" . }}
|
||||
|
|
@ -678,10 +715,8 @@ spec:
|
|||
- ALL
|
||||
{{- end}}
|
||||
volumeMounts:
|
||||
{{- if .Values.bpf.autoMount.enabled}}
|
||||
- name: bpf-maps
|
||||
mountPath: /sys/fs/bpf
|
||||
{{- end }}
|
||||
# Required to mount cgroup filesystem from the host to cilium agent pod
|
||||
- name: cilium-cgroup
|
||||
mountPath: {{ .Values.cgroup.hostRoot }}
|
||||
|
|
@ -807,13 +842,11 @@ spec:
|
|||
hostPath:
|
||||
path: /var/run/netns
|
||||
type: DirectoryOrCreate
|
||||
{{- if .Values.bpf.autoMount.enabled }}
|
||||
# To keep state between restarts / upgrades for bpf maps
|
||||
- name: bpf-maps
|
||||
hostPath:
|
||||
path: /sys/fs/bpf
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
{{- if or .Values.cgroup.autoMount.enabled .Values.sysctlfix.enabled }}
|
||||
# To mount cgroup2 filesystem on the host or apply sysctlfix
|
||||
- name: hostproc
|
||||
|
|
|
|||
|
|
@ -130,7 +130,7 @@ metadata:
|
|||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/part-of: cilium
|
||||
rules:
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ subjects:
|
|||
{{- end}}
|
||||
|
||||
{{- if and .Values.agent (not .Values.preflight.enabled) .Values.serviceAccounts.cilium.create .Values.ingressController.enabled .Values.ingressController.secretsNamespace.name}}
|
||||
---
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
|
|
@ -145,5 +145,5 @@ roleRef:
|
|||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ .Values.serviceAccounts.cilium.name | quote }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -7,6 +7,7 @@ metadata:
|
|||
namespace: {{ .Values.prometheus.serviceMonitor.namespace | default (include "cilium.namespace" .) }}
|
||||
labels:
|
||||
app.kubernetes.io/part-of: cilium
|
||||
app.kubernetes.io/name: cilium-agent
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -49,6 +50,9 @@ spec:
|
|||
{{- if and .Values.envoy.enabled .Values.envoy.prometheus.serviceMonitor.enabled }}
|
||||
- port: envoy-metrics
|
||||
interval: {{ .Values.envoy.prometheus.serviceMonitor.interval | quote }}
|
||||
{{- if .Values.envoy.prometheus.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.envoy.prometheus.serviceMonitor.scrapeTimeout | quote }}
|
||||
{{- end }}
|
||||
honorLabels: true
|
||||
path: /metrics
|
||||
{{- with .Values.envoy.prometheus.serviceMonitor.relabelings }}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{{- if or
|
||||
(and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm"))
|
||||
(and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm"))
|
||||
(and (or .Values.agent .Values.hubble.relay.enabled .Values.hubble.ui.enabled) .Values.hubble.enabled .Values.hubble.tls.enabled .Values.hubble.tls.auto.enabled (eq .Values.hubble.tls.auto.method "helm"))
|
||||
(and .Values.tls.ca.key .Values.tls.ca.cert)
|
||||
-}}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and ( or (.Values.agent) (.Values.operator.enabled) .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) (not .Values.preflight.enabled) }}
|
||||
{{- if and ( or (.Values.agent) (.Values.operator.enabled) .Values.clustermesh.useAPIServer) (not .Values.preflight.enabled) }}
|
||||
{{- /* Default values with backwards compatibility */ -}}
|
||||
{{- $defaultBpfMapDynamicSizeRatio := 0.0 -}}
|
||||
{{- $defaultBpfMasquerade := "false" -}}
|
||||
|
|
@ -15,6 +15,7 @@
|
|||
{{- $defaultK8sClientQPS := 5 -}}
|
||||
{{- $defaultK8sClientBurst := 10 -}}
|
||||
{{- $defaultDNSProxyEnableTransparentMode := "false" -}}
|
||||
{{- $defaultEnableIPv4Masquerade := "true" -}}
|
||||
{{- $envoyDS := eq (include "envoyDaemonSetEnabled" .) "true" -}}
|
||||
{{- $readSecretsOnlyFromSecretsNamespace := eq (include "readSecretsOnlyFromSecretsNamespace" .) "true" -}}
|
||||
{{- $secretSyncEnabled := eq (include "secretSyncEnabled" .) "true" -}}
|
||||
|
|
@ -61,6 +62,14 @@
|
|||
{{- $defaultKubeProxyReplacement = "false" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- /* Default values when 1.18 was initially deployed */ -}}
|
||||
{{- if semverCompare ">=1.18" (default "1.18" .Values.upgradeCompatibility) -}}
|
||||
{{- /* defaultIPv4Masquerad in ENI mode for 1.18 needed to override earlier version defaults set above when upgradeCompatibility is not specified */ -}}
|
||||
{{- if .Values.eni.enabled }}
|
||||
{{- $defaultEnableIPv4Masquerade = "false" -}}
|
||||
# Will also do this for ipv6 when ENI mode works with ipv6.
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- $ipam := (coalesce .Values.ipam.mode $defaultIPAM) -}}
|
||||
{{- $bpfCtTcpMax := (coalesce .Values.bpf.ctTcpMax $defaultBpfCtTcpMax) -}}
|
||||
{{- $bpfCtAnyMax := (coalesce .Values.bpf.ctAnyMax $defaultBpfCtAnyMax) -}}
|
||||
|
|
@ -177,6 +186,10 @@ data:
|
|||
debug-verbose: "{{ .Values.debug.verbose }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if hasKey .Values.debug "metricsSamplingInterval" }}
|
||||
metrics-sampling-interval: "{{ .Values.debug.metricsSamplingInterval }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if ne (int .Values.healthPort) 9879 }}
|
||||
# Set the TCP port for the agent health status API. This is not the port used
|
||||
# for cilium-health.
|
||||
|
|
@ -443,6 +456,11 @@ data:
|
|||
# policy map (per endpoint)
|
||||
bpf-policy-map-max: "{{ .Values.bpf.policyMapMax | int }}"
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.bpf "policyStatsMapMax" }}
|
||||
# bpf-policy-stats-map-max specifies the maximum number of entries in global
|
||||
# policy stats map
|
||||
bpf-policy-stats-map-max: "{{ .Values.bpf.policyStatsMapMax | int }}"
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.bpf "lbMapMax" }}
|
||||
# bpf-lb-map-max specifies the maximum number of entries in bpf lb service,
|
||||
# backend and affinity maps.
|
||||
|
|
@ -484,7 +502,7 @@ data:
|
|||
preallocate-bpf-maps: "{{ .Values.bpf.preallocateMaps }}"
|
||||
|
||||
# Name of the cluster. Only relevant when building a mesh of clusters.
|
||||
cluster-name: {{ .Values.cluster.name }}
|
||||
cluster-name: {{ .Values.cluster.name | quote }}
|
||||
|
||||
{{- if hasKey .Values.cluster "id" }}
|
||||
# Unique ID of the cluster. Must be unique across all conneted clusters and
|
||||
|
|
@ -511,12 +529,30 @@ data:
|
|||
routing-mode: {{ .Values.routingMode | default (ternary "native" "tunnel" .Values.gke.enabled) | quote }}
|
||||
tunnel-protocol: {{ .Values.tunnelProtocol | default "vxlan" | quote }}
|
||||
|
||||
{{- if eq .Values.routingMode "native" }}
|
||||
{{- if and .Values.ipv4.enabled .Values.enableIPv4Masquerade (not .Values.ipMasqAgent.enabled) }}
|
||||
{{- if and (ne $ipam "eni") (ne $ipam "alibabacloud") }}
|
||||
{{- if not .Values.ipv4NativeRoutingCIDR }}
|
||||
{{- fail " ipv4NativeRoutingCIDR must be set when routingMode is native"}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ipv6.enabled .Values.enableIPv6Masquerade (not .Values.ipMasqAgent.enabled) }}
|
||||
{{- if not .Values.ipv6NativeRoutingCIDR }}
|
||||
{{- fail "ipv6NativeRoutingCIDR must be set when routingMode is native" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.tunnelPort }}
|
||||
tunnel-port: {{ .Values.tunnelPort | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.tunnelSourcePortRange }}
|
||||
tunnel-source-port-range: {{ .Values.tunnelSourcePortRange | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.underlayProtocol }}
|
||||
underlay-protocol: {{ .Values.underlayProtocol | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.serviceNoBackendResponse }}
|
||||
service-no-backend-response: "{{ .Values.serviceNoBackendResponse }}"
|
||||
|
|
@ -531,9 +567,6 @@ data:
|
|||
enable-endpoint-routes: "true"
|
||||
{{- end }}
|
||||
auto-create-cilium-node-resource: "true"
|
||||
{{- if .Values.eni.updateEC2AdapterLimitViaAPI }}
|
||||
update-ec2-adapter-limit-via-api: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.eni.awsReleaseExcessIPs }}
|
||||
aws-release-excess-ips: "true"
|
||||
{{- end }}
|
||||
|
|
@ -602,7 +635,11 @@ data:
|
|||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
enable-ipv4-masquerade: {{ .Values.enableIPv4Masquerade | quote }}
|
||||
{{- if (not (kindIs "invalid" .Values.enableIPv4Masquerade)) }}
|
||||
enable-ipv4-masquerade: {{.Values.enableIPv4Masquerade | quote }}
|
||||
{{- else }}
|
||||
enable-ipv4-masquerade: {{ $defaultEnableIPv4Masquerade | quote }}
|
||||
{{- end }}
|
||||
enable-ipv4-big-tcp: {{ .Values.enableIPv4BIGTCP | quote }}
|
||||
enable-ipv6-big-tcp: {{ .Values.enableIPv6BIGTCP | quote }}
|
||||
enable-ipv6-masquerade: {{ .Values.enableIPv6Masquerade | quote }}
|
||||
|
|
@ -686,15 +723,16 @@ data:
|
|||
{{- if .Values.bandwidthManager.enabled }}
|
||||
enable-bandwidth-manager: {{ .Values.bandwidthManager.enabled | quote }}
|
||||
enable-bbr: {{ .Values.bandwidthManager.bbr | quote }}
|
||||
enable-bbr-hostns-only: {{ .Values.bandwidthManager.bbrHostNamespaceOnly | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.highScaleIPcache.enabled }}
|
||||
enable-high-scale-ipcache: {{ .Values.highScaleIPcache.enabled | quote }}
|
||||
{{ if or .Values.localRedirectPolicies.enabled .Values.localRedirectPolicy }}
|
||||
enable-local-redirect-policy: "true"
|
||||
{{- end }}
|
||||
|
||||
{{- if hasKey .Values "localRedirectPolicy" }}
|
||||
enable-local-redirect-policy: {{ .Values.localRedirectPolicy | quote }}
|
||||
{{- if .Values.localRedirectPolicies.addressMatcherCIDRs }}
|
||||
lrp-address-matcher-cidrs: {{ .Values.localRedirectPolicies.addressMatcherCIDRs | join "," | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.ipv4NativeRoutingCIDR }}
|
||||
|
|
@ -725,10 +763,6 @@ data:
|
|||
devices: {{ join " " .Values.devices | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.enableRuntimeDeviceDetection }}
|
||||
enable-runtime-device-detection: "true"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.forceDeviceDetection }}
|
||||
force-device-detection: "true"
|
||||
{{- end }}
|
||||
|
|
@ -754,12 +788,6 @@ data:
|
|||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if hasKey .Values "hostPort" }}
|
||||
{{- if eq $kubeProxyReplacement "false" }}
|
||||
enable-host-port: {{ .Values.hostPort.enabled | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if hasKey .Values "nodePort" }}
|
||||
{{- if eq $kubeProxyReplacement "false" }}
|
||||
enable-node-port: {{ .Values.nodePort.enabled | quote }}
|
||||
|
|
@ -786,7 +814,7 @@ data:
|
|||
{{- end }}
|
||||
{{- if hasKey .Values "loadBalancer" }}
|
||||
{{- if .Values.loadBalancer.standalone }}
|
||||
datapath-mode: lb-only
|
||||
bpf-lb-only: {{ .Values.loadBalancer.standalone | quote }}
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.loadBalancer "mode" }}
|
||||
bpf-lb-mode: {{ .Values.loadBalancer.mode | quote }}
|
||||
|
|
@ -804,9 +832,6 @@ data:
|
|||
enable-service-topology: {{ .Values.loadBalancer.serviceTopology | quote }}
|
||||
# {{- end }}
|
||||
|
||||
{{- if hasKey .Values.loadBalancer "experimental" }}
|
||||
enable-experimental-lb: {{ .Values.loadBalancer.experimental | quote }}
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.loadBalancer "protocolDifferentiation" }}
|
||||
bpf-lb-proto-diff: {{ .Values.loadBalancer.protocolDifferentiation.enabled | quote }}
|
||||
{{- end }}
|
||||
|
|
@ -829,7 +854,6 @@ data:
|
|||
{{- if hasKey .Values.l2NeighDiscovery "enabled" }}
|
||||
enable-l2-neigh-discovery: {{ .Values.l2NeighDiscovery.enabled | quote }}
|
||||
{{- end }}
|
||||
arping-refresh-period: {{ include "validateDuration" .Values.l2NeighDiscovery.refreshPeriod | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.pprof.enabled }}
|
||||
|
|
@ -856,6 +880,9 @@ data:
|
|||
{{- if hasKey .Values.k8s "requireIPv6PodCIDR" }}
|
||||
k8s-require-ipv6-pod-cidr: {{ .Values.k8s.requireIPv6PodCIDR | quote }}
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.k8s "apiServerURLs" }}
|
||||
k8s-api-server-urls: {{ .Values.k8s.apiServerURLs | quote }}
|
||||
{{- end }}
|
||||
{{- if and .Values.endpointRoutes .Values.endpointRoutes.enabled }}
|
||||
enable-endpoint-routes: {{ .Values.endpointRoutes.enabled | quote }}
|
||||
{{- end }}
|
||||
|
|
@ -915,6 +942,12 @@ data:
|
|||
{{- end }}
|
||||
enable-node-selector-labels: {{ .Values.nodeSelectorLabels | quote }}
|
||||
|
||||
{{- if hasKey .Values "nodeLabels" }}
|
||||
# To include or exclude matched resources from cilium node identity evaluation
|
||||
# List of labels just like --labels flag (.Values.labels)
|
||||
node-labels: {{ .Values.nodeLabels | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if hasKey .Values "synchronizeK8sNodes" }}
|
||||
synchronize-k8s-nodes: {{ .Values.synchronizeK8sNodes | quote }}
|
||||
{{- end }}
|
||||
|
|
@ -967,6 +1000,9 @@ data:
|
|||
hubble-dynamic-metrics-config-path: /dynamic-metrics-config/dynamic-metrics.yaml
|
||||
{{- end }}
|
||||
|
||||
{{- if hasKey .Values.hubble.networkPolicyCorrelation "enabled" }}
|
||||
hubble-network-policy-correlation-enabled: {{ .Values.hubble.networkPolicyCorrelation.enabled | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.hubble.redact }}
|
||||
{{- if eq .Values.hubble.redact.enabled true }}
|
||||
# Enables hubble redact capabilities
|
||||
|
|
@ -998,9 +1034,12 @@ data:
|
|||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.hubble.export }}
|
||||
hubble-export-file-max-size-mb: {{ .Values.hubble.export.fileMaxSizeMb | quote }}
|
||||
hubble-export-file-max-backups: {{ .Values.hubble.export.fileMaxBackups | quote }}
|
||||
{{- /* hubble export configurations moved, use default to make upgrades seemless */ -}}
|
||||
{{- /* TODO: remove default once v1.18 is released, remove warning in warnings.txt and add failure validation in validate.yaml */ -}}
|
||||
{{- if .Values.hubble.export.static.enabled }}
|
||||
hubble-export-file-max-size-mb: {{ .Values.hubble.export.fileMaxSizeMb | default .Values.hubble.export.static.fileMaxSizeMb | quote }}
|
||||
hubble-export-file-max-backups: {{ .Values.hubble.export.fileMaxBackups | default .Values.hubble.export.static.fileMaxBackups | quote }}
|
||||
hubble-export-file-compress: {{ .Values.hubble.export.fileCompress | default .Values.hubble.export.static.fileCompress | quote }}
|
||||
hubble-export-file-path: {{ .Values.hubble.export.static.filePath | quote }}
|
||||
hubble-export-fieldmask: {{ .Values.hubble.export.static.fieldMask | join " " | quote }}
|
||||
hubble-export-allowlist: {{ .Values.hubble.export.static.allowList | join " " | quote }}
|
||||
|
|
@ -1104,7 +1143,7 @@ data:
|
|||
{{- end }}
|
||||
|
||||
{{- if .Values.egressGateway.enabled }}
|
||||
enable-ipv4-egress-gateway: "true"
|
||||
enable-egress-gateway: "true"
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.egressGateway "reconciliationTriggerInterval" }}
|
||||
egress-gateway-reconciliation-trigger-interval: {{ .Values.egressGateway.reconciliationTriggerInterval | quote }}
|
||||
|
|
@ -1163,13 +1202,20 @@ data:
|
|||
|
||||
{{- if .Values.l2podAnnouncements.enabled }}
|
||||
enable-l2-pod-announcements: {{ .Values.l2podAnnouncements.enabled | quote }}
|
||||
{{- if .Values.l2podAnnouncements.interfacePattern }}
|
||||
l2-pod-announcements-interface-pattern: {{ .Values.l2podAnnouncements.interfacePattern | quote }}
|
||||
{{- else }}
|
||||
l2-pod-announcements-interface: {{ .Values.l2podAnnouncements.interface | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.bgpControlPlane.enabled }}
|
||||
enable-bgp-control-plane: "true"
|
||||
bgp-secrets-namespace: {{ .Values.bgpControlPlane.secretsNamespace.name | quote }}
|
||||
enable-bgp-control-plane-status-report: {{ .Values.bgpControlPlane.statusReport.enabled | quote }}
|
||||
bgp-router-id-allocation-mode: {{ .Values.bgpControlPlane.routerIDAllocation.mode | quote }}
|
||||
bgp-router-id-allocation-ip-pool: {{ .Values.bgpControlPlane.routerIDAllocation.ipPool | quote }}
|
||||
enable-bgp-legacy-origin-attribute: {{ .Values.bgpControlPlane.legacyOriginAttribute.enabled | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.pmtuDiscovery.enabled }}
|
||||
|
|
@ -1197,19 +1243,14 @@ data:
|
|||
disable-external-ip-mitigation: {{ .Values.bpf.disableExternalIPMitigation | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.ciliumEndpointSlice.enabled .Values.enableCiliumEndpointSlice }}
|
||||
{{- if .Values.ciliumEndpointSlice.enabled }}
|
||||
enable-cilium-endpoint-slice: "true"
|
||||
{{- if .Values.ciliumEndpointSlice.rateLimits }}
|
||||
ces-rate-limits: {{ .Values.ciliumEndpointSlice.rateLimits | toJson | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.ciliumEndpointSlice.sliceMode }}
|
||||
ces-slice-mode: {{ .Values.ciliumEndpointSlice.sliceMode | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if hasKey .Values "enableK8sTerminatingEndpoint" }}
|
||||
enable-k8s-terminating-endpoint: {{ .Values.enableK8sTerminatingEndpoint | quote }}
|
||||
{{- end }}
|
||||
identity-management-mode: {{ .Values.identityManagementMode | quote }}
|
||||
|
||||
{{- if hasKey .Values.sctp "enabled" }}
|
||||
enable-sctp: {{ .Values.sctp.enabled | quote }}
|
||||
|
|
@ -1298,6 +1339,7 @@ data:
|
|||
{{- if .Values.dnsProxy.proxyResponseMaxDelay }}
|
||||
tofqdns-proxy-response-max-delay: {{ .Values.dnsProxy.proxyResponseMaxDelay | quote }}
|
||||
{{- end }}
|
||||
tofqdns-preallocate-identities: {{ .Values.dnsProxy.preAllocateIdentities | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if hasKey .Values "agentNotReadyTaintKey" }}
|
||||
|
|
@ -1333,10 +1375,15 @@ data:
|
|||
proxy-idle-timeout-seconds: {{ .Values.envoy.idleTimeoutDurationSeconds | quote }}
|
||||
proxy-max-concurrent-retries: {{ .Values.envoy.maxConcurrentRetries | quote }}
|
||||
http-retry-count: {{ .Values.envoy.httpRetryCount | quote }}
|
||||
http-stream-idle-timeout: {{ .Values.envoy.streamIdleTimeoutDurationSeconds | quote }}
|
||||
|
||||
external-envoy-proxy: {{ include "envoyDaemonSetEnabled" . | quote }}
|
||||
envoy-base-id: {{ .Values.envoy.baseID | quote }}
|
||||
|
||||
{{- if .Values.envoy.httpUpstreamLingerTimeout }}
|
||||
envoy-http-upstream-linger-timeout: {{ .Values.envoy.httpUpstreamLingerTimeout | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.envoy.policyRestoreTimeoutDuration }}
|
||||
envoy-policy-restore-timeout: {{ .Values.envoy.policyRestoreTimeoutDuration | quote }}
|
||||
{{- end }}
|
||||
|
|
@ -1357,6 +1404,7 @@ data:
|
|||
{{- end }}
|
||||
clustermesh-enable-endpoint-sync: {{ .Values.clustermesh.enableEndpointSliceSynchronization | quote }}
|
||||
clustermesh-enable-mcs-api: {{ .Values.clustermesh.enableMCSAPISupport | quote }}
|
||||
policy-default-local-cluster: {{ .Values.clustermesh.policyDefaultLocalCluster | quote }}
|
||||
|
||||
nat-map-stats-entries: {{ .Values.nat.mapStatsEntries | quote }}
|
||||
nat-map-stats-interval: {{ .Values.nat.mapStatsInterval | quote }}
|
||||
|
|
@ -1368,6 +1416,10 @@ data:
|
|||
enable-source-ip-verification: {{ .Values.daemon.enableSourceIPVerification | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if has (kindOf .Values.connectivityProbeFrequencyRatio) (list "int64" "float64") }}
|
||||
connectivity-probe-frequency-ratio: {{ .Values.connectivityProbeFrequencyRatio | quote }}
|
||||
{{- end }}
|
||||
|
||||
# Extra config allows adding arbitrary properties to the cilium config.
|
||||
# By putting it at the end of the ConfigMap, it's also possible to override existing properties.
|
||||
{{- if .Values.extraConfig }}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{{- $envoyDS := eq (include "envoyDaemonSetEnabled" .) "true" -}}
|
||||
{{- if and $envoyDS (not .Values.preflight.enabled) }}
|
||||
{{- if $envoyDS }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
|
|
|
|||
|
|
@ -97,6 +97,7 @@ spec:
|
|||
{{- with .Values.envoy.extraArgs }}
|
||||
{{- toYaml . | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
|
||||
|
|
@ -107,6 +108,8 @@ spec:
|
|||
periodSeconds: {{ .Values.envoy.startupProbe.periodSeconds }}
|
||||
successThreshold: 1
|
||||
initialDelaySeconds: 5
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
|
||||
|
|
@ -117,6 +120,7 @@ spec:
|
|||
successThreshold: 1
|
||||
failureThreshold: {{ .Values.envoy.livenessProbe.failureThreshold }}
|
||||
timeoutSeconds: 5
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
|
||||
|
|
@ -138,6 +142,15 @@ spec:
|
|||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- if and .Values.k8sServiceHostRef.name .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Values.k8sServiceHostRef.name }}
|
||||
key: {{ .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: {{ include "k8sServicePort" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.k8sServiceHost }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: {{ include "k8sServiceHost" . }}
|
||||
|
|
|
|||
|
|
@ -34,6 +34,9 @@ spec:
|
|||
endpoints:
|
||||
- port: envoy-metrics
|
||||
interval: {{ .Values.envoy.prometheus.serviceMonitor.interval | quote }}
|
||||
{{- if .Values.envoy.prometheus.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.envoy.prometheus.serviceMonitor.scrapeTimeout | quote }}
|
||||
{{- end }}
|
||||
honorLabels: true
|
||||
path: /metrics
|
||||
{{- with .Values.envoy.prometheus.serviceMonitor.relabelings }}
|
||||
|
|
|
|||
|
|
@ -12,5 +12,18 @@ metadata:
|
|||
data:
|
||||
flowlogs.yaml: |
|
||||
flowLogs:
|
||||
{{ .Values.hubble.export.dynamic.config.content | toYaml | indent 4 }}
|
||||
{{- /* hubble export configurations moved, use default to make upgrades seemless */ -}}
|
||||
{{- /* TODO: remove default once v1.18 is released, remove warning in warnings.txt and add failure validation in validate.yaml */ -}}
|
||||
{{- range .Values.hubble.export.dynamic.config.content }}
|
||||
{{- if hasKey $.Values.hubble.export "fileMaxSizeMb" }}
|
||||
{{- $_ := set . "fileMaxSizeMb" (get $.Values.hubble.export "fileMaxSizeMb") -}}
|
||||
{{- end }}
|
||||
{{- if hasKey $.Values.hubble.export "fileMaxBackups" }}
|
||||
{{- $_ := set . "fileMaxBackups" (get $.Values.hubble.export "fileMaxBackups") -}}
|
||||
{{- end }}
|
||||
{{- if hasKey $.Values.hubble.export "fileCompress" }}
|
||||
{{- $_ := set . "fileCompress" (get $.Values.hubble.export "fileCompress") -}}
|
||||
{{- end }}
|
||||
{{- list . | toYaml | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -22,11 +22,15 @@ spec:
|
|||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
{{- if .Values.ingressController.service.insecureNodePort }}
|
||||
nodePort: {{ .Values.ingressController.service.insecureNodePort }}
|
||||
{{- end }}
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
{{- if .Values.ingressController.service.secureNodePort }}
|
||||
nodePort: {{ .Values.ingressController.service.secureNodePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingressController.hostNetwork.enabled }}
|
||||
type: ClusterIP
|
||||
{{- else }}
|
||||
|
|
@ -41,7 +45,7 @@ spec:
|
|||
{{- if .Values.ingressController.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.ingressController.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingressController.service.externalTrafficPolicy }}
|
||||
{{- if and .Values.ingressController.service.externalTrafficPolicy (not .Values.ingressController.hostNetwork.enabled) }}
|
||||
externalTrafficPolicy: {{ .Values.ingressController.service.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
---
|
||||
|
|
|
|||
|
|
@ -69,7 +69,7 @@ rules:
|
|||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
{{- if .Values.clustermesh.enableEndpointSliceSynchronization }}
|
||||
{{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }}
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
|
|
@ -164,6 +164,9 @@ rules:
|
|||
verbs:
|
||||
# To synchronize garbage collection of such resources
|
||||
- update
|
||||
{{- if (or (eq .Values.identityManagementMode "operator") (eq .Values.identityManagementMode "both")) }}
|
||||
- create
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
|
|
@ -236,7 +239,6 @@ rules:
|
|||
- ciliumendpoints.cilium.io
|
||||
- ciliumendpointslices.cilium.io
|
||||
- ciliumenvoyconfigs.cilium.io
|
||||
- ciliumexternalworkloads.cilium.io
|
||||
- ciliumidentities.cilium.io
|
||||
- ciliumlocalredirectpolicies.cilium.io
|
||||
- ciliumnetworkpolicies.cilium.io
|
||||
|
|
@ -245,6 +247,7 @@ rules:
|
|||
- ciliumcidrgroups.cilium.io
|
||||
- ciliuml2announcementpolicies.cilium.io
|
||||
- ciliumpodippools.cilium.io
|
||||
- ciliumgatewayclassconfigs.cilium.io
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
|
|
@ -316,6 +319,12 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- gatewayclasses
|
||||
verbs:
|
||||
- patch
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
|
|
@ -327,6 +336,21 @@ rules:
|
|||
verbs:
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
- ciliumgatewayclassconfigs
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
- ciliumgatewayclassconfigs/status
|
||||
verbs:
|
||||
- update
|
||||
- patch
|
||||
{{- end }}
|
||||
{{- if or .Values.gatewayAPI.enabled .Values.clustermesh.enableMCSAPISupport }}
|
||||
- apiGroups:
|
||||
|
|
|
|||
|
|
@ -142,6 +142,15 @@ spec:
|
|||
key: ALIBABA_CLOUD_ACCESS_KEY_SECRET
|
||||
optional: true
|
||||
{{- end }}
|
||||
{{- if and .Values.k8sServiceHostRef.name .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Values.k8sServiceHostRef.name }}
|
||||
key: {{ .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: {{ include "k8sServicePort" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.k8sServiceHost }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: {{ include "k8sServiceHost" . }}
|
||||
|
|
@ -299,6 +308,10 @@ spec:
|
|||
tolerations:
|
||||
{{- toYaml . | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if hasKey .Values "agentNotReadyTaintKey" }}
|
||||
- key: {{ .Values.agentNotReadyTaintKey }}
|
||||
operator: Exists
|
||||
{{ end}}
|
||||
volumes:
|
||||
# To read the configuration from the config map
|
||||
- name: cilium-config-path
|
||||
|
|
|
|||
|
|
@ -24,6 +24,13 @@ spec:
|
|||
{{- with $component.minAvailable }}
|
||||
minAvailable: {{ . }}
|
||||
{{- end }}
|
||||
{{- if (semverCompare ">= 1.27-0" .Capabilities.KubeVersion.Version) }}
|
||||
{{- if hasKey $component "unhealthyPodEvictionPolicy" }}
|
||||
{{- with $component.unhealthyPodEvictionPolicy }}
|
||||
unhealthyPodEvictionPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
io.cilium/app: operator
|
||||
|
|
|
|||
|
|
@ -75,5 +75,5 @@ roleRef:
|
|||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ .Values.serviceAccounts.operator.name | quote }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -33,6 +33,9 @@ spec:
|
|||
endpoints:
|
||||
- port: metrics
|
||||
interval: {{ .Values.operator.prometheus.serviceMonitor.interval | quote }}
|
||||
{{- if .Values.operator.prometheus.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.operator.prometheus.serviceMonitor.scrapeTimeout | quote }}
|
||||
{{- end }}
|
||||
honorLabels: true
|
||||
path: /metrics
|
||||
{{- with .Values.operator.prometheus.serviceMonitor.relabelings }}
|
||||
|
|
|
|||
|
|
@ -42,6 +42,9 @@ rules:
|
|||
- pods
|
||||
- endpoints
|
||||
- nodes
|
||||
{{- if $readSecretsOnlyFromSecretsNamespace }}
|
||||
- secrets
|
||||
{{- end }}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
|
|
@ -87,14 +90,6 @@ rules:
|
|||
# until we figure out how to avoid "get" inside the preflight, and then
|
||||
# should be removed ideally.
|
||||
- get
|
||||
{{- if $readSecretsOnlyFromSecretsNamespace }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
|
|
|
|||
|
|
@ -18,6 +18,6 @@ roleRef:
|
|||
name: cilium-pre-flight
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ .Values.serviceAccounts.preflight.name | quote }}
|
||||
name: {{ .Values.serviceAccounts.preflight.name | quote }}
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -1,14 +1,16 @@
|
|||
{{- $envoyDS := eq (include "envoyDaemonSetEnabled" .) "true" -}}
|
||||
|
||||
{{- if .Values.preflight.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: cilium-pre-flight-check
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
{{- with .Values.preflight.annotations }}
|
||||
{{- with .Values.commonLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.preflight.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -19,10 +21,11 @@ spec:
|
|||
kubernetes.io/cluster-service: "true"
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.preflight.podAnnotations }}
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: cilium-pre-flight-check
|
||||
{{- with .Values.preflight.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/part-of: cilium
|
||||
k8s-app: cilium-pre-flight-check
|
||||
|
|
@ -84,7 +87,7 @@ spec:
|
|||
apiVersion: v1
|
||||
fieldPath: spec.nodeName
|
||||
{{- with .Values.preflight.extraEnv }}
|
||||
{{- toYaml . | trim | nindent 12 }}
|
||||
{{- toYaml . | trim | nindent 10 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: cilium-run
|
||||
|
|
@ -137,6 +140,15 @@ spec:
|
|||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
env:
|
||||
{{- if and .Values.k8sServiceHostRef.name .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Values.k8sServiceHostRef.name }}
|
||||
key: {{ .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: {{ include "k8sServicePort" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.k8sServiceHost }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: {{ include "k8sServiceHost" . }}
|
||||
|
|
@ -172,6 +184,48 @@ spec:
|
|||
{{- end }}
|
||||
terminationMessagePolicy: FallbackToLogsOnError
|
||||
{{- end }}
|
||||
{{- if $envoyDS }}
|
||||
- name: cilium-pre-flight-envoy
|
||||
image: {{ include "cilium.image" .Values.preflight.envoy.image | quote }}
|
||||
imagePullPolicy: {{ .Values.preflight.image.pullPolicy }}
|
||||
command: ["/bin/sh"]
|
||||
args:
|
||||
- -c
|
||||
- "touch /tmp/ready; sleep 1h"
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- cat
|
||||
- /tmp/ready
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- cat
|
||||
- /tmp/ready
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumeMounts:
|
||||
- name: envoy-sockets
|
||||
mountPath: /var/run/cilium/envoy/sockets
|
||||
readOnly: false
|
||||
- name: envoy-artifacts
|
||||
mountPath: /var/run/cilium/envoy/artifacts
|
||||
readOnly: true
|
||||
- name: envoy-config
|
||||
mountPath: /var/run/cilium/envoy/
|
||||
readOnly: true
|
||||
{{- with .Values.preflight.resources }}
|
||||
resources:
|
||||
{{- toYaml . | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.preflight.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | trim | nindent 14 }}
|
||||
{{- end }}
|
||||
terminationMessagePolicy: FallbackToLogsOnError
|
||||
{{- end }}
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
restartPolicy: Always
|
||||
|
|
@ -217,6 +271,24 @@ spec:
|
|||
optional: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $envoyDS }}
|
||||
- name: envoy-sockets
|
||||
hostPath:
|
||||
path: "{{ .Values.daemon.runPath }}/envoy/sockets"
|
||||
type: DirectoryOrCreate
|
||||
- name: envoy-artifacts
|
||||
hostPath:
|
||||
path: "{{ .Values.daemon.runPath }}/envoy/artifacts"
|
||||
type: DirectoryOrCreate
|
||||
- name: envoy-config
|
||||
configMap:
|
||||
name: {{ .Values.envoy.bootstrapConfigMap | default "cilium-envoy-config" | quote }}
|
||||
# note: the leading zero means this number is in octal representation: do not remove it
|
||||
defaultMode: 0400
|
||||
items:
|
||||
- key: bootstrap-config.json
|
||||
path: bootstrap-config.json
|
||||
{{- end }}
|
||||
{{- with .Values.preflight.extraVolumes }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ metadata:
|
|||
app.kubernetes.io/name: cilium-pre-flight-check
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
|
|
@ -64,7 +64,16 @@ spec:
|
|||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- if .Values.k8sServiceHost }}
|
||||
{{- if and .Values.k8sServiceHostRef.name .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Values.k8sServiceHostRef.name }}
|
||||
key: {{ .Values.k8sServiceHostRef.key }}
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: {{ include "k8sServicePort" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.k8sServiceHost }}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: {{ include "k8sServiceHost" . }}
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
|
|
|
|||
|
|
@ -24,6 +24,13 @@ spec:
|
|||
{{- with $component.minAvailable }}
|
||||
minAvailable: {{ . }}
|
||||
{{- end }}
|
||||
{{- if (semverCompare ">= 1.27-0" .Capabilities.KubeVersion.Version) }}
|
||||
{{- if hasKey $component "unhealthyPodEvictionPolicy" }}
|
||||
{{- with $component.unhealthyPodEvictionPolicy }}
|
||||
unhealthyPodEvictionPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: cilium-pre-flight-check-deployment
|
||||
|
|
|
|||
|
|
@ -20,4 +20,8 @@ metadata:
|
|||
{{- with $.Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- with $.Values.secretsNamespaceAnnotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.serviceAccounts.clustermeshApiserver.create .Values.rbac.create }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.serviceAccounts.clustermeshApiserver.create .Values.rbac.create (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (eq "true" (include "identityAllocationCRD" .)) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
|
|
@ -13,40 +13,13 @@ metadata:
|
|||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if .Values.externalWorkloads.enabled }}
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
- ciliumnodes
|
||||
- ciliumendpoints
|
||||
- ciliumidentities
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
- ciliumexternalworkloads/status
|
||||
- ciliumnodes
|
||||
- ciliumidentities
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
- ciliumendpoints
|
||||
- ciliumendpoints/status
|
||||
verbs:
|
||||
- patch
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
- ciliumidentities
|
||||
{{- if .Values.externalWorkloads.enabled }}
|
||||
- ciliumexternalworkloads
|
||||
{{- end }}
|
||||
- ciliumendpoints
|
||||
- ciliumnodes
|
||||
- ciliumendpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.serviceAccounts.clustermeshApiserver.create .Values.rbac.create }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.serviceAccounts.clustermeshApiserver.create .Values.rbac.create (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (eq "true" (include "identityAllocationCRD" .)) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) }}
|
||||
{{- if .Values.clustermesh.useAPIServer }}
|
||||
{{- if not (list "legacy" "migration" "cluster" | has .Values.clustermesh.apiserver.tls.authMode) -}}
|
||||
{{- fail ".Values.clustermesh.apiserver.tls.authMode must be one of legacy, migration, cluster" -}}
|
||||
{{- end -}}
|
||||
|
|
@ -23,9 +23,16 @@ spec:
|
|||
selector:
|
||||
matchLabels:
|
||||
k8s-app: clustermesh-apiserver
|
||||
{{- with .Values.clustermesh.apiserver.updateStrategy }}
|
||||
{{- if eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "external" }}
|
||||
{{/* without proper locking in kvstoremesh we can't run multiple pods at once */}}
|
||||
strategy:
|
||||
type: Recreate
|
||||
{{- else }}
|
||||
{{- with .Values.clustermesh.apiserver.updateStrategy }}
|
||||
strategy:
|
||||
# -- The priority class to use for clustermesh-apiserver
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
|
|
@ -33,6 +40,7 @@ spec:
|
|||
{{- with .Values.clustermesh.apiserver.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
kubectl.kubernetes.io/default-container: apiserver
|
||||
labels:
|
||||
app.kubernetes.io/part-of: cilium
|
||||
app.kubernetes.io/name: clustermesh-apiserver
|
||||
|
|
@ -52,6 +60,7 @@ spec:
|
|||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal" }}
|
||||
initContainers:
|
||||
- name: etcd-init
|
||||
image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }}
|
||||
|
|
@ -104,7 +113,9 @@ spec:
|
|||
resources:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal" }}
|
||||
- name: etcd
|
||||
# The clustermesh-apiserver container image includes an etcd binary.
|
||||
image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }}
|
||||
|
|
@ -118,23 +129,21 @@ spec:
|
|||
- --trusted-ca-file=/var/lib/etcd-secrets/ca.crt
|
||||
- --cert-file=/var/lib/etcd-secrets/tls.crt
|
||||
- --key-file=/var/lib/etcd-secrets/tls.key
|
||||
# Surrounding the IPv4 address with brackets works in this case, since etcd
|
||||
# uses net.SplitHostPort() internally and it accepts the that format.
|
||||
- --listen-client-urls=https://127.0.0.1:2379,https://[$(HOSTNAME_IP)]:2379
|
||||
- --advertise-client-urls=https://[$(HOSTNAME_IP)]:2379
|
||||
- --listen-client-urls=https://0.0.0.0:2379
|
||||
# We advertise localhost as client URLs for convenience, even though
|
||||
# technically not correct. However, it doesn't matter, as this is a
|
||||
# single replica cluster, and clients directly connect to it via the
|
||||
# address provided as part of their configuration.
|
||||
- --advertise-client-urls=https://localhost:2379
|
||||
- --initial-cluster-token=$(INITIAL_CLUSTER_TOKEN)
|
||||
- --auto-compaction-retention=1
|
||||
{{- if .Values.clustermesh.apiserver.metrics.etcd.enabled }}
|
||||
- --listen-metrics-urls=http://[$(HOSTNAME_IP)]:{{ .Values.clustermesh.apiserver.metrics.etcd.port }}
|
||||
- --listen-metrics-urls=http://0.0.0.0:{{ .Values.clustermesh.apiserver.metrics.etcd.port }}
|
||||
- --metrics={{ .Values.clustermesh.apiserver.metrics.etcd.mode }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: ETCDCTL_API
|
||||
value: "3"
|
||||
- name: HOSTNAME_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: INITIAL_CLUSTER_TOKEN
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
|
|
@ -170,6 +179,8 @@ spec:
|
|||
lifecycle:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq "true" (include "identityAllocationCRD" .) }}
|
||||
- name: apiserver
|
||||
image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }}
|
||||
imagePullPolicy: {{ .Values.clustermesh.apiserver.image.pullPolicy }}
|
||||
|
|
@ -193,7 +204,6 @@ spec:
|
|||
- --cluster-users-enabled
|
||||
- --cluster-users-config-path=/var/lib/cilium/etcd-config/users.yaml
|
||||
{{- end }}
|
||||
- --enable-external-workloads={{ .Values.externalWorkloads.enabled }}
|
||||
{{- if .Values.clustermesh.apiserver.metrics.enabled }}
|
||||
- --prometheus-serve-addr=:{{ .Values.clustermesh.apiserver.metrics.port }}
|
||||
- --controller-group-metrics=all
|
||||
|
|
@ -201,6 +211,9 @@ spec:
|
|||
{{- if .Values.clustermesh.enableMCSAPISupport }}
|
||||
- --clustermesh-enable-mcs-api
|
||||
{{- end }}
|
||||
{{- if .Values.ciliumEndpointSlice.enabled }}
|
||||
- --enable-cilium-endpoint-slice
|
||||
{{- end }}
|
||||
{{- with .Values.clustermesh.apiserver.extraArgs }}
|
||||
{{- toYaml . | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -266,6 +279,7 @@ spec:
|
|||
lifecycle:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.clustermesh.apiserver.kvstoremesh.enabled }}
|
||||
- name: kvstoremesh
|
||||
image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }}
|
||||
|
|
@ -281,7 +295,9 @@ spec:
|
|||
- --cluster-id=$(CLUSTER_ID)
|
||||
- --kvstore-opt=etcd.config=/var/lib/cilium/etcd-config.yaml
|
||||
- --kvstore-opt=etcd.qps=100
|
||||
{{- if ne .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "external" }}
|
||||
- --kvstore-opt=etcd.bootstrapQps=10000
|
||||
{{- end }}
|
||||
- --kvstore-opt=etcd.maxInflight=10
|
||||
- --clustermesh-config=/var/lib/cilium/clustermesh
|
||||
{{- if hasKey .Values.clustermesh "maxConnectedClusters" }}
|
||||
|
|
@ -292,6 +308,7 @@ spec:
|
|||
- --prometheus-serve-addr=:{{ .Values.clustermesh.apiserver.metrics.kvstoremesh.port }}
|
||||
- --controller-group-metrics=all
|
||||
{{- end }}
|
||||
- --enable-heartbeat={{ eq "true" (include "identityAllocationCRD" .) | ternary "false" "true" }}
|
||||
{{- with .Values.clustermesh.apiserver.kvstoremesh.extraArgs }}
|
||||
{{- toYaml . | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -330,12 +347,19 @@ spec:
|
|||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") }}
|
||||
- name: etcd-admin-client
|
||||
mountPath: /var/lib/cilium/etcd-secrets
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: kvstoremesh-secrets
|
||||
mountPath: /var/lib/cilium/clustermesh
|
||||
readOnly: true
|
||||
{{- if eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "external"}}
|
||||
- name: etcd-config
|
||||
mountPath: /var/lib/cilium
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.clustermesh.apiserver.kvstoremesh.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -350,6 +374,7 @@ spec:
|
|||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") }}
|
||||
- name: etcd-server-secrets
|
||||
projected:
|
||||
# note: the leading zero means this number is in octal representation: do not remove it
|
||||
|
|
@ -404,6 +429,7 @@ spec:
|
|||
- name: etcd-data-dir
|
||||
emptyDir:
|
||||
medium: {{ ternary "Memory" "" (eq .Values.clustermesh.apiserver.etcd.storageMedium "Memory") | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.clustermesh.apiserver.kvstoremesh.enabled }}
|
||||
- name: kvstoremesh-secrets
|
||||
projected:
|
||||
|
|
@ -425,8 +451,26 @@ spec:
|
|||
path: common-etcd-client.key
|
||||
- key: tls.crt
|
||||
path: common-etcd-client.crt
|
||||
{{- if not .Values.tls.caBundle.enabled }}
|
||||
- key: ca.crt
|
||||
path: common-etcd-client-ca.crt
|
||||
{{- else }}
|
||||
- {{ .Values.tls.caBundle.useSecret | ternary "secret" "configMap" }}:
|
||||
name: {{ .Values.tls.caBundle.name }}
|
||||
optional: true
|
||||
items:
|
||||
- key: {{ .Values.tls.caBundle.key }}
|
||||
path: common-etcd-client-ca.crt
|
||||
{{- end }}
|
||||
{{- if eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "external"}}
|
||||
- configMap:
|
||||
defaultMode: 0400
|
||||
items:
|
||||
- key: etcd-config
|
||||
path: etcd-config.yaml
|
||||
name: cilium-config
|
||||
name: etcd-config
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.clustermesh.apiserver.extraVolumes }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{{- $kvstoreMetricsEnabled := and .Values.clustermesh.apiserver.kvstoremesh.enabled .Values.clustermesh.apiserver.metrics.kvstoremesh.enabled -}}
|
||||
{{- if and
|
||||
(or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer)
|
||||
.Values.clustermesh.useAPIServer
|
||||
(or .Values.clustermesh.apiserver.metrics.enabled $kvstoreMetricsEnabled .Values.clustermesh.apiserver.metrics.etcd.enabled) }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
|
@ -24,11 +24,13 @@ spec:
|
|||
clusterIP: None
|
||||
type: ClusterIP
|
||||
ports:
|
||||
{{- if .Values.clustermesh.apiserver.metrics.enabled }}
|
||||
{{- if and (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (eq "true" (include "identityAllocationCRD" .)) }}
|
||||
{{- if .Values.clustermesh.apiserver.metrics.enabled }}
|
||||
- name: apiserv-metrics
|
||||
port: {{ .Values.clustermesh.apiserver.metrics.port }}
|
||||
protocol: TCP
|
||||
targetPort: apiserv-metrics
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $kvstoreMetricsEnabled }}
|
||||
- name: kvmesh-metrics
|
||||
|
|
@ -36,11 +38,13 @@ spec:
|
|||
protocol: TCP
|
||||
targetPort: kvmesh-metrics
|
||||
{{- end }}
|
||||
{{- if .Values.clustermesh.apiserver.metrics.etcd.enabled }}
|
||||
{{- if eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal" }}
|
||||
{{- if .Values.clustermesh.apiserver.metrics.etcd.enabled }}
|
||||
- name: etcd-metrics
|
||||
port: {{ .Values.clustermesh.apiserver.metrics.etcd.port }}
|
||||
protocol: TCP
|
||||
targetPort: etcd-metrics
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
k8s-app: clustermesh-apiserver
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.podDisruptionBudget.enabled }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.podDisruptionBudget.enabled }}
|
||||
{{- $component := .Values.clustermesh.apiserver.podDisruptionBudget }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
|
|
@ -24,6 +24,13 @@ spec:
|
|||
{{- with $component.minAvailable }}
|
||||
minAvailable: {{ . }}
|
||||
{{- end }}
|
||||
{{- if (semverCompare ">= 1.27-0" .Capabilities.KubeVersion.Version) }}
|
||||
{{- if hasKey $component "unhealthyPodEvictionPolicy" }}
|
||||
{{- with $component.unhealthyPodEvictionPolicy }}
|
||||
unhealthyPodEvictionPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: clustermesh-apiserver
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) }}
|
||||
{{- if and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.serviceAccounts.clustermeshApiserver.create -}}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.serviceAccounts.clustermeshApiserver.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{{- $kvstoreMetricsEnabled := and .Values.clustermesh.apiserver.kvstoremesh.enabled .Values.clustermesh.apiserver.metrics.kvstoremesh.enabled -}}
|
||||
{{- if and
|
||||
(or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer)
|
||||
.Values.clustermesh.useAPIServer
|
||||
(or .Values.clustermesh.apiserver.metrics.enabled $kvstoreMetricsEnabled .Values.clustermesh.apiserver.metrics.etcd.enabled)
|
||||
.Values.clustermesh.apiserver.metrics.serviceMonitor.enabled }}
|
||||
---
|
||||
|
|
@ -11,6 +11,7 @@ metadata:
|
|||
namespace: {{ .Values.clustermesh.apiserver.metrics.serviceMonitor.namespace | default (include "cilium.namespace" .) }}
|
||||
labels:
|
||||
app.kubernetes.io/part-of: cilium
|
||||
app.kubernetes.io/name: clustermesh-apiserver
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -35,9 +36,12 @@ spec:
|
|||
matchNames:
|
||||
- {{ include "cilium.namespace" . }}
|
||||
endpoints:
|
||||
{{- if .Values.clustermesh.apiserver.metrics.enabled }}
|
||||
{{- if and .Values.clustermesh.apiserver.metrics.enabled (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (eq "true" (include "identityAllocationCRD" .)) }}
|
||||
- port: apiserv-metrics
|
||||
interval: {{ .Values.clustermesh.apiserver.metrics.serviceMonitor.interval | quote }}
|
||||
{{- if .Values.clustermesh.apiserver.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.clustermesh.apiserver.metrics.serviceMonitor.scrapeTimeout | quote }}
|
||||
{{- end }}
|
||||
honorLabels: true
|
||||
path: /metrics
|
||||
{{- with .Values.clustermesh.apiserver.metrics.serviceMonitor.relabelings }}
|
||||
|
|
@ -52,6 +56,9 @@ spec:
|
|||
{{- if $kvstoreMetricsEnabled }}
|
||||
- port: kvmesh-metrics
|
||||
interval: {{ .Values.clustermesh.apiserver.metrics.serviceMonitor.kvstoremesh.interval | quote }}
|
||||
{{- if .Values.clustermesh.apiserver.metrics.serviceMonitor.kvstoremesh.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.clustermesh.apiserver.metrics.serviceMonitor.kvstoremesh.scrapeTimeout | quote }}
|
||||
{{- end }}
|
||||
honorLabels: true
|
||||
path: /metrics
|
||||
{{- with .Values.clustermesh.apiserver.metrics.serviceMonitor.kvstoremesh.relabelings }}
|
||||
|
|
@ -63,9 +70,12 @@ spec:
|
|||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.clustermesh.apiserver.metrics.etcd.enabled }}
|
||||
{{- if and .Values.clustermesh.apiserver.metrics.etcd.enabled (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") }}
|
||||
- port: etcd-metrics
|
||||
interval: {{ .Values.clustermesh.apiserver.metrics.serviceMonitor.etcd.interval | quote }}
|
||||
{{- if .Values.clustermesh.apiserver.metrics.serviceMonitor.etcd.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.clustermesh.apiserver.metrics.serviceMonitor.etcd.scrapeTimeout | quote }}
|
||||
{{- end }}
|
||||
honorLabels: true
|
||||
path: /metrics
|
||||
{{- with .Values.clustermesh.apiserver.metrics.serviceMonitor.etcd.relabelings }}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
{{- if and (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal")) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
|
|
|
|||
|
|
@ -1,22 +0,0 @@
|
|||
{{- if and .Values.externalWorkloads.enabled .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: clustermesh-apiserver-client-cert
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
{{- with .Values.commonLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.clustermesh.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
issuerRef:
|
||||
{{- toYaml .Values.clustermesh.apiserver.tls.auto.certManagerIssuerRef | nindent 4 }}
|
||||
secretName: clustermesh-apiserver-client-cert
|
||||
commonName: externalworkload
|
||||
duration: {{ printf "%dh0m0s" (mul .Values.clustermesh.apiserver.tls.auto.certValidityDuration 24) }}
|
||||
{{- end }}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
{{- if and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
{{- if and (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal")) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
|
|
|
|||
|
|
@ -13,6 +13,10 @@ spec:
|
|||
- name: certgen
|
||||
image: {{ include "cilium.image" .Values.certgen.image | quote }}
|
||||
imagePullPolicy: {{ .Values.certgen.image.pullPolicy }}
|
||||
{{- with .Values.certgen.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- "/usr/bin/cilium-certgen"
|
||||
args:
|
||||
|
|
@ -76,16 +80,6 @@ spec:
|
|||
- client auth
|
||||
validity: {{ $certValidityStr }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalWorkloads.enabled }}
|
||||
- name: clustermesh-apiserver-client-cert
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
commonName: "externalworkload"
|
||||
usage:
|
||||
- signing
|
||||
- key encipherment
|
||||
- client auth
|
||||
validity: {{ $certValidityStr }}
|
||||
{{- end }}
|
||||
{{- with .Values.certgen.extraVolumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") .Values.clustermesh.apiserver.tls.auto.schedule }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") .Values.clustermesh.apiserver.tls.auto.schedule }}
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") }}
|
||||
{{- if and (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal")) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") }}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") .Values.serviceAccounts.clustermeshcertgen.create }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") .Values.serviceAccounts.clustermeshcertgen.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") .Values.serviceAccounts.clustermeshcertgen.create }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") .Values.serviceAccounts.clustermeshcertgen.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") .Values.serviceAccounts.clustermeshcertgen.create }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "cronJob") .Values.serviceAccounts.clustermeshcertgen.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
|
||||
{{- if and ( and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal")) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
|
||||
{{- $_ := include "cilium.ca.setup" . -}}
|
||||
{{- $cn := include "clustermesh-apiserver-generate-certs.admin-common-name" . -}}
|
||||
{{- $cert := genSignedCert $cn nil nil (.Values.clustermesh.apiserver.tls.auto.certValidityDuration | int) .commonCA -}}
|
||||
|
|
|
|||
|
|
@ -1,24 +0,0 @@
|
|||
{{- if and .Values.externalWorkloads.enabled .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
|
||||
{{- $_ := include "cilium.ca.setup" . -}}
|
||||
{{- $cn := "externalworkload" }}
|
||||
{{- $cert := genSignedCert $cn nil nil (.Values.clustermesh.apiserver.tls.auto.certValidityDuration | int) .commonCA -}}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: clustermesh-apiserver-client-cert
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
{{- with .Values.commonLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.clustermesh.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ .commonCA.Cert | b64enc }}
|
||||
tls.crt: {{ $cert.Cert | b64enc }}
|
||||
tls.key: {{ $cert.Key | b64enc }}
|
||||
{{- end }}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
|
||||
{{- $_ := include "cilium.ca.setup" . -}}
|
||||
{{- $cn := include "clustermesh-apiserver-generate-certs.local-common-name" . -}}
|
||||
{{- $cert := genSignedCert $cn nil nil (.Values.clustermesh.apiserver.tls.auto.certValidityDuration | int) .commonCA -}}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
|
||||
{{- if and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
|
||||
{{- $_ := include "cilium.ca.setup" . -}}
|
||||
{{- $cn := include "clustermesh-apiserver-generate-certs.remote-common-name" . -}}
|
||||
{{- $cert := genSignedCert $cn nil nil (.Values.clustermesh.apiserver.tls.auto.certValidityDuration | int) .commonCA -}}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
|
||||
{{- if and (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal")) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
|
||||
{{- $_ := include "cilium.ca.setup" . -}}
|
||||
{{- $cn := "clustermesh-apiserver.cilium.io" }}
|
||||
{{- $ip := concat (list "127.0.0.1" "::1") .Values.clustermesh.apiserver.tls.server.extraIpAddresses }}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) (not .Values.clustermesh.apiserver.tls.auto.enabled) }}
|
||||
{{- if and (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal")) (not .Values.clustermesh.apiserver.tls.auto.enabled) }}
|
||||
{{- if .Values.clustermesh.apiserver.tls.enableSecrets }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
|
|
|
|||
|
|
@ -1,22 +0,0 @@
|
|||
{{- if and .Values.externalWorkloads.enabled (not .Values.clustermesh.apiserver.tls.auto.enabled) }}
|
||||
{{- if .Values.clustermesh.apiserver.tls.enableSecrets }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: clustermesh-apiserver-client-cert
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
{{- with .Values.clustermesh.annotations }}
|
||||
{{- with .Values.commonLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ .Values.tls.ca.cert }}
|
||||
tls.crt: {{ .Values.clustermesh.apiserver.tls.client.cert | required "missing clustermesh.apiserver.tls.client.cert" }}
|
||||
tls.key: {{ .Values.clustermesh.apiserver.tls.client.key | required "missing clustermesh.apiserver.tls.client.key" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and .Values.clustermesh.useAPIServer (not .Values.clustermesh.apiserver.tls.auto.enabled) }}
|
||||
{{- if and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (not .Values.clustermesh.apiserver.tls.auto.enabled) }}
|
||||
{{- if .Values.clustermesh.apiserver.tls.enableSecrets }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) (not .Values.clustermesh.apiserver.tls.auto.enabled) }}
|
||||
{{- if and (and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal")) (not .Values.clustermesh.apiserver.tls.auto.enabled) }}
|
||||
{{- if .Values.clustermesh.apiserver.tls.enableSecrets }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{{- if and
|
||||
(or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer)
|
||||
(and .Values.clustermesh.useAPIServer (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "internal") (eq "true" (include "identityAllocationCRD" .)))
|
||||
(ne .Values.clustermesh.apiserver.tls.authMode "legacy")
|
||||
}}
|
||||
---
|
||||
|
|
|
|||
|
|
@ -2,6 +2,8 @@
|
|||
{{- $cluster := index . 0 -}}
|
||||
{{- $domain := index . 1 -}}
|
||||
{{- $override := index . 2 -}}
|
||||
{{- $local_etcd := index . 3 -}}
|
||||
{{- $etcd_config := index . 4 -}}
|
||||
{{- /* The parenthesis around $cluster.tls are required, since it can be null: https://stackoverflow.com/a/68807258 */}}
|
||||
{{- $prefix := ternary "common-" (printf "%s." $cluster.name) (or (empty ($cluster.tls).cert) (empty ($cluster.tls).key)) -}}
|
||||
{{- /* KVStoreMesh is enabled, and we are generating the secret used by Cilium agents. */}}
|
||||
|
|
@ -12,15 +14,24 @@
|
|||
{{- end -}}
|
||||
|
||||
endpoints:
|
||||
{{- if ne $override "" }}
|
||||
{{- if $local_etcd }}
|
||||
{{ $etcd_config.endpoints | toYaml }}
|
||||
{{- else if ne $override "" }}
|
||||
- {{ $override }}
|
||||
{{- else if $cluster.ips }}
|
||||
- https://{{ $cluster.name }}.{{ $domain }}:{{ $cluster.port }}
|
||||
{{- else }}
|
||||
- https://{{ $cluster.address | required "missing clustermesh.apiserver.config.clusters.address" }}:{{ $cluster.port }}
|
||||
{{- end }}
|
||||
{{- if $local_etcd }}
|
||||
{{- if $etcd_config.ssl }}
|
||||
trusted-ca-file: '/var/lib/etcd-secrets/etcd-client-ca.crt'
|
||||
key-file: '/var/lib/etcd-secrets/etcd-client.key'
|
||||
cert-file: '/var/lib/etcd-secrets/etcd-client.crt'
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if or (ne $override "") (not (empty ($cluster.tls).caCert)) }}
|
||||
{{- /* The custom CA configuration takes effect only if a custom certificate and key are also set, */}}
|
||||
{{- /* The custom CA configuration takes effect only if a custom certificate and key are also set */}}
|
||||
{{- /* otherwise we may enter this branch, but the prefix is still set to common-. */}}
|
||||
{{- /* Additionally, when KVStoreMesh is enabled, and we are generating the secret for the agents, */}}
|
||||
{{- /* we want to always use the corresponding CA certificate, that is the one with local- prefix. */}}
|
||||
|
|
@ -31,3 +42,4 @@ trusted-ca-file: /var/lib/cilium/clustermesh/common-etcd-client-ca.crt
|
|||
key-file: /var/lib/cilium/clustermesh/{{ $prefix }}etcd-client.key
|
||||
cert-file: /var/lib/cilium/clustermesh/{{ $prefix }}etcd-client.crt
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -17,8 +17,9 @@ metadata:
|
|||
data:
|
||||
{{- $kvstoremesh := and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled }}
|
||||
{{- $override := ternary (printf "https://clustermesh-apiserver.%s.svc:2379" (include "cilium.namespace" .)) "" $kvstoremesh }}
|
||||
{{- $local_etcd := and $kvstoremesh (eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "external") }}
|
||||
{{- range .Values.clustermesh.config.clusters }}
|
||||
{{ .name }}: {{ include "clustermesh-config-generate-etcd-cfg" (list . $.Values.clustermesh.config.domain $override) | b64enc }}
|
||||
{{ .name }}: {{ include "clustermesh-config-generate-etcd-cfg" (list . $.Values.clustermesh.config.domain $override $local_etcd $.Values.etcd ) | b64enc }}
|
||||
{{- /* The parenthesis around .tls are required, since it can be null: https://stackoverflow.com/a/68807258 */}}
|
||||
{{- if and (eq $override "") (.tls).cert (.tls).key }}
|
||||
{{- if .tls.caCert }}
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ metadata:
|
|||
{{- end }}
|
||||
data:
|
||||
{{- range .Values.clustermesh.config.clusters }}
|
||||
{{ .name }}: {{ include "clustermesh-config-generate-etcd-cfg" (list . $.Values.clustermesh.config.domain "") | b64enc }}
|
||||
{{ .name }}: {{ include "clustermesh-config-generate-etcd-cfg" (list . $.Values.clustermesh.config.domain "" false $.Values.etcd ) | b64enc }}
|
||||
{{- /* The parenthesis around .tls are required, since it can be null: https://stackoverflow.com/a/68807258 */}}
|
||||
{{- if and (.tls).cert (.tls).key }}
|
||||
{{- if .tls.caCert }}
|
||||
|
|
|
|||
|
|
@ -24,6 +24,13 @@ spec:
|
|||
{{- with $component.minAvailable }}
|
||||
minAvailable: {{ . }}
|
||||
{{- end }}
|
||||
{{- if (semverCompare ">= 1.27-0" .Capabilities.KubeVersion.Version) }}
|
||||
{{- if hasKey $component "unhealthyPodEvictionPolicy" }}
|
||||
{{- with $component.unhealthyPodEvictionPolicy }}
|
||||
unhealthyPodEvictionPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: hubble-relay
|
||||
|
|
|
|||
|
|
@ -5,6 +5,8 @@ metadata:
|
|||
name: hubble-relay
|
||||
namespace: {{ .Values.hubble.relay.prometheus.serviceMonitor.namespace | default (include "cilium.namespace" .) }}
|
||||
labels:
|
||||
app.kubernetes.io/part-of: cilium
|
||||
app.kubernetes.io/name: hubble-relay
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -31,6 +33,9 @@ spec:
|
|||
endpoints:
|
||||
- port: metrics
|
||||
interval: {{ .Values.hubble.relay.prometheus.serviceMonitor.interval | quote }}
|
||||
{{- if .Values.hubble.relay.prometheus.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.hubble.relay.prometheus.serviceMonitor.scrapeTimeout | quote }}
|
||||
{{- end }}
|
||||
path: /metrics
|
||||
{{- with .Values.hubble.relay.prometheus.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
|
|
|
|||
|
|
@ -31,10 +31,11 @@ server {
|
|||
sub_filter '<base href="/"/>' '<base href="{{ .Values.hubble.ui.baseUrl }}"/>';
|
||||
{{- end }}
|
||||
location {{ .Values.hubble.ui.baseUrl }} {
|
||||
if ($http_user_agent ~* "kube-probe") { access_log off; }
|
||||
{{- if not (eq .Values.hubble.ui.baseUrl "/") }}
|
||||
rewrite ^{{ (trimSuffix "/" .Values.hubble.ui.baseUrl) }}(/.*)$ $1 break;
|
||||
{{- end }}
|
||||
# double `/index.html` is required here
|
||||
# double `/index.html` is required here
|
||||
try_files $uri $uri/ /index.html /index.html;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -24,6 +24,13 @@ spec:
|
|||
{{- with $component.minAvailable }}
|
||||
minAvailable: {{ . }}
|
||||
{{- end }}
|
||||
{{- if (semverCompare ">= 1.27-0" .Capabilities.KubeVersion.Version) }}
|
||||
{{- if hasKey $component "unhealthyPodEvictionPolicy" }}
|
||||
{{- with $component.unhealthyPodEvictionPolicy }}
|
||||
unhealthyPodEvictionPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: hubble-ui
|
||||
|
|
|
|||
|
|
@ -21,6 +21,9 @@ metadata:
|
|||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.hubble.ui.service.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
spec:
|
||||
type: {{ .Values.hubble.ui.service.type | quote }}
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
namespace: {{ .Values.prometheus.serviceMonitor.namespace | default (include "cilium.namespace" .) }}
|
||||
labels:
|
||||
app.kubernetes.io/part-of: cilium
|
||||
|
||||
app.kubernetes.io/name: hubble
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -33,6 +33,9 @@ spec:
|
|||
endpoints:
|
||||
- port: hubble-metrics
|
||||
interval: {{ .Values.hubble.metrics.serviceMonitor.interval | quote }}
|
||||
{{- if .Values.hubble.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.hubble.metrics.serviceMonitor.scrapeTimeout | quote }}
|
||||
{{- end }}
|
||||
honorLabels: true
|
||||
path: /metrics
|
||||
{{- if .Values.hubble.metrics.tls.enabled }}
|
||||
|
|
|
|||
|
|
@ -21,6 +21,10 @@ spec:
|
|||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
{{- with .Values.certgen.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- "/usr/bin/cilium-certgen"
|
||||
# Because this is executed as a job, we pass the values as command
|
||||
|
|
|
|||
|
|
@ -3,6 +3,14 @@
|
|||
{{- $cn := "*.hubble-relay.cilium.io" }}
|
||||
{{- $dns := list $cn }}
|
||||
{{- $cert := genSignedCert $cn nil $dns (.Values.hubble.tls.auto.certValidityDuration | int) .commonCA -}}
|
||||
{{- $tls_crt := ($cert.Cert | b64enc) }}
|
||||
{{- $tls_key := ($cert.Key | b64enc) }}
|
||||
{{- with lookup "v1" "Secret" (include "cilium.namespace" .) "hubble-relay-client-certs" }}
|
||||
{{- if and (index .data "tls.crt") (index .data "tls.key") }}
|
||||
{{- $tls_key = (index .data "tls.key") }}
|
||||
{{- $tls_crt = (index .data "tls.crt") }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
|
|
@ -21,6 +29,6 @@ metadata:
|
|||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ .commonCA.Cert | b64enc }}
|
||||
tls.crt: {{ $cert.Cert | b64enc }}
|
||||
tls.key: {{ $cert.Key | b64enc }}
|
||||
tls.crt: {{ $tls_crt }}
|
||||
tls.key: {{ $tls_key }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -4,6 +4,14 @@
|
|||
{{- $ip := .Values.hubble.tls.server.extraIpAddresses }}
|
||||
{{- $dns := prepend .Values.hubble.tls.server.extraDnsNames $cn }}
|
||||
{{- $cert := genSignedCert $cn $ip $dns (.Values.hubble.tls.auto.certValidityDuration | int) .commonCA -}}
|
||||
{{- $tls_crt := ($cert.Cert | b64enc) }}
|
||||
{{- $tls_key := ($cert.Key | b64enc) }}
|
||||
{{- with lookup "v1" "Secret" (include "cilium.namespace" .) "hubble-server-certs" }}
|
||||
{{- if and (index .data "tls.crt") (index .data "tls.key") }}
|
||||
{{- $tls_key = (index .data "tls.key") }}
|
||||
{{- $tls_crt = (index .data "tls.crt") }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
|
|
@ -22,6 +30,6 @@ metadata:
|
|||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ .commonCA.Cert | b64enc }}
|
||||
tls.crt: {{ $cert.Cert | b64enc }}
|
||||
tls.key: {{ $cert.Key | b64enc }}
|
||||
tls.crt: {{ $tls_crt }}
|
||||
tls.key: {{ $tls_key }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ kind: Secret
|
|||
metadata:
|
||||
name: hubble-metrics-server-certs
|
||||
namespace: {{ include "cilium.namespace" . }}
|
||||
|
||||
|
||||
{{- with .Values.commonLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
|
|
|
|||
|
|
@ -91,7 +91,7 @@ spec:
|
|||
{{- with .Values.authentication.mutual.spire.install.agent.resources }}
|
||||
resources:
|
||||
{{- toYaml . | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /live
|
||||
|
|
|
|||
|
|
@ -29,6 +29,8 @@ spec:
|
|||
serviceName: spire-server
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: spire-server
|
||||
labels:
|
||||
app: spire-server
|
||||
{{- with .Values.commonLabels }}
|
||||
|
|
@ -75,7 +77,7 @@ spec:
|
|||
{{- with .Values.authentication.mutual.spire.install.server.resources }}
|
||||
resources:
|
||||
{{- toYaml . | trim | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 8081
|
||||
|
|
|
|||
|
|
@ -1,5 +1,13 @@
|
|||
{{/* validate deprecated options are not being used */}}
|
||||
|
||||
{{/* Options removed in v1.18 */}}
|
||||
{{- if (dig "enableCiliumEndpointSlice" "" .Values.AsMap) }}
|
||||
{{ fail "enableCiliumEndpointSlice was deprecated in v1.16 and has been removed in v1.18. For details please refer to https://docs.cilium.io/en/v1.18/operations/upgrade/#helm-options" }}
|
||||
{{- end }}
|
||||
{{- if (dig "ciliumEndpointSlice" "sliceMode" "" .Values.AsMap) }}
|
||||
{{ fail "ciliumEndpointSlice.sliceMode has been removed in v1.18. For details please refer to https://docs.cilium.io/en/v1.18/operations/upgrade/#helm-options" }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Options deprecated in v1.15 and removed in v1.16 */}}
|
||||
{{- if or
|
||||
(dig "encryption" "keyFile" "" .Values.AsMap)
|
||||
|
|
@ -42,6 +50,11 @@
|
|||
{{ fail "enableCnpStatusUpdates was deprecated in v1.14 and has been removed in v1.15. For details please refer to https://docs.cilium.io/en/v1.15/operations/upgrade/#helm-options" }}
|
||||
{{- end }}
|
||||
|
||||
{{/* validate single k8sServiceHost strategy */}}
|
||||
{{- if and (and .Values.k8sServiceHostRef.name .Values.k8sServiceHostRef.key) .Values.k8sServiceHost }}
|
||||
{{- fail "Both k8sServiceHostRef and k8sServiceHost are set. Please set only one of them." }}
|
||||
{{- end }}
|
||||
|
||||
{{/* validate hubble config */}}
|
||||
{{- if and .Values.hubble.ui.enabled (not .Values.hubble.ui.standalone.enabled) }}
|
||||
{{- if not .Values.hubble.relay.enabled }}
|
||||
|
|
@ -78,7 +91,7 @@
|
|||
{{ fail "Only one of .Values.hubble.redact.http.headers.allow, .Values.hubble.redact.http.headers.deny can be specified"}}
|
||||
{{- end }}
|
||||
|
||||
{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
{{- if and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
|
||||
{{- if not .Values.clustermesh.apiserver.tls.auto.certManagerIssuerRef }}
|
||||
{{ fail "ClusterMesh TLS certgen method=certmanager requires that user specifies .Values.clustermesh.apiserver.tls.auto.certManagerIssuerRef" }}
|
||||
{{- end }}
|
||||
|
|
@ -129,7 +142,7 @@
|
|||
{{- end }}
|
||||
|
||||
{{/* validate Cilium operator */}}
|
||||
{{- if or .Values.ciliumEndpointSlice.enabled .Values.enableCiliumEndpointSlice }}
|
||||
{{- if .Values.ciliumEndpointSlice.enabled }}
|
||||
{{- if eq .Values.disableEndpointCRD true }}
|
||||
{{ fail "if Cilium Endpoint Slice is enabled (.Values.ciliumEndpointSlice.enabled=true), it requires .Values.disableEndpointCRD=false" }}
|
||||
{{- end }}
|
||||
|
|
@ -156,29 +169,54 @@
|
|||
{{- end }}
|
||||
|
||||
{{/* validate clustermesh-apiserver */}}
|
||||
|
||||
{{- if not (list "internal" "external" | has .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode) -}}
|
||||
{{- fail ".Values.clustermesh.apiserver.kvstoremesh.kvstoreMode must have the value of external or internal" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.clustermesh.useAPIServer }}
|
||||
{{- if and (ne .Values.identityAllocationMode "crd") (ne .Values.identityAllocationMode "doublewrite-readkvstore") (ne .Values.identityAllocationMode "doublewrite-readcrd") }}
|
||||
{{ fail (printf "The clustermesh-apiserver cannot be enabled in combination with .Values.identityAllocationMode=%s. To establish a Cluster Mesh, directly configure the parameters to access the remote kvstore through .Values.clustermesh.config" .Values.identityAllocationMode ) }}
|
||||
{{- end }}
|
||||
{{- if .Values.disableEndpointCRD }}
|
||||
{{ fail "The clustermesh-apiserver cannot be enabled in combination with .Values.disableEndpointCRD=true" }}
|
||||
{{- if eq "true" (include "identityAllocationCRD" .) }}
|
||||
{{/* CRDs are used */}}
|
||||
{{- if and .Values.disableEndpointCRD }}
|
||||
{{ fail "The clustermesh-apiserver cannot be enabled in combination with .Values.disableEndpointCRD=true" }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{/* kvstore is used */}}
|
||||
{{- if not .Values.clustermesh.apiserver.kvstoremesh.enabled }}
|
||||
{{ fail (printf "The kvstoremesh container cannot be disabled in combination with .Values.identityAllocationMode=%s. To establish a Cluster Mesh, directly configure the parameters to access the remote kvstores through .Values.clustermesh.config" .Values.identityAllocationMode ) }}
|
||||
{{- end}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalWorkloads.enabled }}
|
||||
{{- if and (ne .Values.identityAllocationMode "crd") (ne .Values.identityAllocationMode "doublewrite-readkvstore") (ne .Values.identityAllocationMode "doublewrite-readcrd") }}
|
||||
{{ fail (printf "External workloads support cannot be enabled in combination with .Values.identityAllocationMode=%s" .Values.identityAllocationMode ) }}
|
||||
{{- if eq .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode "external"}}
|
||||
{{- if not .Values.clustermesh.useAPIServer }}
|
||||
{{- fail "kvstoremesh.kvstoreMode=external can only be used with clustermesh.useAPIServer=true" }}
|
||||
{{- end }}
|
||||
{{- if .Values.disableEndpointCRD }}
|
||||
{{ fail "External workloads support cannot be enabled in combination with .Values.disableEndpointCRD=true" }}
|
||||
{{- if not .Values.clustermesh.apiserver.kvstoremesh.enabled }}
|
||||
{{- fail "kvstoremesh.kvstoreMode=external can only be used with kvstoremesh.enabled=true" }}
|
||||
{{- end }}
|
||||
{{- if ne (toString .Values.clustermesh.apiserver.replicas) "1" }}
|
||||
{{- fail "Only single clustermesh-apiserver replica is allowed when kvstoreMode=external" }}
|
||||
{{- end }}
|
||||
{{- if and (ne .Values.identityAllocationMode "kvstore") (ne .Values.identityAllocationMode "doublewrite-readkvstore") (ne .Values.identityAllocationMode "doublewrite-readcrd") }}
|
||||
{{- fail (printf "KVStoreMesh with %s etcd cannot be enabled in combination with .Values.identityAllocationMode=%s" .Values.clustermesh.apiserver.kvstoremesh.kvstoreMode .Values.identityAllocationMode) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*validate ClusterMesh */}}
|
||||
{{/* validate ClusterMesh */}}
|
||||
{{- if and (ne (int .Values.clustermesh.maxConnectedClusters) 255) (ne (int .Values.clustermesh.maxConnectedClusters) 511) }}
|
||||
{{- fail "max-connected-clusters must be set to 255 or 511" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*validate Envoy baseID */}}
|
||||
{{/* validate Envoy baseID */}}
|
||||
{{- if not (and (ge (int .Values.envoy.baseID) 0) (le (int .Values.envoy.baseID) 4294967295)) }}
|
||||
{{- fail "envoy.baseID must be an int. Supported values 0 - 4294967295" }}
|
||||
{{- end }}
|
||||
|
||||
{{/* validate enableK8sClientExponentialBackoff and extraEnv to avoid duplicate env var keys */}}
|
||||
{{- if .Values.k8sClientExponentialBackoff.enabled }}
|
||||
{{- range .Values.extraEnv }}
|
||||
{{- if or (eq .name "KUBE_CLIENT_BACKOFF_BASE") (eq .name "KUBE_CLIENT_BACKOFF_DURATION") }}
|
||||
{{ fail "k8sClientExponentialBackoff cannot be enabled when extraEnv contains KUBE_CLIENT_BACKOFF_BASE or KUBE_CLIENT_BACKOFF_DURATION" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
13
packages/system/cilium/charts/cilium/templates/warnings.txt
Normal file
13
packages/system/cilium/charts/cilium/templates/warnings.txt
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
{{- define "cilium.warnings" }}
|
||||
{{- /* TODO: move this warning to a validation failure once v1.18 is released */ -}}
|
||||
{{- if or
|
||||
(hasKey .Values.hubble.export "fileMaxSizeMb")
|
||||
(hasKey .Values.hubble.export "fileMaxBackups")
|
||||
(hasKey .Values.hubble.export "fileCompress")
|
||||
-}}
|
||||
- We detected that one or more Hubble export options under 'hubble.export' are currently set
|
||||
('fileMaxSizeMb', 'fileMaxBackups', 'fileCompress'). Please note that these have moved to
|
||||
their corresponding exporter type ('hubble.export.static', 'hubble.export.dynamic.config.content')
|
||||
and will be removed in v1.19.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -449,6 +449,9 @@
|
|||
"bbr": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"bbrHostNamespaceOnly": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
|
|
@ -460,6 +463,25 @@
|
|||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"legacyOriginAttribute": {
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"routerIDAllocation": {
|
||||
"properties": {
|
||||
"ipPool": {
|
||||
"type": "string"
|
||||
},
|
||||
"mode": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"secretsNamespace": {
|
||||
"properties": {
|
||||
"create": {
|
||||
|
|
@ -646,6 +668,12 @@
|
|||
"integer"
|
||||
]
|
||||
},
|
||||
"policyStatsMapMax": {
|
||||
"type": [
|
||||
"null",
|
||||
"integer"
|
||||
]
|
||||
},
|
||||
"preallocateMaps": {
|
||||
"type": "boolean"
|
||||
},
|
||||
|
|
@ -732,6 +760,9 @@
|
|||
"priorityClassName": {
|
||||
"type": "string"
|
||||
},
|
||||
"resources": {
|
||||
"type": "object"
|
||||
},
|
||||
"tolerations": {
|
||||
"items": {},
|
||||
"type": "array"
|
||||
|
|
@ -798,12 +829,6 @@
|
|||
]
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"sliceMode": {
|
||||
"enum": [
|
||||
"identity",
|
||||
"fcfs"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -998,6 +1023,9 @@
|
|||
"healthPort": {
|
||||
"type": "integer"
|
||||
},
|
||||
"kvstoreMode": {
|
||||
"type": "string"
|
||||
},
|
||||
"lifecycle": {
|
||||
"type": "object"
|
||||
},
|
||||
|
|
@ -1093,6 +1121,12 @@
|
|||
"null",
|
||||
"array"
|
||||
]
|
||||
},
|
||||
"scrapeTimeout": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -1116,6 +1150,12 @@
|
|||
"null",
|
||||
"array"
|
||||
]
|
||||
},
|
||||
"scrapeTimeout": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -1134,6 +1174,12 @@
|
|||
"null",
|
||||
"array"
|
||||
]
|
||||
},
|
||||
"scrapeTimeout": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -1170,6 +1216,12 @@
|
|||
"integer",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"unhealthyPodEvictionPolicy": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -1424,6 +1476,9 @@
|
|||
"maxConnectedClusters": {
|
||||
"type": "integer"
|
||||
},
|
||||
"policyDefaultLocalCluster": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"useAPIServer": {
|
||||
"type": "boolean"
|
||||
}
|
||||
|
|
@ -1453,6 +1508,9 @@
|
|||
"confPath": {
|
||||
"type": "string"
|
||||
},
|
||||
"configMap": {
|
||||
"type": "string"
|
||||
},
|
||||
"configMapKey": {
|
||||
"type": "string"
|
||||
},
|
||||
|
|
@ -1471,6 +1529,9 @@
|
|||
"install": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"iptablesRemoveAWSRules": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"logFile": {
|
||||
"type": "string"
|
||||
},
|
||||
|
|
@ -1502,6 +1563,12 @@
|
|||
"object"
|
||||
]
|
||||
},
|
||||
"connectivityProbeFrequencyRatio": {
|
||||
"type": [
|
||||
"null",
|
||||
"number"
|
||||
]
|
||||
},
|
||||
"conntrackGCInterval": {
|
||||
"type": "string"
|
||||
},
|
||||
|
|
@ -1579,6 +1646,12 @@
|
|||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"metricsSamplingInterval": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"verbose": {
|
||||
"type": [
|
||||
"null",
|
||||
|
|
@ -1620,6 +1693,9 @@
|
|||
"minTtl": {
|
||||
"type": "integer"
|
||||
},
|
||||
"preAllocateIdentities": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"preCache": {
|
||||
"type": "string"
|
||||
},
|
||||
|
|
@ -1646,9 +1722,6 @@
|
|||
},
|
||||
"type": "object"
|
||||
},
|
||||
"enableCiliumEndpointSlice": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"enableCriticalPriorityClass": {
|
||||
"type": "boolean"
|
||||
},
|
||||
|
|
@ -1656,7 +1729,10 @@
|
|||
"type": "boolean"
|
||||
},
|
||||
"enableIPv4Masquerade": {
|
||||
"type": "boolean"
|
||||
"type": [
|
||||
"null",
|
||||
"boolean"
|
||||
]
|
||||
},
|
||||
"enableIPv6BIGTCP": {
|
||||
"type": "boolean"
|
||||
|
|
@ -1667,9 +1743,6 @@
|
|||
"enableInternalTrafficPolicy": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"enableK8sTerminatingEndpoint": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"enableLBIPAM": {
|
||||
"type": "boolean"
|
||||
},
|
||||
|
|
@ -1679,9 +1752,6 @@
|
|||
"enableNonDefaultDenyPolicies": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"enableRuntimeDeviceDetection": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"enableXTSocketFallback": {
|
||||
"type": "boolean"
|
||||
},
|
||||
|
|
@ -1806,9 +1876,6 @@
|
|||
"subnetTagsFilter": {
|
||||
"items": {},
|
||||
"type": "array"
|
||||
},
|
||||
"updateEC2AdapterLimitViaAPI": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -2005,6 +2072,9 @@
|
|||
"httpRetryCount": {
|
||||
"type": "integer"
|
||||
},
|
||||
"httpUpstreamLingerTimeout": {
|
||||
"type": "null"
|
||||
},
|
||||
"idleTimeoutDurationSeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
|
|
@ -2039,6 +2109,9 @@
|
|||
},
|
||||
"livenessProbe": {
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"failureThreshold": {
|
||||
"type": "integer"
|
||||
},
|
||||
|
|
@ -2173,6 +2246,9 @@
|
|||
"anyOf": [
|
||||
{
|
||||
"properties": {
|
||||
"action": {
|
||||
"type": "string"
|
||||
},
|
||||
"replacement": {
|
||||
"type": "string"
|
||||
},
|
||||
|
|
@ -2194,6 +2270,12 @@
|
|||
]
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"scrapeTimeout": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -2260,6 +2342,9 @@
|
|||
},
|
||||
"startupProbe": {
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"failureThreshold": {
|
||||
"type": "integer"
|
||||
},
|
||||
|
|
@ -2269,6 +2354,9 @@
|
|||
},
|
||||
"type": "object"
|
||||
},
|
||||
"streamIdleTimeoutDurationSeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"terminationGracePeriodSeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
|
|
@ -2357,14 +2445,6 @@
|
|||
},
|
||||
"type": "object"
|
||||
},
|
||||
"externalWorkloads": {
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"extraArgs": {
|
||||
"items": {},
|
||||
"type": "array"
|
||||
|
|
@ -2480,14 +2560,6 @@
|
|||
"healthPort": {
|
||||
"type": "integer"
|
||||
},
|
||||
"highScaleIPcache": {
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"hostFirewall": {
|
||||
"properties": {
|
||||
"enabled": {
|
||||
|
|
@ -2496,14 +2568,6 @@
|
|||
},
|
||||
"type": "object"
|
||||
},
|
||||
"hostPort": {
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"hubble": {
|
||||
"properties": {
|
||||
"annotations": {
|
||||
|
|
@ -2558,6 +2622,15 @@
|
|||
"items": {},
|
||||
"type": "array"
|
||||
},
|
||||
"fileCompress": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"fileMaxBackups": {
|
||||
"type": "integer"
|
||||
},
|
||||
"fileMaxSizeMb": {
|
||||
"type": "integer"
|
||||
},
|
||||
"filePath": {
|
||||
"type": "string"
|
||||
},
|
||||
|
|
@ -2586,12 +2659,6 @@
|
|||
},
|
||||
"type": "object"
|
||||
},
|
||||
"fileMaxBackups": {
|
||||
"type": "integer"
|
||||
},
|
||||
"fileMaxSizeMb": {
|
||||
"type": "integer"
|
||||
},
|
||||
"static": {
|
||||
"properties": {
|
||||
"allowList": {
|
||||
|
|
@ -2609,6 +2676,15 @@
|
|||
"items": {},
|
||||
"type": "array"
|
||||
},
|
||||
"fileCompress": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"fileMaxBackups": {
|
||||
"type": "integer"
|
||||
},
|
||||
"fileMaxSizeMb": {
|
||||
"type": "integer"
|
||||
},
|
||||
"filePath": {
|
||||
"type": "string"
|
||||
}
|
||||
|
|
@ -2712,6 +2788,9 @@
|
|||
"anyOf": [
|
||||
{
|
||||
"properties": {
|
||||
"action": {
|
||||
"type": "string"
|
||||
},
|
||||
"replacement": {
|
||||
"type": "string"
|
||||
},
|
||||
|
|
@ -2734,6 +2813,12 @@
|
|||
},
|
||||
"type": "array"
|
||||
},
|
||||
"scrapeTimeout": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"tlsConfig": {
|
||||
"type": "object"
|
||||
}
|
||||
|
|
@ -2790,6 +2875,14 @@
|
|||
},
|
||||
"type": "object"
|
||||
},
|
||||
"networkPolicyCorrelation": {
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"peerService": {
|
||||
"properties": {
|
||||
"clusterDomain": {
|
||||
|
|
@ -2886,12 +2979,6 @@
|
|||
"annotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"dialTimeout": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
|
|
@ -2979,6 +3066,12 @@
|
|||
"integer",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"unhealthyPodEvictionPolicy": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -2990,6 +3083,14 @@
|
|||
"properties": {
|
||||
"fsGroup": {
|
||||
"type": "integer"
|
||||
},
|
||||
"seccompProfile": {
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -3044,6 +3145,12 @@
|
|||
"null",
|
||||
"array"
|
||||
]
|
||||
},
|
||||
"scrapeTimeout": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -3068,6 +3175,9 @@
|
|||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"properties": {
|
||||
"drop": {
|
||||
|
|
@ -3091,6 +3201,14 @@
|
|||
},
|
||||
"runAsUser": {
|
||||
"type": "integer"
|
||||
},
|
||||
"seccompProfile": {
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -3328,6 +3446,11 @@
|
|||
"type": "object"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
|
|
@ -3383,6 +3506,11 @@
|
|||
"type": "object"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"server": {
|
||||
|
|
@ -3464,6 +3592,12 @@
|
|||
"integer",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"unhealthyPodEvictionPolicy": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -3499,6 +3633,9 @@
|
|||
"annotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object"
|
||||
},
|
||||
"nodePort": {
|
||||
"type": "integer"
|
||||
},
|
||||
|
|
@ -3582,6 +3719,13 @@
|
|||
"identityChangeGracePeriod": {
|
||||
"type": "string"
|
||||
},
|
||||
"identityManagementMode": {
|
||||
"enum": [
|
||||
"agent",
|
||||
"operator",
|
||||
"both"
|
||||
]
|
||||
},
|
||||
"image": {
|
||||
"properties": {
|
||||
"digest": {
|
||||
|
|
@ -3868,6 +4012,20 @@
|
|||
},
|
||||
"type": "object"
|
||||
},
|
||||
"k8sClientExponentialBackoff": {
|
||||
"properties": {
|
||||
"backoffBaseSeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"backoffMaxDurationSeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"k8sClientRateLimit": {
|
||||
"properties": {
|
||||
"burst": {
|
||||
|
|
@ -3913,6 +4071,23 @@
|
|||
"k8sServiceHost": {
|
||||
"type": "string"
|
||||
},
|
||||
"k8sServiceHostRef": {
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": [
|
||||
"string",
|
||||
"null"
|
||||
]
|
||||
},
|
||||
"name": {
|
||||
"type": [
|
||||
"string",
|
||||
"null"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"k8sServiceLookupConfigMapName": {
|
||||
"type": [
|
||||
"null",
|
||||
|
|
@ -3940,6 +4115,12 @@
|
|||
"kubeConfigPath": {
|
||||
"type": "string"
|
||||
},
|
||||
"kubeProxyReplacement": {
|
||||
"type": [
|
||||
"string",
|
||||
"boolean"
|
||||
]
|
||||
},
|
||||
"kubeProxyReplacementHealthzBindAddr": {
|
||||
"type": "string"
|
||||
},
|
||||
|
|
@ -3947,9 +4128,6 @@
|
|||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"refreshPeriod": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -3995,9 +4173,6 @@
|
|||
"acceleration": {
|
||||
"type": "string"
|
||||
},
|
||||
"experimental": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"l7": {
|
||||
"properties": {
|
||||
"algorithm": {
|
||||
|
|
@ -4016,6 +4191,20 @@
|
|||
},
|
||||
"type": "object"
|
||||
},
|
||||
"localRedirectPolicies": {
|
||||
"properties": {
|
||||
"addressMatcherCIDRs": {
|
||||
"type": [
|
||||
"null",
|
||||
"array"
|
||||
]
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"localRedirectPolicy": {
|
||||
"type": "boolean"
|
||||
},
|
||||
|
|
@ -4218,6 +4407,9 @@
|
|||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"properties": {
|
||||
"add": {
|
||||
|
|
@ -4471,6 +4663,12 @@
|
|||
"integer",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"unhealthyPodEvictionPolicy": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -4479,6 +4677,16 @@
|
|||
"type": "object"
|
||||
},
|
||||
"podSecurityContext": {
|
||||
"properties": {
|
||||
"seccompProfile": {
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"pprof": {
|
||||
|
|
@ -4537,6 +4745,12 @@
|
|||
"null",
|
||||
"array"
|
||||
]
|
||||
},
|
||||
"scrapeTimeout": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -4557,6 +4771,26 @@
|
|||
"type": "boolean"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"properties": {
|
||||
"drop": {
|
||||
"items": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"setNodeNetworkStatus": {
|
||||
|
|
@ -4576,6 +4810,39 @@
|
|||
"anyOf": [
|
||||
{
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"type": "string"
|
||||
}
|
||||
|
|
@ -4583,7 +4850,10 @@
|
|||
}
|
||||
]
|
||||
},
|
||||
"type": "array"
|
||||
"type": [
|
||||
"null",
|
||||
"array"
|
||||
]
|
||||
},
|
||||
"topologySpreadConstraints": {
|
||||
"items": {},
|
||||
|
|
@ -4732,6 +5002,37 @@
|
|||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"envoy": {
|
||||
"properties": {
|
||||
"image": {
|
||||
"properties": {
|
||||
"digest": {
|
||||
"type": "string"
|
||||
},
|
||||
"override": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"pullPolicy": {
|
||||
"type": "string"
|
||||
},
|
||||
"repository": {
|
||||
"type": "string"
|
||||
},
|
||||
"tag": {
|
||||
"type": "string"
|
||||
},
|
||||
"useDigest": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"extraEnv": {
|
||||
"items": {},
|
||||
"type": "array"
|
||||
|
|
@ -4799,6 +5100,12 @@
|
|||
"integer",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"unhealthyPodEvictionPolicy": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
|
|
@ -4827,6 +5134,11 @@
|
|||
"type": "object"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"terminationGracePeriodSeconds": {
|
||||
|
|
@ -4927,6 +5239,9 @@
|
|||
"anyOf": [
|
||||
{
|
||||
"properties": {
|
||||
"action": {
|
||||
"type": "string"
|
||||
},
|
||||
"replacement": {
|
||||
"type": "string"
|
||||
},
|
||||
|
|
@ -4949,6 +5264,12 @@
|
|||
},
|
||||
"type": "array"
|
||||
},
|
||||
"scrapeTimeout": {
|
||||
"type": [
|
||||
"null",
|
||||
"string"
|
||||
]
|
||||
},
|
||||
"trustCRDsExist": {
|
||||
"type": "boolean"
|
||||
}
|
||||
|
|
@ -5039,8 +5360,14 @@
|
|||
},
|
||||
"type": "object"
|
||||
},
|
||||
"secretsNamespaceAnnotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"properties": {
|
||||
"applySysctlOverwrites": {
|
||||
|
|
@ -5470,6 +5797,9 @@
|
|||
"tunnelSourcePortRange": {
|
||||
"type": "string"
|
||||
},
|
||||
"underlayProtocol": {
|
||||
"type": "string"
|
||||
},
|
||||
"updateStrategy": {
|
||||
"properties": {
|
||||
"rollingUpdate": {
|
||||
|
|
|
|||
|
|
@ -40,6 +40,14 @@ debug:
|
|||
# - datapath
|
||||
# - policy
|
||||
verbose: ~
|
||||
# -- Set the agent-internal metrics sampling frequency. This sets the
|
||||
# frequency of the internal sampling of the agent metrics. These are
|
||||
# available via the "cilium-dbg shell -- metrics -s" command and are
|
||||
# part of the metrics HTML page included in the sysdump.
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
metricsSamplingInterval: "5m"
|
||||
rbac:
|
||||
# -- Enable creation of Resource-Based Access Control configuration.
|
||||
create: true
|
||||
|
|
@ -52,6 +60,18 @@ iptablesRandomFully: false
|
|||
# -- (string) Kubernetes config path
|
||||
# @default -- `"~/.kube/config"`
|
||||
kubeConfigPath: ""
|
||||
# -- Configure the Kubernetes service endpoint dynamically using a ConfigMap. Mutually exclusive with `k8sServiceHost`.
|
||||
k8sServiceHostRef:
|
||||
# @schema
|
||||
# type: [string, null]
|
||||
# @schema
|
||||
# -- (string) name of the ConfigMap containing the Kubernetes service endpoint
|
||||
name:
|
||||
# @schema
|
||||
# type: [string, null]
|
||||
# @schema
|
||||
# -- (string) Key in the ConfigMap containing the Kubernetes service endpoint
|
||||
key:
|
||||
# -- (string) Kubernetes service host - use "auto" for automatic lookup from the cluster-info ConfigMap
|
||||
k8sServiceHost: ""
|
||||
# @schema
|
||||
|
|
@ -103,6 +123,14 @@ k8sClientRateLimit:
|
|||
# The rate limiter will allow short bursts with a higher rate.
|
||||
# @default -- 200
|
||||
burst:
|
||||
# -- Configure exponential backoff for client-go in Cilium agent.
|
||||
k8sClientExponentialBackoff:
|
||||
# -- Enable exponential backoff for client-go in Cilium agent.
|
||||
enabled: true
|
||||
# -- Configure base (in seconds) for exponential backoff.
|
||||
backoffBaseSeconds: 1
|
||||
# -- Configure maximum duration (in seconds) for exponential backoff.
|
||||
backoffMaxDurationSeconds: 120
|
||||
cluster:
|
||||
# -- Name of the cluster. Only required for Cluster Mesh and mutual authentication with SPIRE.
|
||||
# It must respect the following constraints:
|
||||
|
|
@ -180,7 +208,7 @@ serviceAccounts:
|
|||
terminationGracePeriodSeconds: 1
|
||||
# -- Install the cilium agent resources.
|
||||
agent: true
|
||||
# -- Agent container name.
|
||||
# -- Agent daemonset name.
|
||||
name: cilium
|
||||
# -- Roll out cilium agent pods automatically when configmap is updated.
|
||||
rollOutCiliumPods: false
|
||||
|
|
@ -191,10 +219,10 @@ image:
|
|||
# @schema
|
||||
override: ~
|
||||
repository: "quay.io/cilium/cilium"
|
||||
tag: "v1.17.8"
|
||||
tag: "v1.18.5"
|
||||
pullPolicy: "IfNotPresent"
|
||||
# cilium-digest
|
||||
digest: "sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636"
|
||||
digest: sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
|
||||
useDigest: true
|
||||
# -- Scheduling configurations for cilium pods
|
||||
scheduling:
|
||||
|
|
@ -291,6 +319,8 @@ initResources: {}
|
|||
securityContext:
|
||||
# -- User to run the pod with
|
||||
# runAsUser: 0
|
||||
# -- disable privilege escalation
|
||||
allowPrivilegeEscalation: false
|
||||
# -- Run the pod with elevated privileges
|
||||
privileged: false
|
||||
# -- SELinux options for the `cilium-agent` and init containers
|
||||
|
|
@ -414,15 +444,11 @@ bandwidthManager:
|
|||
enabled: false
|
||||
# -- Activate BBR TCP congestion control for Pods
|
||||
bbr: false
|
||||
# -- Activate BBR TCP congestion control for Pods in the host namespace only.
|
||||
bbrHostNamespaceOnly: false
|
||||
# -- Configure standalone NAT46/NAT64 gateway
|
||||
nat46x64Gateway:
|
||||
# -- Enable RFC8215-prefixed translation
|
||||
enabled: false
|
||||
# -- EnableHighScaleIPcache enables the special ipcache mode for high scale
|
||||
# clusters. The ipcache content will be reduced to the strict minimum and
|
||||
# traffic will be encapsulated to carry security identities.
|
||||
highScaleIPcache:
|
||||
# -- Enable the high scale mode for the ipcache.
|
||||
# -- Enable RFC6052-prefixed translation
|
||||
enabled: false
|
||||
# -- Configure L2 announcements
|
||||
l2announcements:
|
||||
|
|
@ -440,6 +466,8 @@ l2podAnnouncements:
|
|||
enabled: false
|
||||
# -- Interface used for sending Gratuitous ARP pod announcements
|
||||
interface: "eth0"
|
||||
# -- A regular expression matching interfaces used for sending Gratuitous ARP pod announcements
|
||||
# interfacePattern: ""
|
||||
# -- This feature set enables virtual BGP routers to be created via
|
||||
# CiliumBGPPeeringPolicy CRDs.
|
||||
bgpControlPlane:
|
||||
|
|
@ -457,6 +485,18 @@ bgpControlPlane:
|
|||
# It is recommended to enable status reporting in general, but if you have any issue
|
||||
# such as high API server load, you can disable it by setting this to false.
|
||||
enabled: true
|
||||
# -- BGP router-id allocation mode
|
||||
routerIDAllocation:
|
||||
# -- BGP router-id allocation mode. In default mode, the router-id is derived from the IPv4 address if it is available, or else it is determined by the lower 32 bits of the MAC address.
|
||||
mode: "default"
|
||||
# -- IP pool to allocate the BGP router-id from when the mode is ip-pool.
|
||||
ipPool: ""
|
||||
# -- Legacy BGP ORIGIN attribute settings (BGPv2 only)
|
||||
legacyOriginAttribute:
|
||||
# -- Enable/Disable advertising LoadBalancerIP routes with the legacy
|
||||
# BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0).
|
||||
# Enable for compatibility with the legacy behavior of MetalLB integration.
|
||||
enabled: false
|
||||
pmtuDiscovery:
|
||||
# -- Enable path MTU discovery to send ICMP fragmentation-needed replies to
|
||||
# the client.
|
||||
|
|
@ -568,6 +608,11 @@ bpf:
|
|||
# type: [null, integer]
|
||||
# @schema
|
||||
policyMapMax: 16384
|
||||
# -- Configure the maximum number of entries in global policy stats map.
|
||||
# @schema
|
||||
# type: [null, integer]
|
||||
# @schema
|
||||
policyStatsMapMax: 65536
|
||||
# @schema
|
||||
# type: [null, number, string]
|
||||
# @schema
|
||||
|
|
@ -637,7 +682,7 @@ bpf:
|
|||
# supported kernels.
|
||||
# @default -- `true`
|
||||
enableTCX: true
|
||||
# -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2, lb-only)
|
||||
# -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2)
|
||||
# @default -- `veth`
|
||||
datapathMode: veth
|
||||
# -- Enable BPF clock source probing for more efficient tick retrieval.
|
||||
|
|
@ -707,12 +752,15 @@ cni:
|
|||
# readCniConf: /host/etc/cni/net.d/05-sample.conflist.input
|
||||
|
||||
# -- When defined, configMap will mount the provided value as ConfigMap and
|
||||
# interpret the cniConf variable as CNI configuration file and write it
|
||||
# when the agent starts up
|
||||
# configMap: cni-configuration
|
||||
|
||||
# interpret the 'cni.configMapKey' value as CNI configuration file and write it
|
||||
# when the agent starts up.
|
||||
configMap: ""
|
||||
# -- Configure the key in the CNI ConfigMap to read the contents of
|
||||
# the CNI configuration from.
|
||||
# the CNI configuration from. For this to be effective, the 'cni.configMap'
|
||||
# parameter must be specified too.
|
||||
# Note that the 'cni.configMap' parameter is the name of the ConfigMap, while
|
||||
# 'cni.configMapKey' is the name of the key in the ConfigMap data containing
|
||||
# the actual configuration.
|
||||
configMapKey: cni-config
|
||||
# -- Configure the path to where to mount the ConfigMap inside the agent pod.
|
||||
confFileMountPath: /tmp/cni-configuration
|
||||
|
|
@ -726,6 +774,16 @@ cni:
|
|||
memory: 10Mi
|
||||
# -- Enable route MTU for pod netns when CNI chaining is used
|
||||
enableRouteMTUForCNIChaining: false
|
||||
# -- Enable the removal of iptables rules created by the AWS CNI VPC plugin.
|
||||
iptablesRemoveAWSRules: true
|
||||
# @schema
|
||||
# type: [null, number]
|
||||
# @schema
|
||||
# -- (float64) Ratio of the connectivity probe frequency vs resource usage, a float in
|
||||
# [0, 1]. 0 will give more frequent probing, 1 will give less frequent probing. Probing
|
||||
# frequency is dynamically adjusted based on the cluster size.
|
||||
# @default -- `0.5`
|
||||
connectivityProbeFrequencyRatio: ~
|
||||
# -- (string) Configure how frequently garbage collection should occur for the datapath
|
||||
# connection tracking table.
|
||||
# @default -- `"0s"`
|
||||
|
|
@ -791,13 +849,6 @@ daemon:
|
|||
# a non-local route. This should be used only when autodetection is not suitable.
|
||||
# devices: ""
|
||||
|
||||
# -- Enables experimental support for the detection of new and removed datapath
|
||||
# devices. When devices change the eBPF datapath is reloaded and services updated.
|
||||
# If "devices" is set then only those devices, or devices matching a wildcard will
|
||||
# be considered.
|
||||
#
|
||||
# This option has been deprecated and is a no-op.
|
||||
enableRuntimeDeviceDetection: true
|
||||
# -- Forces the auto-detection of devices, even if specific devices are explicitly listed
|
||||
forceDeviceDetection: false
|
||||
# -- Chains to ignore when installing feeder rules.
|
||||
|
|
@ -812,8 +863,7 @@ forceDeviceDetection: false
|
|||
# -- Enable Kubernetes EndpointSlice feature in Cilium if the cluster supports it.
|
||||
# enableK8sEndpointSlice: true
|
||||
|
||||
# -- Enable CiliumEndpointSlice feature (deprecated, please use `ciliumEndpointSlice.enabled` instead).
|
||||
enableCiliumEndpointSlice: false
|
||||
# -- CiliumEndpointSlice configuration options.
|
||||
ciliumEndpointSlice:
|
||||
# -- Enable Cilium EndpointSlice feature.
|
||||
enabled: false
|
||||
|
|
@ -829,13 +879,13 @@ ciliumEndpointSlice:
|
|||
- nodes: 100
|
||||
limit: 50
|
||||
burst: 100
|
||||
# @schema
|
||||
# enum: ["identity", "fcfs"]
|
||||
# @schema
|
||||
# -- The slicing mode to use for CiliumEndpointSlices.
|
||||
# identity groups together CiliumEndpoints that share the same identity.
|
||||
# fcfs groups together CiliumEndpoints in a first-come-first-serve basis, filling in the largest non-full slice first.
|
||||
sliceMode: identity
|
||||
# @schema
|
||||
# enum: ["agent", "operator", "both"]
|
||||
# @schema
|
||||
# -- Control whether CiliumIdentities are created by the agent ("agent"), the operator ("operator") or both ("both").
|
||||
# "Both" should be used only to migrate between "agent" and "operator".
|
||||
# Operator-managed identities is a beta feature.
|
||||
identityManagementMode: "agent"
|
||||
envoyConfig:
|
||||
# -- Enable CiliumEnvoyConfig CRD
|
||||
# CiliumEnvoyConfig CRD can also be implicitly enabled by other options.
|
||||
|
|
@ -1044,8 +1094,6 @@ endpointLockdownOnMapOverflow: false
|
|||
eni:
|
||||
# -- Enable Elastic Network Interface (ENI) integration.
|
||||
enabled: false
|
||||
# -- Update ENI Adapter limits from the EC2 API
|
||||
updateEC2AdapterLimitViaAPI: true
|
||||
# -- Release IPs not used from the ENI
|
||||
awsReleaseExcessIPs: false
|
||||
# -- Enable ENI prefix delegation
|
||||
|
|
@ -1094,9 +1142,6 @@ healthCheckICMPFailureThreshold: 3
|
|||
hostFirewall:
|
||||
# -- Enables the enforcement of host policies in the eBPF datapath.
|
||||
enabled: false
|
||||
hostPort:
|
||||
# -- Enable hostPort service support.
|
||||
enabled: false
|
||||
# -- Configure socket LB
|
||||
socketLB:
|
||||
# -- Enable socket LB
|
||||
|
|
@ -1120,8 +1165,8 @@ certgen:
|
|||
# @schema
|
||||
override: ~
|
||||
repository: "quay.io/cilium/certgen"
|
||||
tag: "v0.2.1"
|
||||
digest: "sha256:ab6b1928e9c5f424f6b0f51c68065b9fd85e2f8d3e5f21fbd1a3cb27e6fb9321"
|
||||
tag: "v0.3.1"
|
||||
digest: "sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
# -- Seconds after which the completed job pod will be deleted
|
||||
|
|
@ -1141,6 +1186,9 @@ certgen:
|
|||
# -- Node tolerations for pod assignment on nodes with taints
|
||||
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
|
||||
tolerations: []
|
||||
# -- Resource limits for certgen
|
||||
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers
|
||||
resources: {}
|
||||
# -- Additional certgen volumes.
|
||||
extraVolumes: []
|
||||
# -- Additional certgen volumeMounts.
|
||||
|
|
@ -1236,11 +1284,17 @@ hubble:
|
|||
jobLabel: ""
|
||||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# -- Relabeling configs for the ServiceMonitor hubble
|
||||
relabelings:
|
||||
- sourceLabels:
|
||||
- __meta_kubernetes_pod_node_name
|
||||
targetLabel: node
|
||||
action: replace
|
||||
replacement: ${1}
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
|
|
@ -1280,6 +1334,10 @@ hubble:
|
|||
# excludeFilters: []
|
||||
# -- Unix domain socket path to listen to when Hubble is enabled.
|
||||
socketPath: /var/run/cilium/hubble.sock
|
||||
# -- Enables network policy correlation of Hubble flows, i.e. populating `egress_allowed_by`, `ingress_denied_by` fields with policy information.
|
||||
networkPolicyCorrelation:
|
||||
# @default -- `true`
|
||||
enabled: true
|
||||
# -- Enables redacting sensitive information present in Layer 7 flows.
|
||||
redact:
|
||||
enabled: false
|
||||
|
|
@ -1341,7 +1399,7 @@ hubble:
|
|||
# --set hubble.redact.http.headers.deny="Authorization,Proxy-Authorization"
|
||||
deny: []
|
||||
kafka:
|
||||
# -- Enables redacting Kafka's API key.
|
||||
# -- Enables redacting Kafka's API key (deprecated, will be removed in v1.19).
|
||||
# Example:
|
||||
#
|
||||
# redact:
|
||||
|
|
@ -1445,9 +1503,9 @@ hubble:
|
|||
# @schema
|
||||
override: ~
|
||||
repository: "quay.io/cilium/hubble-relay"
|
||||
tag: "v1.17.8"
|
||||
tag: "v1.18.5"
|
||||
# hubble-relay-digest
|
||||
digest: "sha256:2e576bf7a02291c07bffbc1ca0a66a6c70f4c3eb155480e5b3ac027bedd2858b"
|
||||
digest: sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
# -- Specifies the resources for the hubble-relay pods
|
||||
|
|
@ -1499,6 +1557,11 @@ hubble:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- The priority class to use for hubble-relay
|
||||
priorityClassName: ""
|
||||
# -- Configure termination grace period for hubble relay Deployment.
|
||||
|
|
@ -1518,12 +1581,17 @@ hubble:
|
|||
# -- hubble-relay pod security context
|
||||
podSecurityContext:
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
# -- hubble-relay container security context
|
||||
securityContext:
|
||||
# readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
|
@ -1584,13 +1652,6 @@ hubble:
|
|||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Dial timeout to connect to the local hubble instance to receive peer information (e.g. "30s").
|
||||
#
|
||||
# This option has been deprecated and is a no-op.
|
||||
dialTimeout: ~
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Backoff duration to retry connecting to the local hubble instance in case of failure (e.g. "30s").
|
||||
retryTimeout: ~
|
||||
# @schema
|
||||
|
|
@ -1625,6 +1686,11 @@ hubble:
|
|||
annotations: {}
|
||||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# -- Specify the Kubernetes namespace where Prometheus expects to find
|
||||
# service monitors configured.
|
||||
# namespace: ""
|
||||
|
|
@ -1701,7 +1767,8 @@ hubble:
|
|||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
# -- Hubble-ui backend security context.
|
||||
securityContext: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
# -- Additional hubble-ui backend environment variables.
|
||||
extraEnv: []
|
||||
# -- Additional hubble-ui backend volumes.
|
||||
|
|
@ -1735,7 +1802,8 @@ hubble:
|
|||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
# -- Hubble-ui frontend security context.
|
||||
securityContext: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
# -- Additional hubble-ui frontend environment variables.
|
||||
extraEnv: []
|
||||
# -- Additional hubble-ui frontend volumes.
|
||||
|
|
@ -1780,6 +1848,11 @@ hubble:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- Affinity for hubble-ui
|
||||
affinity: {}
|
||||
# -- Pod topology spread constraints for hubble-ui
|
||||
|
|
@ -1814,6 +1887,8 @@ hubble:
|
|||
service:
|
||||
# -- Annotations to be added for the Hubble UI service
|
||||
annotations: {}
|
||||
# -- Labels to be added for the Hubble UI service
|
||||
labels: {}
|
||||
# --- The type of service used for Hubble UI access, either ClusterIP or NodePort.
|
||||
type: ClusterIP
|
||||
# --- The port to use when the service type is set to NodePort.
|
||||
|
|
@ -1838,10 +1913,6 @@ hubble:
|
|||
# - chart-example.local
|
||||
# -- Hubble flows export.
|
||||
export:
|
||||
# --- Defines max file size of output file before it gets rotated.
|
||||
fileMaxSizeMb: 10
|
||||
# --- Defines max number of backup/rotated files.
|
||||
fileMaxBackups: 5
|
||||
# --- Static exporter configuration.
|
||||
# Static exporter is bound to agent lifecycle.
|
||||
static:
|
||||
|
|
@ -1857,6 +1928,12 @@ hubble:
|
|||
denyList: []
|
||||
# - '{"source_pod":["kube-system/"]}'
|
||||
# - '{"destination_pod":["kube-system/"]}'
|
||||
# --- Defines max file size of output file before it gets rotated.
|
||||
fileMaxSizeMb: 10
|
||||
# --- Defines max number of backup/rotated files.
|
||||
fileMaxBackups: 5
|
||||
# --- Enable compression of rotated files.
|
||||
fileCompress: false
|
||||
# --- Dynamic exporters configuration.
|
||||
# Dynamic exporters may be reconfigured without a need of agent restarts.
|
||||
dynamic:
|
||||
|
|
@ -1874,6 +1951,9 @@ hubble:
|
|||
includeFilters: []
|
||||
excludeFilters: []
|
||||
filePath: "/var/run/cilium/hubble/events.log"
|
||||
fileMaxSizeMb: 10
|
||||
fileMaxBackups: 5
|
||||
fileCompress: false
|
||||
# - name: "test002"
|
||||
# filePath: "/var/log/network/flow-log/pa/test002.log"
|
||||
# fieldMask: ["source.namespace", "source.pod_name", "destination.namespace", "destination.pod_name", "verdict"]
|
||||
|
|
@ -1883,6 +1963,9 @@ hubble:
|
|||
# - type: 1
|
||||
# - destination_pod: ["frontend/nginx-975996d4c-7hhgt"]
|
||||
# excludeFilters: []
|
||||
# fileMaxSizeMb: 1
|
||||
# fileMaxBackups: 10
|
||||
# fileCompress: true
|
||||
# end: "2023-10-09T23:59:59-07:00"
|
||||
# -- Emit v1.Events related to pods on detection of packet drops.
|
||||
# This feature is alpha, please provide feedback at https://github.com/cilium/cilium/issues/33975.
|
||||
|
|
@ -1997,14 +2080,17 @@ k8s:
|
|||
# -- requireIPv6PodCIDR enables waiting for Kubernetes to provide the PodCIDR
|
||||
# range via the Kubernetes node resource
|
||||
requireIPv6PodCIDR: false
|
||||
# -- A space separated list of Kubernetes API server URLs to use with the client.
|
||||
# For example "https://192.168.0.1:6443 https://192.168.0.2:6443"
|
||||
# apiServerURLs: ""
|
||||
# -- Keep the deprecated selector labels when deploying Cilium DaemonSet.
|
||||
keepDeprecatedLabels: false
|
||||
# -- Keep the deprecated probes when deploying Cilium DaemonSet
|
||||
keepDeprecatedProbes: false
|
||||
startupProbe:
|
||||
# -- failure threshold of startup probe.
|
||||
# 105 x 2s translates to the old behaviour of the readiness probe (120s delay + 30 x 3s)
|
||||
failureThreshold: 105
|
||||
# Allow Cilium to take up to 600s to start up (300 attempts with 2s between attempts).
|
||||
failureThreshold: 300
|
||||
# -- interval between checks of the startup probe
|
||||
periodSeconds: 2
|
||||
livenessProbe:
|
||||
|
|
@ -2022,8 +2108,10 @@ readinessProbe:
|
|||
# -- Configure the kube-proxy replacement in Cilium BPF datapath
|
||||
# Valid options are "true" or "false".
|
||||
# ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/
|
||||
#kubeProxyReplacement: "false"
|
||||
|
||||
# @schema@
|
||||
# type: [string, boolean]
|
||||
# @schema@
|
||||
kubeProxyReplacement: "false"
|
||||
# -- healthz server bind address for the kube-proxy replacement.
|
||||
# To enable set the value to '0.0.0.0:10256' for all ipv4
|
||||
# addresses and this '[::]:10256' for all ipv6 addresses.
|
||||
|
|
@ -2031,13 +2119,20 @@ readinessProbe:
|
|||
kubeProxyReplacementHealthzBindAddr: ""
|
||||
l2NeighDiscovery:
|
||||
# -- Enable L2 neighbor discovery in the agent
|
||||
enabled: true
|
||||
# -- Override the agent's default neighbor resolution refresh period.
|
||||
refreshPeriod: "30s"
|
||||
enabled: false
|
||||
# -- Enable Layer 7 network policy.
|
||||
l7Proxy: true
|
||||
# -- Enable Local Redirect Policy.
|
||||
# -- Enable Local Redirect Policy (deprecated, please use 'localRedirectPolicies.enabled' instead)
|
||||
localRedirectPolicy: false
|
||||
localRedirectPolicies:
|
||||
# -- Enable local redirect policies.
|
||||
enabled: false
|
||||
# -- Limit the allowed addresses in Address Matcher rule of
|
||||
# Local Redirect Policies to the given CIDRs.
|
||||
# @schema@
|
||||
# type: [null, array]
|
||||
# @schema@
|
||||
addressMatcherCIDRs: ~
|
||||
# To include or exclude matched resources from cilium identity evaluation
|
||||
# labels: ""
|
||||
|
||||
|
|
@ -2056,8 +2151,12 @@ maglev: {}
|
|||
# -- hashSeed is the cluster-wide base64 encoded seed for the hashing
|
||||
# hashSeed:
|
||||
|
||||
# -- Enables masquerading of IPv4 traffic leaving the node from endpoints.
|
||||
enableIPv4Masquerade: true
|
||||
# @schema
|
||||
# type: [null, boolean]
|
||||
# @schema
|
||||
# -- (bool) Enables masquerading of IPv4 traffic leaving the node from endpoints.
|
||||
# @default -- `true` unless ipam eni mode is active
|
||||
enableIPv4Masquerade: ~
|
||||
# -- Enables masquerading of IPv6 traffic leaving the node from endpoints.
|
||||
enableIPv6Masquerade: true
|
||||
# -- Enables masquerading to the source of the route for traffic leaving the node from endpoints.
|
||||
|
|
@ -2137,17 +2236,14 @@ loadBalancer:
|
|||
# path), or best-effort (use native mode XDP acceleration on devices
|
||||
# that support it).
|
||||
acceleration: disabled
|
||||
# -- dsrDispatch configures whether IP option or IPIP encapsulation is
|
||||
# used to pass a service IP and port to remote backend
|
||||
# -- dsrDispatch configures whether IP option (opt), IPIP encapsulation (ipip),
|
||||
# Geneve Class Option (geneve) used to pass a service IP and port to remote backend
|
||||
# dsrDispatch: opt
|
||||
|
||||
# -- serviceTopology enables K8s Topology Aware Hints -based service
|
||||
# endpoints filtering
|
||||
# serviceTopology: false
|
||||
|
||||
# -- experimental enables support for the experimental load-balancing
|
||||
# control-plane.
|
||||
experimental: false
|
||||
# -- L7 LoadBalancer
|
||||
l7:
|
||||
# -- Enable L7 service load balancing via envoy proxy.
|
||||
|
|
@ -2232,6 +2328,11 @@ prometheus:
|
|||
jobLabel: ""
|
||||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# -- Specify the Kubernetes namespace where Prometheus expects to find
|
||||
# service monitors configured.
|
||||
# namespace: ""
|
||||
|
|
@ -2240,6 +2341,7 @@ prometheus:
|
|||
- sourceLabels:
|
||||
- __meta_kubernetes_pod_node_name
|
||||
targetLabel: node
|
||||
action: replace
|
||||
replacement: ${1}
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
|
|
@ -2342,6 +2444,9 @@ envoy:
|
|||
# -- Set Envoy upstream HTTP idle connection timeout seconds.
|
||||
# Does not apply to connections with pending requests. Default 60s
|
||||
idleTimeoutDurationSeconds: 60
|
||||
# -- Set Envoy the amount of time that the connection manager will allow a stream to exist with no upstream or downstream activity.
|
||||
# default 5 minutes
|
||||
streamIdleTimeoutDurationSeconds: 300
|
||||
# -- Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the ingress L7 policy enforcement Envoy listeners.
|
||||
xffNumTrustedHopsL7PolicyIngress: 0
|
||||
# -- Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the egress L7 policy enforcement Envoy listeners.
|
||||
|
|
@ -2351,6 +2456,8 @@ envoy:
|
|||
# @schema
|
||||
# -- Max duration to wait for endpoint policies to be restored on restart. Default "3m".
|
||||
policyRestoreTimeoutDuration: null
|
||||
# -- Time in seconds to block Envoy worker thread while an upstream HTTP connection is closing. If set to 0, the connection is closed immediately (with TCP RST). If set to -1, the connection is closed asynchronously in the background.
|
||||
httpUpstreamLingerTimeout: null
|
||||
# -- Envoy container image.
|
||||
image:
|
||||
# @schema
|
||||
|
|
@ -2358,9 +2465,9 @@ envoy:
|
|||
# @schema
|
||||
override: ~
|
||||
repository: "quay.io/cilium/cilium-envoy"
|
||||
tag: "v1.33.9-1757932127-3c04e8f2f1027d106b96f8ef4a0215e81dbaaece"
|
||||
tag: "v1.34.12-1765374555-6a93b0bbba8d6dc75b651cbafeedb062b2997716"
|
||||
pullPolicy: "IfNotPresent"
|
||||
digest: "sha256:06fbc4e55d926dd82ff2a0049919248dcc6be5354609b09012b01bc9c5b0ee28"
|
||||
digest: "sha256:3108521821c6922695ff1f6ef24b09026c94b195283f8bfbfc0fa49356a156e1"
|
||||
useDigest: true
|
||||
# -- Additional containers added to the cilium Envoy DaemonSet.
|
||||
extraContainers: []
|
||||
|
|
@ -2427,12 +2534,16 @@ envoy:
|
|||
# memory: 512Mi
|
||||
|
||||
startupProbe:
|
||||
# -- Enable startup probe for cilium-envoy
|
||||
enabled: true
|
||||
# -- failure threshold of startup probe.
|
||||
# 105 x 2s translates to the old behaviour of the readiness probe (120s delay + 30 x 3s)
|
||||
failureThreshold: 105
|
||||
# -- interval between checks of the startup probe
|
||||
periodSeconds: 2
|
||||
livenessProbe:
|
||||
# -- Enable liveness probe for cilium-envoy
|
||||
enabled: true
|
||||
# -- failure threshold of liveness probe
|
||||
failureThreshold: 10
|
||||
# -- interval between checks of the liveness probe
|
||||
|
|
@ -2545,6 +2656,11 @@ envoy:
|
|||
annotations: {}
|
||||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# -- Specify the Kubernetes namespace where Prometheus expects to find
|
||||
# service monitors configured.
|
||||
# namespace: ""
|
||||
|
|
@ -2554,6 +2670,7 @@ envoy:
|
|||
- sourceLabels:
|
||||
- __meta_kubernetes_pod_node_name
|
||||
targetLabel: node
|
||||
action: replace
|
||||
replacement: ${1}
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
|
|
@ -2565,6 +2682,10 @@ envoy:
|
|||
port: "9964"
|
||||
# -- Enable/Disable use of node label based identity
|
||||
nodeSelectorLabels: false
|
||||
# To include or exclude matched resources from cilium node identity evaluation
|
||||
# List of labels just like --labels flag (.Values.labels)
|
||||
# nodeLabels: ""
|
||||
|
||||
# -- Enable resource quotas for priority classes used in the cluster.
|
||||
resourceQuotas:
|
||||
enabled: false
|
||||
|
|
@ -2580,6 +2701,8 @@ resourceQuotas:
|
|||
##################
|
||||
#sessionAffinity: false
|
||||
|
||||
# -- Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace)
|
||||
secretsNamespaceAnnotations: {}
|
||||
# -- Do not run Cilium agent when running with clean mode. Useful to completely
|
||||
# uninstall Cilium as it will stop Cilium from starting and create artifacts
|
||||
# in the node.
|
||||
|
|
@ -2667,6 +2790,9 @@ tls:
|
|||
# - geneve
|
||||
# @default -- `"vxlan"`
|
||||
tunnelProtocol: ""
|
||||
# -- IP family for the underlay.
|
||||
# @default -- `"ipv4"`
|
||||
underlayProtocol: ""
|
||||
# -- Enable native-routing mode or tunneling mode.
|
||||
# Possible values:
|
||||
# - ""
|
||||
|
|
@ -2715,15 +2841,15 @@ operator:
|
|||
# @schema
|
||||
override: ~
|
||||
repository: "quay.io/cilium/operator"
|
||||
tag: "v1.17.8"
|
||||
tag: "v1.18.5"
|
||||
# operator-generic-digest
|
||||
genericDigest: "sha256:5468807b9c31997f3a1a14558ec7c20c5b962a2df6db633b7afbe2f45a15da1c"
|
||||
genericDigest: sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99
|
||||
# operator-azure-digest
|
||||
azureDigest: "sha256:619f9febf3efef2724a26522b253e4595cd33c274f5f49925e29a795fdc2d2d7"
|
||||
azureDigest: sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6
|
||||
# operator-aws-digest
|
||||
awsDigest: "sha256:28012f7d0f4f23e9f6c7d6a5dd931afa326bbac3e8103f3f6f22b9670847dffa"
|
||||
awsDigest: sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52
|
||||
# operator-alibabacloud-digest
|
||||
alibabacloudDigest: "sha256:72c25a405ad8e58d2cf03f7ea2b6696ed1edcfb51716b5f85e45c6c4fcaa6056"
|
||||
alibabacloudDigest: sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
suffix: ""
|
||||
|
|
@ -2766,12 +2892,19 @@ operator:
|
|||
kubernetes.io/os: linux
|
||||
# -- Node tolerations for cilium-operator scheduling to nodes with taints
|
||||
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
|
||||
# Toleration for agentNotReadyTaintKey taint is always added to cilium-operator pods.
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
# - key: "key"
|
||||
# operator: "Equal|Exists"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
operator: Exists
|
||||
- key: "node-role.kubernetes.io/master" #deprecated
|
||||
operator: Exists
|
||||
- key: "node.kubernetes.io/not-ready"
|
||||
operator: Exists
|
||||
- key: "node.cloudprovider.kubernetes.io/uninitialized"
|
||||
operator: Exists
|
||||
# -- Additional cilium-operator container arguments.
|
||||
extraArgs: []
|
||||
# -- Additional cilium-operator environment variables.
|
||||
|
|
@ -2794,7 +2927,9 @@ operator:
|
|||
# -- HostNetwork setting
|
||||
hostNetwork: true
|
||||
# -- Security context to be added to cilium-operator pods
|
||||
podSecurityContext: {}
|
||||
podSecurityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
# -- Annotations to be added to cilium-operator pods
|
||||
podAnnotations: {}
|
||||
# -- Labels to be added to cilium-operator pods
|
||||
|
|
@ -2815,6 +2950,11 @@ operator:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- cilium-operator resource limits & requests
|
||||
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
|
@ -2826,7 +2966,11 @@ operator:
|
|||
# memory: 128Mi
|
||||
|
||||
# -- Security context to be added to cilium-operator pods
|
||||
securityContext: {}
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
# runAsUser: 0
|
||||
|
||||
# -- Interval for endpoint garbage collection.
|
||||
|
|
@ -2863,6 +3007,11 @@ operator:
|
|||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
# -- Relabeling configs for the ServiceMonitor cilium-operator
|
||||
|
|
@ -2963,6 +3112,7 @@ nodeinit:
|
|||
memory: 100Mi
|
||||
# -- Security context to be added to nodeinit pods.
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
seLinuxOptions:
|
||||
level: 's0'
|
||||
|
|
@ -2998,11 +3148,23 @@ preflight:
|
|||
# @schema
|
||||
override: ~
|
||||
repository: "quay.io/cilium/cilium"
|
||||
tag: "v1.17.8"
|
||||
tag: "v1.18.5"
|
||||
# cilium-digest
|
||||
digest: "sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636"
|
||||
digest: sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
envoy:
|
||||
# -- Envoy pre-flight image.
|
||||
image:
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
override: ~
|
||||
repository: "quay.io/cilium/cilium-envoy"
|
||||
tag: "v1.34.12-1765374555-6a93b0bbba8d6dc75b651cbafeedb062b2997716"
|
||||
pullPolicy: "IfNotPresent"
|
||||
digest: "sha256:3108521821c6922695ff1f6ef24b09026c94b195283f8bfbfc0fa49356a156e1"
|
||||
useDigest: true
|
||||
# -- The priority class to use for the preflight pod.
|
||||
priorityClassName: ""
|
||||
# -- preflight update strategy
|
||||
|
|
@ -3058,6 +3220,11 @@ preflight:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- preflight resource limits & requests
|
||||
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
|
@ -3074,7 +3241,8 @@ preflight:
|
|||
# -- interval between checks of the readiness probe
|
||||
periodSeconds: 5
|
||||
# -- Security context to be added to preflight pods
|
||||
securityContext: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
# runAsUser: 0
|
||||
|
||||
# -- Path to write the `--tofqdns-pre-cache` file to.
|
||||
|
|
@ -3108,6 +3276,8 @@ clustermesh:
|
|||
enableEndpointSliceSynchronization: false
|
||||
# -- Enable Multi-Cluster Services API support
|
||||
enableMCSAPISupport: false
|
||||
# -- Control whether policy rules assume by default the local cluster if not explicitly selected
|
||||
policyDefaultLocalCluster: false
|
||||
# -- Annotations to be added to all top-level clustermesh objects (resources under templates/clustermesh-apiserver and templates/clustermesh-config)
|
||||
annotations: {}
|
||||
# -- Clustermesh explicit configuration.
|
||||
|
|
@ -3147,9 +3317,9 @@ clustermesh:
|
|||
# @schema
|
||||
override: ~
|
||||
repository: "quay.io/cilium/clustermesh-apiserver"
|
||||
tag: "v1.17.8"
|
||||
tag: "v1.18.5"
|
||||
# clustermesh-apiserver-digest
|
||||
digest: "sha256:3ac210d94d37a77ec010f9ac4c705edc8f15f22afa2b9a6f0e2a7d64d2360586"
|
||||
digest: sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
# -- TCP port for the clustermesh-apiserver health API.
|
||||
|
|
@ -3203,7 +3373,7 @@ clustermesh:
|
|||
storageMedium: Disk
|
||||
kvstoremesh:
|
||||
# -- Enable KVStoreMesh. KVStoreMesh caches the information retrieved
|
||||
# from the remote clusters in the local etcd instance.
|
||||
# from the remote clusters in the local etcd instance (deprecated - KVStoreMesh will always be enabled once the option is removed).
|
||||
enabled: true
|
||||
# -- TCP port for the KVStoreMesh health API.
|
||||
healthPort: 9881
|
||||
|
|
@ -3232,6 +3402,11 @@ clustermesh:
|
|||
- ALL
|
||||
# -- lifecycle setting for the KVStoreMesh container
|
||||
lifecycle: {}
|
||||
# -- Specify the KVStore mode when running KVStoreMesh
|
||||
# Supported values:
|
||||
# - "internal": remote cluster identities are cached in etcd that runs as a sidecar within ``clustermesh-apiserver`` pod.
|
||||
# - "external": ``clustermesh-apiserver`` will sync remote cluster information to the etcd used as kvstore. This can't be enabled with crd identity allocation mode.
|
||||
kvstoreMode: "internal"
|
||||
service:
|
||||
# -- The type of service used for apiserver access.
|
||||
type: NodePort
|
||||
|
|
@ -3345,6 +3520,11 @@ clustermesh:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- Resource requests and limits for the clustermesh-apiserver
|
||||
resources: {}
|
||||
# requests:
|
||||
|
|
@ -3511,6 +3691,11 @@ clustermesh:
|
|||
# -- Interval for scrape metrics (apiserver metrics)
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
# -- Relabeling configs for the ServiceMonitor clustermesh-apiserver (apiserver metrics)
|
||||
|
|
@ -3524,6 +3709,11 @@ clustermesh:
|
|||
# -- Interval for scrape metrics (KVStoreMesh metrics)
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
# -- Relabeling configs for the ServiceMonitor clustermesh-apiserver (KVStoreMesh metrics)
|
||||
|
|
@ -3537,6 +3727,11 @@ clustermesh:
|
|||
# -- Interval for scrape metrics (etcd metrics)
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
# -- Relabeling configs for the ServiceMonitor clustermesh-apiserver (etcd metrics)
|
||||
|
|
@ -3546,10 +3741,6 @@ clustermesh:
|
|||
# @schema
|
||||
# -- Metrics relabeling configs for the ServiceMonitor clustermesh-apiserver (etcd metrics)
|
||||
metricRelabelings: ~
|
||||
# -- Configure external workloads support
|
||||
externalWorkloads:
|
||||
# -- Enable support for external workloads, such as VMs (false by default).
|
||||
enabled: false
|
||||
# -- Configure cgroup related configuration
|
||||
cgroup:
|
||||
autoMount:
|
||||
|
|
@ -3574,9 +3765,6 @@ cgroup:
|
|||
sysctlfix:
|
||||
# -- Enable the sysctl override. When enabled, the init container will mount the /proc of the host so that the `sysctlfix` utility can execute.
|
||||
enabled: true
|
||||
# -- Configure whether to enable auto detect of terminating state for endpoints
|
||||
# in order to support graceful termination.
|
||||
enableK8sTerminatingEndpoint: true
|
||||
# -- Configure whether to unload DNS policy rules on graceful shutdown
|
||||
# dnsPolicyUnloadOnShutdown: false
|
||||
|
||||
|
|
@ -3609,6 +3797,9 @@ dnsProxy:
|
|||
proxyResponseMaxDelay: 100ms
|
||||
# -- DNS proxy operation mode (true/false, or unset to use version dependent defaults)
|
||||
# enableTransparentMode: true
|
||||
# -- Pre-allocate ToFQDN identities. This reduces DNS proxy tail latency, at the potential cost of some
|
||||
# unnecessary policymap entries. Disable this if you have a large (200+) number of unique ToFQDN selectors.
|
||||
preAllocateIdentities: true
|
||||
# -- SCTP Configuration Values
|
||||
sctp:
|
||||
# -- Enable SCTP support. NOTE: Currently, SCTP support does not support rewriting ports or multihoming.
|
||||
|
|
@ -3658,7 +3849,7 @@ authentication:
|
|||
override: ~
|
||||
repository: "docker.io/library/busybox"
|
||||
tag: "1.37.0"
|
||||
digest: "sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e"
|
||||
digest: "sha256:d80cd694d3e9467884fcb94b8ca1e20437d8a501096cdf367a5a1918a34fc2fd"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
# SPIRE agent configuration
|
||||
|
|
@ -3672,8 +3863,8 @@ authentication:
|
|||
# @schema
|
||||
override: ~
|
||||
repository: "ghcr.io/spiffe/spire-agent"
|
||||
tag: "1.9.6"
|
||||
digest: "sha256:5106ac601272a88684db14daf7f54b9a45f31f77bb16a906bd5e87756ee7b97c"
|
||||
tag: "1.12.4"
|
||||
digest: "sha256:163970884fba18860cac93655dc32b6af85a5dcf2ebb7e3e119a10888eff8fcd"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
# -- SPIRE agent service account
|
||||
|
|
@ -3727,8 +3918,8 @@ authentication:
|
|||
# @schema
|
||||
override: ~
|
||||
repository: "ghcr.io/spiffe/spire-server"
|
||||
tag: "1.9.6"
|
||||
digest: "sha256:59a0b92b39773515e25e68a46c40d3b931b9c1860bc445a79ceb45a805cab8b4"
|
||||
tag: "1.12.4"
|
||||
digest: "sha256:34147f27066ab2be5cc10ca1d4bfd361144196467155d46c45f3519f41596e49"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
# -- SPIRE server service account
|
||||
|
|
|
|||
|
|
@ -38,6 +38,15 @@ debug:
|
|||
# - datapath
|
||||
# - policy
|
||||
verbose: ~
|
||||
|
||||
# -- Set the agent-internal metrics sampling frequency. This sets the
|
||||
# frequency of the internal sampling of the agent metrics. These are
|
||||
# available via the "cilium-dbg shell -- metrics -s" command and are
|
||||
# part of the metrics HTML page included in the sysdump.
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
metricsSamplingInterval: "5m"
|
||||
rbac:
|
||||
# -- Enable creation of Resource-Based Access Control configuration.
|
||||
create: true
|
||||
|
|
@ -52,6 +61,18 @@ iptablesRandomFully: false
|
|||
# -- (string) Kubernetes config path
|
||||
# @default -- `"~/.kube/config"`
|
||||
kubeConfigPath: ""
|
||||
# -- Configure the Kubernetes service endpoint dynamically using a ConfigMap. Mutually exclusive with `k8sServiceHost`.
|
||||
k8sServiceHostRef:
|
||||
# @schema
|
||||
# type: [string, null]
|
||||
# @schema
|
||||
# -- (string) name of the ConfigMap containing the Kubernetes service endpoint
|
||||
name:
|
||||
# @schema
|
||||
# type: [string, null]
|
||||
# @schema
|
||||
# -- (string) Key in the ConfigMap containing the Kubernetes service endpoint
|
||||
key:
|
||||
# -- (string) Kubernetes service host - use "auto" for automatic lookup from the cluster-info ConfigMap
|
||||
k8sServiceHost: ""
|
||||
# @schema
|
||||
|
|
@ -104,6 +125,15 @@ k8sClientRateLimit:
|
|||
# @default -- 200
|
||||
burst:
|
||||
|
||||
# -- Configure exponential backoff for client-go in Cilium agent.
|
||||
k8sClientExponentialBackoff:
|
||||
# -- Enable exponential backoff for client-go in Cilium agent.
|
||||
enabled: true
|
||||
# -- Configure base (in seconds) for exponential backoff.
|
||||
backoffBaseSeconds: 1
|
||||
# -- Configure maximum duration (in seconds) for exponential backoff.
|
||||
backoffMaxDurationSeconds: 120
|
||||
|
||||
cluster:
|
||||
# -- Name of the cluster. Only required for Cluster Mesh and mutual authentication with SPIRE.
|
||||
# It must respect the following constraints:
|
||||
|
|
@ -181,7 +211,7 @@ serviceAccounts:
|
|||
terminationGracePeriodSeconds: 1
|
||||
# -- Install the cilium agent resources.
|
||||
agent: true
|
||||
# -- Agent container name.
|
||||
# -- Agent daemonset name.
|
||||
name: cilium
|
||||
# -- Roll out cilium agent pods automatically when configmap is updated.
|
||||
rollOutCiliumPods: false
|
||||
|
|
@ -292,6 +322,8 @@ initResources: {}
|
|||
securityContext:
|
||||
# -- User to run the pod with
|
||||
# runAsUser: 0
|
||||
# -- disable privilege escalation
|
||||
allowPrivilegeEscalation: false
|
||||
# -- Run the pod with elevated privileges
|
||||
privileged: false
|
||||
# -- SELinux options for the `cilium-agent` and init containers
|
||||
|
|
@ -419,15 +451,11 @@ bandwidthManager:
|
|||
enabled: false
|
||||
# -- Activate BBR TCP congestion control for Pods
|
||||
bbr: false
|
||||
# -- Activate BBR TCP congestion control for Pods in the host namespace only.
|
||||
bbrHostNamespaceOnly: false
|
||||
# -- Configure standalone NAT46/NAT64 gateway
|
||||
nat46x64Gateway:
|
||||
# -- Enable RFC8215-prefixed translation
|
||||
enabled: false
|
||||
# -- EnableHighScaleIPcache enables the special ipcache mode for high scale
|
||||
# clusters. The ipcache content will be reduced to the strict minimum and
|
||||
# traffic will be encapsulated to carry security identities.
|
||||
highScaleIPcache:
|
||||
# -- Enable the high scale mode for the ipcache.
|
||||
# -- Enable RFC6052-prefixed translation
|
||||
enabled: false
|
||||
# -- Configure L2 announcements
|
||||
l2announcements:
|
||||
|
|
@ -445,6 +473,8 @@ l2podAnnouncements:
|
|||
enabled: false
|
||||
# -- Interface used for sending Gratuitous ARP pod announcements
|
||||
interface: "eth0"
|
||||
# -- A regular expression matching interfaces used for sending Gratuitous ARP pod announcements
|
||||
# interfacePattern: ""
|
||||
# -- This feature set enables virtual BGP routers to be created via
|
||||
# CiliumBGPPeeringPolicy CRDs.
|
||||
bgpControlPlane:
|
||||
|
|
@ -462,6 +492,18 @@ bgpControlPlane:
|
|||
# It is recommended to enable status reporting in general, but if you have any issue
|
||||
# such as high API server load, you can disable it by setting this to false.
|
||||
enabled: true
|
||||
# -- BGP router-id allocation mode
|
||||
routerIDAllocation:
|
||||
# -- BGP router-id allocation mode. In default mode, the router-id is derived from the IPv4 address if it is available, or else it is determined by the lower 32 bits of the MAC address.
|
||||
mode: "default"
|
||||
# -- IP pool to allocate the BGP router-id from when the mode is ip-pool.
|
||||
ipPool: ""
|
||||
# -- Legacy BGP ORIGIN attribute settings (BGPv2 only)
|
||||
legacyOriginAttribute:
|
||||
# -- Enable/Disable advertising LoadBalancerIP routes with the legacy
|
||||
# BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0).
|
||||
# Enable for compatibility with the legacy behavior of MetalLB integration.
|
||||
enabled: false
|
||||
pmtuDiscovery:
|
||||
# -- Enable path MTU discovery to send ICMP fragmentation-needed replies to
|
||||
# the client.
|
||||
|
|
@ -573,6 +615,11 @@ bpf:
|
|||
# type: [null, integer]
|
||||
# @schema
|
||||
policyMapMax: 16384
|
||||
# -- Configure the maximum number of entries in global policy stats map.
|
||||
# @schema
|
||||
# type: [null, integer]
|
||||
# @schema
|
||||
policyStatsMapMax: 65536
|
||||
# @schema
|
||||
# type: [null, number, string]
|
||||
# @schema
|
||||
|
|
@ -642,7 +689,7 @@ bpf:
|
|||
# supported kernels.
|
||||
# @default -- `true`
|
||||
enableTCX: true
|
||||
# -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2, lb-only)
|
||||
# -- (string) Mode for Pod devices for the core datapath (veth, netkit, netkit-l2)
|
||||
# @default -- `veth`
|
||||
datapathMode: veth
|
||||
# -- Enable BPF clock source probing for more efficient tick retrieval.
|
||||
|
|
@ -712,12 +759,16 @@ cni:
|
|||
# readCniConf: /host/etc/cni/net.d/05-sample.conflist.input
|
||||
|
||||
# -- When defined, configMap will mount the provided value as ConfigMap and
|
||||
# interpret the cniConf variable as CNI configuration file and write it
|
||||
# when the agent starts up
|
||||
# configMap: cni-configuration
|
||||
# interpret the 'cni.configMapKey' value as CNI configuration file and write it
|
||||
# when the agent starts up.
|
||||
configMap: ""
|
||||
|
||||
# -- Configure the key in the CNI ConfigMap to read the contents of
|
||||
# the CNI configuration from.
|
||||
# the CNI configuration from. For this to be effective, the 'cni.configMap'
|
||||
# parameter must be specified too.
|
||||
# Note that the 'cni.configMap' parameter is the name of the ConfigMap, while
|
||||
# 'cni.configMapKey' is the name of the key in the ConfigMap data containing
|
||||
# the actual configuration.
|
||||
configMapKey: cni-config
|
||||
# -- Configure the path to where to mount the ConfigMap inside the agent pod.
|
||||
confFileMountPath: /tmp/cni-configuration
|
||||
|
|
@ -731,6 +782,16 @@ cni:
|
|||
memory: 10Mi
|
||||
# -- Enable route MTU for pod netns when CNI chaining is used
|
||||
enableRouteMTUForCNIChaining: false
|
||||
# -- Enable the removal of iptables rules created by the AWS CNI VPC plugin.
|
||||
iptablesRemoveAWSRules: true
|
||||
# @schema
|
||||
# type: [null, number]
|
||||
# @schema
|
||||
# -- (float64) Ratio of the connectivity probe frequency vs resource usage, a float in
|
||||
# [0, 1]. 0 will give more frequent probing, 1 will give less frequent probing. Probing
|
||||
# frequency is dynamically adjusted based on the cluster size.
|
||||
# @default -- `0.5`
|
||||
connectivityProbeFrequencyRatio: ~
|
||||
# -- (string) Configure how frequently garbage collection should occur for the datapath
|
||||
# connection tracking table.
|
||||
# @default -- `"0s"`
|
||||
|
|
@ -796,14 +857,6 @@ daemon:
|
|||
# a non-local route. This should be used only when autodetection is not suitable.
|
||||
# devices: ""
|
||||
|
||||
# -- Enables experimental support for the detection of new and removed datapath
|
||||
# devices. When devices change the eBPF datapath is reloaded and services updated.
|
||||
# If "devices" is set then only those devices, or devices matching a wildcard will
|
||||
# be considered.
|
||||
#
|
||||
# This option has been deprecated and is a no-op.
|
||||
enableRuntimeDeviceDetection: true
|
||||
|
||||
# -- Forces the auto-detection of devices, even if specific devices are explicitly listed
|
||||
forceDeviceDetection: false
|
||||
|
||||
|
|
@ -819,9 +872,7 @@ forceDeviceDetection: false
|
|||
# -- Enable Kubernetes EndpointSlice feature in Cilium if the cluster supports it.
|
||||
# enableK8sEndpointSlice: true
|
||||
|
||||
# -- Enable CiliumEndpointSlice feature (deprecated, please use `ciliumEndpointSlice.enabled` instead).
|
||||
enableCiliumEndpointSlice: false
|
||||
|
||||
# -- CiliumEndpointSlice configuration options.
|
||||
ciliumEndpointSlice:
|
||||
# -- Enable Cilium EndpointSlice feature.
|
||||
enabled: false
|
||||
|
|
@ -838,13 +889,13 @@ ciliumEndpointSlice:
|
|||
limit: 50
|
||||
burst: 100
|
||||
|
||||
# @schema
|
||||
# enum: ["identity", "fcfs"]
|
||||
# @schema
|
||||
# -- The slicing mode to use for CiliumEndpointSlices.
|
||||
# identity groups together CiliumEndpoints that share the same identity.
|
||||
# fcfs groups together CiliumEndpoints in a first-come-first-serve basis, filling in the largest non-full slice first.
|
||||
sliceMode: identity
|
||||
# @schema
|
||||
# enum: ["agent", "operator", "both"]
|
||||
# @schema
|
||||
# -- Control whether CiliumIdentities are created by the agent ("agent"), the operator ("operator") or both ("both").
|
||||
# "Both" should be used only to migrate between "agent" and "operator".
|
||||
# Operator-managed identities is a beta feature.
|
||||
identityManagementMode: "agent"
|
||||
|
||||
envoyConfig:
|
||||
# -- Enable CiliumEnvoyConfig CRD
|
||||
|
|
@ -1057,8 +1108,6 @@ endpointLockdownOnMapOverflow: false
|
|||
eni:
|
||||
# -- Enable Elastic Network Interface (ENI) integration.
|
||||
enabled: false
|
||||
# -- Update ENI Adapter limits from the EC2 API
|
||||
updateEC2AdapterLimitViaAPI: true
|
||||
# -- Release IPs not used from the ENI
|
||||
awsReleaseExcessIPs: false
|
||||
# -- Enable ENI prefix delegation
|
||||
|
|
@ -1107,9 +1156,6 @@ healthCheckICMPFailureThreshold: 3
|
|||
hostFirewall:
|
||||
# -- Enables the enforcement of host policies in the eBPF datapath.
|
||||
enabled: false
|
||||
hostPort:
|
||||
# -- Enable hostPort service support.
|
||||
enabled: false
|
||||
# -- Configure socket LB
|
||||
socketLB:
|
||||
# -- Enable socket LB
|
||||
|
|
@ -1154,6 +1200,9 @@ certgen:
|
|||
# -- Node tolerations for pod assignment on nodes with taints
|
||||
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
|
||||
tolerations: []
|
||||
# -- Resource limits for certgen
|
||||
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers
|
||||
resources: {}
|
||||
# -- Additional certgen volumes.
|
||||
extraVolumes: []
|
||||
# -- Additional certgen volumeMounts.
|
||||
|
|
@ -1249,11 +1298,17 @@ hubble:
|
|||
jobLabel: ""
|
||||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# -- Relabeling configs for the ServiceMonitor hubble
|
||||
relabelings:
|
||||
- sourceLabels:
|
||||
- __meta_kubernetes_pod_node_name
|
||||
targetLabel: node
|
||||
action: replace
|
||||
replacement: ${1}
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
|
|
@ -1293,6 +1348,10 @@ hubble:
|
|||
# excludeFilters: []
|
||||
# -- Unix domain socket path to listen to when Hubble is enabled.
|
||||
socketPath: /var/run/cilium/hubble.sock
|
||||
# -- Enables network policy correlation of Hubble flows, i.e. populating `egress_allowed_by`, `ingress_denied_by` fields with policy information.
|
||||
networkPolicyCorrelation:
|
||||
# @default -- `true`
|
||||
enabled: true
|
||||
# -- Enables redacting sensitive information present in Layer 7 flows.
|
||||
redact:
|
||||
enabled: false
|
||||
|
|
@ -1354,7 +1413,7 @@ hubble:
|
|||
# --set hubble.redact.http.headers.deny="Authorization,Proxy-Authorization"
|
||||
deny: []
|
||||
kafka:
|
||||
# -- Enables redacting Kafka's API key.
|
||||
# -- Enables redacting Kafka's API key (deprecated, will be removed in v1.19).
|
||||
# Example:
|
||||
#
|
||||
# redact:
|
||||
|
|
@ -1512,6 +1571,11 @@ hubble:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- The priority class to use for hubble-relay
|
||||
priorityClassName: ""
|
||||
# -- Configure termination grace period for hubble relay Deployment.
|
||||
|
|
@ -1531,12 +1595,17 @@ hubble:
|
|||
# -- hubble-relay pod security context
|
||||
podSecurityContext:
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
# -- hubble-relay container security context
|
||||
securityContext:
|
||||
# readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
|
@ -1597,13 +1666,6 @@ hubble:
|
|||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Dial timeout to connect to the local hubble instance to receive peer information (e.g. "30s").
|
||||
#
|
||||
# This option has been deprecated and is a no-op.
|
||||
dialTimeout: ~
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Backoff duration to retry connecting to the local hubble instance in case of failure (e.g. "30s").
|
||||
retryTimeout: ~
|
||||
# @schema
|
||||
|
|
@ -1638,6 +1700,11 @@ hubble:
|
|||
annotations: {}
|
||||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# -- Specify the Kubernetes namespace where Prometheus expects to find
|
||||
# service monitors configured.
|
||||
# namespace: ""
|
||||
|
|
@ -1714,7 +1781,8 @@ hubble:
|
|||
useDigest: true
|
||||
pullPolicy: "${PULL_POLICY}"
|
||||
# -- Hubble-ui backend security context.
|
||||
securityContext: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
# -- Additional hubble-ui backend environment variables.
|
||||
extraEnv: []
|
||||
# -- Additional hubble-ui backend volumes.
|
||||
|
|
@ -1748,7 +1816,8 @@ hubble:
|
|||
useDigest: true
|
||||
pullPolicy: "${PULL_POLICY}"
|
||||
# -- Hubble-ui frontend security context.
|
||||
securityContext: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
# -- Additional hubble-ui frontend environment variables.
|
||||
extraEnv: []
|
||||
# -- Additional hubble-ui frontend volumes.
|
||||
|
|
@ -1793,6 +1862,11 @@ hubble:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- Affinity for hubble-ui
|
||||
affinity: {}
|
||||
# -- Pod topology spread constraints for hubble-ui
|
||||
|
|
@ -1827,6 +1901,8 @@ hubble:
|
|||
service:
|
||||
# -- Annotations to be added for the Hubble UI service
|
||||
annotations: {}
|
||||
# -- Labels to be added for the Hubble UI service
|
||||
labels: {}
|
||||
# --- The type of service used for Hubble UI access, either ClusterIP or NodePort.
|
||||
type: ClusterIP
|
||||
# --- The port to use when the service type is set to NodePort.
|
||||
|
|
@ -1851,10 +1927,6 @@ hubble:
|
|||
# - chart-example.local
|
||||
# -- Hubble flows export.
|
||||
export:
|
||||
# --- Defines max file size of output file before it gets rotated.
|
||||
fileMaxSizeMb: 10
|
||||
# --- Defines max number of backup/rotated files.
|
||||
fileMaxBackups: 5
|
||||
# --- Static exporter configuration.
|
||||
# Static exporter is bound to agent lifecycle.
|
||||
static:
|
||||
|
|
@ -1870,6 +1942,12 @@ hubble:
|
|||
denyList: []
|
||||
# - '{"source_pod":["kube-system/"]}'
|
||||
# - '{"destination_pod":["kube-system/"]}'
|
||||
# --- Defines max file size of output file before it gets rotated.
|
||||
fileMaxSizeMb: 10
|
||||
# --- Defines max number of backup/rotated files.
|
||||
fileMaxBackups: 5
|
||||
# --- Enable compression of rotated files.
|
||||
fileCompress: false
|
||||
# --- Dynamic exporters configuration.
|
||||
# Dynamic exporters may be reconfigured without a need of agent restarts.
|
||||
dynamic:
|
||||
|
|
@ -1887,6 +1965,9 @@ hubble:
|
|||
includeFilters: []
|
||||
excludeFilters: []
|
||||
filePath: "/var/run/cilium/hubble/events.log"
|
||||
fileMaxSizeMb: 10
|
||||
fileMaxBackups: 5
|
||||
fileCompress: false
|
||||
# - name: "test002"
|
||||
# filePath: "/var/log/network/flow-log/pa/test002.log"
|
||||
# fieldMask: ["source.namespace", "source.pod_name", "destination.namespace", "destination.pod_name", "verdict"]
|
||||
|
|
@ -1896,6 +1977,9 @@ hubble:
|
|||
# - type: 1
|
||||
# - destination_pod: ["frontend/nginx-975996d4c-7hhgt"]
|
||||
# excludeFilters: []
|
||||
# fileMaxSizeMb: 1
|
||||
# fileMaxBackups: 10
|
||||
# fileCompress: true
|
||||
# end: "2023-10-09T23:59:59-07:00"
|
||||
|
||||
# -- Emit v1.Events related to pods on detection of packet drops.
|
||||
|
|
@ -2012,14 +2096,18 @@ k8s:
|
|||
# -- requireIPv6PodCIDR enables waiting for Kubernetes to provide the PodCIDR
|
||||
# range via the Kubernetes node resource
|
||||
requireIPv6PodCIDR: false
|
||||
# -- A space separated list of Kubernetes API server URLs to use with the client.
|
||||
# For example "https://192.168.0.1:6443 https://192.168.0.2:6443"
|
||||
# apiServerURLs: ""
|
||||
|
||||
# -- Keep the deprecated selector labels when deploying Cilium DaemonSet.
|
||||
keepDeprecatedLabels: false
|
||||
# -- Keep the deprecated probes when deploying Cilium DaemonSet
|
||||
keepDeprecatedProbes: false
|
||||
startupProbe:
|
||||
# -- failure threshold of startup probe.
|
||||
# 105 x 2s translates to the old behaviour of the readiness probe (120s delay + 30 x 3s)
|
||||
failureThreshold: 105
|
||||
# Allow Cilium to take up to 600s to start up (300 attempts with 2s between attempts).
|
||||
failureThreshold: 300
|
||||
# -- interval between checks of the startup probe
|
||||
periodSeconds: 2
|
||||
livenessProbe:
|
||||
|
|
@ -2037,7 +2125,10 @@ readinessProbe:
|
|||
# -- Configure the kube-proxy replacement in Cilium BPF datapath
|
||||
# Valid options are "true" or "false".
|
||||
# ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/
|
||||
#kubeProxyReplacement: "false"
|
||||
# @schema@
|
||||
# type: [string, boolean]
|
||||
# @schema@
|
||||
kubeProxyReplacement: "false"
|
||||
|
||||
# -- healthz server bind address for the kube-proxy replacement.
|
||||
# To enable set the value to '0.0.0.0:10256' for all ipv4
|
||||
|
|
@ -2046,13 +2137,24 @@ readinessProbe:
|
|||
kubeProxyReplacementHealthzBindAddr: ""
|
||||
l2NeighDiscovery:
|
||||
# -- Enable L2 neighbor discovery in the agent
|
||||
enabled: true
|
||||
# -- Override the agent's default neighbor resolution refresh period.
|
||||
refreshPeriod: "30s"
|
||||
enabled: false
|
||||
# -- Enable Layer 7 network policy.
|
||||
l7Proxy: true
|
||||
# -- Enable Local Redirect Policy.
|
||||
|
||||
# -- Enable Local Redirect Policy (deprecated, please use 'localRedirectPolicies.enabled' instead)
|
||||
localRedirectPolicy: false
|
||||
|
||||
localRedirectPolicies:
|
||||
# -- Enable local redirect policies.
|
||||
enabled: false
|
||||
|
||||
# -- Limit the allowed addresses in Address Matcher rule of
|
||||
# Local Redirect Policies to the given CIDRs.
|
||||
# @schema@
|
||||
# type: [null, array]
|
||||
# @schema@
|
||||
addressMatcherCIDRs: ~
|
||||
|
||||
# To include or exclude matched resources from cilium identity evaluation
|
||||
# labels: ""
|
||||
|
||||
|
|
@ -2071,8 +2173,12 @@ maglev: {}
|
|||
# -- hashSeed is the cluster-wide base64 encoded seed for the hashing
|
||||
# hashSeed:
|
||||
|
||||
# -- Enables masquerading of IPv4 traffic leaving the node from endpoints.
|
||||
enableIPv4Masquerade: true
|
||||
# @schema
|
||||
# type: [null, boolean]
|
||||
# @schema
|
||||
# -- (bool) Enables masquerading of IPv4 traffic leaving the node from endpoints.
|
||||
# @default -- `true` unless ipam eni mode is active
|
||||
enableIPv4Masquerade: ~
|
||||
# -- Enables masquerading of IPv6 traffic leaving the node from endpoints.
|
||||
enableIPv6Masquerade: true
|
||||
# -- Enables masquerading to the source of the route for traffic leaving the node from endpoints.
|
||||
|
|
@ -2154,18 +2260,14 @@ loadBalancer:
|
|||
# path), or best-effort (use native mode XDP acceleration on devices
|
||||
# that support it).
|
||||
acceleration: disabled
|
||||
# -- dsrDispatch configures whether IP option or IPIP encapsulation is
|
||||
# used to pass a service IP and port to remote backend
|
||||
# -- dsrDispatch configures whether IP option (opt), IPIP encapsulation (ipip),
|
||||
# Geneve Class Option (geneve) used to pass a service IP and port to remote backend
|
||||
# dsrDispatch: opt
|
||||
|
||||
# -- serviceTopology enables K8s Topology Aware Hints -based service
|
||||
# endpoints filtering
|
||||
# serviceTopology: false
|
||||
|
||||
# -- experimental enables support for the experimental load-balancing
|
||||
# control-plane.
|
||||
experimental: false
|
||||
|
||||
# -- L7 LoadBalancer
|
||||
l7:
|
||||
# -- Enable L7 service load balancing via envoy proxy.
|
||||
|
|
@ -2251,6 +2353,11 @@ prometheus:
|
|||
jobLabel: ""
|
||||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# -- Specify the Kubernetes namespace where Prometheus expects to find
|
||||
# service monitors configured.
|
||||
# namespace: ""
|
||||
|
|
@ -2259,6 +2366,7 @@ prometheus:
|
|||
- sourceLabels:
|
||||
- __meta_kubernetes_pod_node_name
|
||||
targetLabel: node
|
||||
action: replace
|
||||
replacement: ${1}
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
|
|
@ -2361,6 +2469,9 @@ envoy:
|
|||
# -- Set Envoy upstream HTTP idle connection timeout seconds.
|
||||
# Does not apply to connections with pending requests. Default 60s
|
||||
idleTimeoutDurationSeconds: 60
|
||||
# -- Set Envoy the amount of time that the connection manager will allow a stream to exist with no upstream or downstream activity.
|
||||
# default 5 minutes
|
||||
streamIdleTimeoutDurationSeconds: 300
|
||||
# -- Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the ingress L7 policy enforcement Envoy listeners.
|
||||
xffNumTrustedHopsL7PolicyIngress: 0
|
||||
# -- Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the egress L7 policy enforcement Envoy listeners.
|
||||
|
|
@ -2370,6 +2481,8 @@ envoy:
|
|||
# @schema
|
||||
# -- Max duration to wait for endpoint policies to be restored on restart. Default "3m".
|
||||
policyRestoreTimeoutDuration: null
|
||||
# -- Time in seconds to block Envoy worker thread while an upstream HTTP connection is closing. If set to 0, the connection is closed immediately (with TCP RST). If set to -1, the connection is closed asynchronously in the background.
|
||||
httpUpstreamLingerTimeout: null
|
||||
# -- Envoy container image.
|
||||
image:
|
||||
# @schema
|
||||
|
|
@ -2446,12 +2559,16 @@ envoy:
|
|||
# memory: 512Mi
|
||||
|
||||
startupProbe:
|
||||
# -- Enable startup probe for cilium-envoy
|
||||
enabled: true
|
||||
# -- failure threshold of startup probe.
|
||||
# 105 x 2s translates to the old behaviour of the readiness probe (120s delay + 30 x 3s)
|
||||
failureThreshold: 105
|
||||
# -- interval between checks of the startup probe
|
||||
periodSeconds: 2
|
||||
livenessProbe:
|
||||
# -- Enable liveness probe for cilium-envoy
|
||||
enabled: true
|
||||
# -- failure threshold of liveness probe
|
||||
failureThreshold: 10
|
||||
# -- interval between checks of the liveness probe
|
||||
|
|
@ -2564,6 +2681,11 @@ envoy:
|
|||
annotations: {}
|
||||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# -- Specify the Kubernetes namespace where Prometheus expects to find
|
||||
# service monitors configured.
|
||||
# namespace: ""
|
||||
|
|
@ -2573,6 +2695,7 @@ envoy:
|
|||
- sourceLabels:
|
||||
- __meta_kubernetes_pod_node_name
|
||||
targetLabel: node
|
||||
action: replace
|
||||
replacement: ${1}
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
|
|
@ -2586,6 +2709,10 @@ envoy:
|
|||
# -- Enable/Disable use of node label based identity
|
||||
nodeSelectorLabels: false
|
||||
|
||||
# To include or exclude matched resources from cilium node identity evaluation
|
||||
# List of labels just like --labels flag (.Values.labels)
|
||||
# nodeLabels: ""
|
||||
|
||||
# -- Enable resource quotas for priority classes used in the cluster.
|
||||
resourceQuotas:
|
||||
enabled: false
|
||||
|
|
@ -2601,6 +2728,9 @@ resourceQuotas:
|
|||
##################
|
||||
#sessionAffinity: false
|
||||
|
||||
# -- Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace)
|
||||
secretsNamespaceAnnotations: {}
|
||||
|
||||
# -- Do not run Cilium agent when running with clean mode. Useful to completely
|
||||
# uninstall Cilium as it will stop Cilium from starting and create artifacts
|
||||
# in the node.
|
||||
|
|
@ -2688,6 +2818,9 @@ tls:
|
|||
# - geneve
|
||||
# @default -- `"vxlan"`
|
||||
tunnelProtocol: ""
|
||||
# -- IP family for the underlay.
|
||||
# @default -- `"ipv4"`
|
||||
underlayProtocol: ""
|
||||
# -- Enable native-routing mode or tunneling mode.
|
||||
# Possible values:
|
||||
# - ""
|
||||
|
|
@ -2787,12 +2920,19 @@ operator:
|
|||
kubernetes.io/os: linux
|
||||
# -- Node tolerations for cilium-operator scheduling to nodes with taints
|
||||
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
# - key: "key"
|
||||
# operator: "Equal|Exists"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
|
||||
# Toleration for agentNotReadyTaintKey taint is always added to cilium-operator pods.
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
tolerations:
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
operator: Exists
|
||||
- key: "node-role.kubernetes.io/master" #deprecated
|
||||
operator: Exists
|
||||
- key: "node.kubernetes.io/not-ready"
|
||||
operator: Exists
|
||||
- key: "node.cloudprovider.kubernetes.io/uninitialized"
|
||||
operator: Exists
|
||||
# -- Additional cilium-operator container arguments.
|
||||
extraArgs: []
|
||||
# -- Additional cilium-operator environment variables.
|
||||
|
|
@ -2815,7 +2955,9 @@ operator:
|
|||
# -- HostNetwork setting
|
||||
hostNetwork: true
|
||||
# -- Security context to be added to cilium-operator pods
|
||||
podSecurityContext: {}
|
||||
podSecurityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
# -- Annotations to be added to cilium-operator pods
|
||||
podAnnotations: {}
|
||||
# -- Labels to be added to cilium-operator pods
|
||||
|
|
@ -2836,6 +2978,11 @@ operator:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- cilium-operator resource limits & requests
|
||||
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
|
@ -2847,7 +2994,11 @@ operator:
|
|||
# memory: 128Mi
|
||||
|
||||
# -- Security context to be added to cilium-operator pods
|
||||
securityContext: {}
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
# runAsUser: 0
|
||||
|
||||
# -- Interval for endpoint garbage collection.
|
||||
|
|
@ -2884,6 +3035,11 @@ operator:
|
|||
# -- Interval for scrape metrics.
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
# -- Relabeling configs for the ServiceMonitor cilium-operator
|
||||
|
|
@ -2984,6 +3140,7 @@ nodeinit:
|
|||
memory: 100Mi
|
||||
# -- Security context to be added to nodeinit pods.
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
seLinuxOptions:
|
||||
level: 's0'
|
||||
|
|
@ -3026,6 +3183,18 @@ preflight:
|
|||
digest: ${CILIUM_DIGEST}
|
||||
useDigest: ${USE_DIGESTS}
|
||||
pullPolicy: "${PULL_POLICY}"
|
||||
envoy:
|
||||
# -- Envoy pre-flight image.
|
||||
image:
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
override: ~
|
||||
repository: "${CILIUM_ENVOY_REPO}"
|
||||
tag: "${CILIUM_ENVOY_VERSION}"
|
||||
pullPolicy: "${PULL_POLICY}"
|
||||
digest: "${CILIUM_ENVOY_DIGEST}"
|
||||
useDigest: true
|
||||
# -- The priority class to use for the preflight pod.
|
||||
priorityClassName: ""
|
||||
# -- preflight update strategy
|
||||
|
|
@ -3081,6 +3250,11 @@ preflight:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- preflight resource limits & requests
|
||||
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
|
@ -3097,7 +3271,8 @@ preflight:
|
|||
# -- interval between checks of the readiness probe
|
||||
periodSeconds: 5
|
||||
# -- Security context to be added to preflight pods
|
||||
securityContext: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
# runAsUser: 0
|
||||
|
||||
# -- Path to write the `--tofqdns-pre-cache` file to.
|
||||
|
|
@ -3131,6 +3306,8 @@ clustermesh:
|
|||
enableEndpointSliceSynchronization: false
|
||||
# -- Enable Multi-Cluster Services API support
|
||||
enableMCSAPISupport: false
|
||||
# -- Control whether policy rules assume by default the local cluster if not explicitly selected
|
||||
policyDefaultLocalCluster: false
|
||||
|
||||
# -- Annotations to be added to all top-level clustermesh objects (resources under templates/clustermesh-apiserver and templates/clustermesh-config)
|
||||
annotations: {}
|
||||
|
|
@ -3231,7 +3408,7 @@ clustermesh:
|
|||
|
||||
kvstoremesh:
|
||||
# -- Enable KVStoreMesh. KVStoreMesh caches the information retrieved
|
||||
# from the remote clusters in the local etcd instance.
|
||||
# from the remote clusters in the local etcd instance (deprecated - KVStoreMesh will always be enabled once the option is removed).
|
||||
enabled: true
|
||||
|
||||
# -- TCP port for the KVStoreMesh health API.
|
||||
|
|
@ -3262,6 +3439,11 @@ clustermesh:
|
|||
- ALL
|
||||
# -- lifecycle setting for the KVStoreMesh container
|
||||
lifecycle: {}
|
||||
# -- Specify the KVStore mode when running KVStoreMesh
|
||||
# Supported values:
|
||||
# - "internal": remote cluster identities are cached in etcd that runs as a sidecar within ``clustermesh-apiserver`` pod.
|
||||
# - "external": ``clustermesh-apiserver`` will sync remote cluster information to the etcd used as kvstore. This can't be enabled with crd identity allocation mode.
|
||||
kvstoreMode: "internal"
|
||||
service:
|
||||
# -- The type of service used for apiserver access.
|
||||
type: NodePort
|
||||
|
|
@ -3375,6 +3557,11 @@ clustermesh:
|
|||
# @schema
|
||||
# -- Maximum number/percentage of pods that may be made unavailable
|
||||
maxUnavailable: 1
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- How are unhealthy, but running, pods counted for eviction
|
||||
unhealthyPodEvictionPolicy: null
|
||||
# -- Resource requests and limits for the clustermesh-apiserver
|
||||
resources: {}
|
||||
# requests:
|
||||
|
|
@ -3541,6 +3728,11 @@ clustermesh:
|
|||
# -- Interval for scrape metrics (apiserver metrics)
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
# -- Relabeling configs for the ServiceMonitor clustermesh-apiserver (apiserver metrics)
|
||||
|
|
@ -3554,6 +3746,11 @@ clustermesh:
|
|||
# -- Interval for scrape metrics (KVStoreMesh metrics)
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
# -- Relabeling configs for the ServiceMonitor clustermesh-apiserver (KVStoreMesh metrics)
|
||||
|
|
@ -3567,6 +3764,11 @@ clustermesh:
|
|||
# -- Interval for scrape metrics (etcd metrics)
|
||||
interval: "10s"
|
||||
# @schema
|
||||
# type: [null, string]
|
||||
# @schema
|
||||
# -- Timeout after which scrape is considered to be failed.
|
||||
scrapeTimeout: ~
|
||||
# @schema
|
||||
# type: [null, array]
|
||||
# @schema
|
||||
# -- Relabeling configs for the ServiceMonitor clustermesh-apiserver (etcd metrics)
|
||||
|
|
@ -3576,10 +3778,6 @@ clustermesh:
|
|||
# @schema
|
||||
# -- Metrics relabeling configs for the ServiceMonitor clustermesh-apiserver (etcd metrics)
|
||||
metricRelabelings: ~
|
||||
# -- Configure external workloads support
|
||||
externalWorkloads:
|
||||
# -- Enable support for external workloads, such as VMs (false by default).
|
||||
enabled: false
|
||||
# -- Configure cgroup related configuration
|
||||
cgroup:
|
||||
autoMount:
|
||||
|
|
@ -3604,9 +3802,6 @@ cgroup:
|
|||
sysctlfix:
|
||||
# -- Enable the sysctl override. When enabled, the init container will mount the /proc of the host so that the `sysctlfix` utility can execute.
|
||||
enabled: true
|
||||
# -- Configure whether to enable auto detect of terminating state for endpoints
|
||||
# in order to support graceful termination.
|
||||
enableK8sTerminatingEndpoint: true
|
||||
# -- Configure whether to unload DNS policy rules on graceful shutdown
|
||||
# dnsPolicyUnloadOnShutdown: false
|
||||
|
||||
|
|
@ -3639,6 +3834,9 @@ dnsProxy:
|
|||
proxyResponseMaxDelay: 100ms
|
||||
# -- DNS proxy operation mode (true/false, or unset to use version dependent defaults)
|
||||
# enableTransparentMode: true
|
||||
# -- Pre-allocate ToFQDN identities. This reduces DNS proxy tail latency, at the potential cost of some
|
||||
# unnecessary policymap entries. Disable this if you have a large (200+) number of unique ToFQDN selectors.
|
||||
preAllocateIdentities: true
|
||||
# -- SCTP Configuration Values
|
||||
sctp:
|
||||
# -- Enable SCTP support. NOTE: Currently, SCTP support does not support rewriting ports or multihoming.
|
||||
|
|
@ -3843,3 +4041,4 @@ authentication:
|
|||
enableInternalTrafficPolicy: true
|
||||
# -- Enable LoadBalancer IP Address Management
|
||||
enableLBIPAM: true
|
||||
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
ARG VERSION=v1.17.8
|
||||
ARG VERSION=v1.18.5
|
||||
FROM quay.io/cilium/cilium:${VERSION}
|
||||
|
|
|
|||
|
|
@ -15,6 +15,5 @@ cilium:
|
|||
enableIPv4Masquerade: false
|
||||
enableIPv6Masquerade: false
|
||||
enableIdentityMark: false
|
||||
enableRuntimeDeviceDetection: true
|
||||
forceDeviceDetection: true
|
||||
devices: "ovn0 genev_sys_6081"
|
||||
|
|
|
|||
|
|
@ -1,3 +1,10 @@
|
|||
# macOS-compatible sed in-place
|
||||
ifeq ($(shell uname),Darwin)
|
||||
SED_INPLACE := sed -i ''
|
||||
else
|
||||
SED_INPLACE := sed -i
|
||||
endif
|
||||
|
||||
REGISTRY ?= ghcr.io/cozystack/cozystack
|
||||
TAG = $(shell git describe --tags --exact-match 2>/dev/null || echo latest)
|
||||
PUSH := 1
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue