deploy/cluster/templates/calico-addon.yaml

   1 {{- if eq .Values.cni "calico" }}
   2 {{- if eq .Values.ipam "ipv4" }}
   3 ---
   4 apiVersion: v1
   5 data:
   6   calico.yaml: |
   7     apiVersion: apiextensions.k8s.io/v1
   8     kind: CustomResourceDefinition
   9     metadata:
  10       name: bgpconfigurations.crd.projectcalico.org
  11     spec:
  12       group: crd.projectcalico.org
  13       names:
  14         kind: BGPConfiguration
  15         listKind: BGPConfigurationList
  16         plural: bgpconfigurations
  17         singular: bgpconfiguration
  18       scope: Cluster
  19       versions:
  20       - name: v1
  21         schema:
  22           openAPIV3Schema:
  23             description: BGPConfiguration contains the configuration for any BGP routing.
  24             properties:
  25               apiVersion:
  26                 description: 'APIVersion defines the versioned schema of this representation
  27                   of an object. Servers should convert recognized schemas to the latest
  28                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  29                 type: string
  30               kind:
  31                 description: 'Kind is a string value representing the REST resource this
  32                   object represents. Servers may infer this from the endpoint the client
  33                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  34                 type: string
  35               metadata:
  36                 type: object
  37               spec:
  38                 description: BGPConfigurationSpec contains the values of the BGP configuration.
  39                 properties:
  40                   asNumber:
  41                     description: 'ASNumber is the default AS number used by a node. [Default:
  42                       64512]'
  43                     format: int32
  44                     type: integer
  45                   communities:
  46                     description: Communities is a list of BGP community values and their
  47                       arbitrary names for tagging routes.
  48                     items:
  49                       description: Community contains standard or large community value
  50                         and its name.
  51                       properties:
  52                         name:
  53                           description: Name given to community value.
  54                           type: string
  55                         value:
  56                           description: Value must be of format `aa:nn` or `aa:nn:mm`.
  57                             For standard community use `aa:nn` format, where `aa` and
  58                             `nn` are 16 bit number. For large community use `aa:nn:mm`
  59                             format, where `aa`, `nn` and `mm` are 32 bit number. Where,
  60                             `aa` is an AS Number, `nn` and `mm` are per-AS identifier.
  61                           pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$
  62                           type: string
  63                       type: object
  64                     type: array
  65                   listenPort:
  66                     description: ListenPort is the port where BGP protocol should listen.
  67                       Defaults to 179
  68                     maximum: 65535
  69                     minimum: 1
  70                     type: integer
  71                   logSeverityScreen:
  72                     description: 'LogSeverityScreen is the log severity above which logs
  73                       are sent to the stdout. [Default: INFO]'
  74                     type: string
  75                   nodeToNodeMeshEnabled:
  76                     description: 'NodeToNodeMeshEnabled sets whether full node to node
  77                       BGP mesh is enabled. [Default: true]'
  78                     type: boolean
  79                   prefixAdvertisements:
  80                     description: PrefixAdvertisements contains per-prefix advertisement
  81                       configuration.
  82                     items:
  83                       description: PrefixAdvertisement configures advertisement properties
  84                         for the specified CIDR.
  85                       properties:
  86                         cidr:
  87                           description: CIDR for which properties should be advertised.
  88                           type: string
  89                         communities:
  90                           description: Communities can be list of either community names
  91                             already defined in `Specs.Communities` or community value
  92                             of format `aa:nn` or `aa:nn:mm`. For standard community use
  93                             `aa:nn` format, where `aa` and `nn` are 16 bit number. For
  94                             large community use `aa:nn:mm` format, where `aa`, `nn` and
  95                             `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and
  96                             `mm` are per-AS identifier.
  97                           items:
  98                             type: string
  99                           type: array
 100                       type: object
 101                     type: array
 102                   serviceClusterIPs:
 103                     description: ServiceClusterIPs are the CIDR blocks from which service
 104                       cluster IPs are allocated. If specified, Calico will advertise these
 105                       blocks, as well as any cluster IPs within them.
 106                     items:
 107                       description: ServiceClusterIPBlock represents a single allowed ClusterIP
 108                         CIDR block.
 109                       properties:
 110                         cidr:
 111                           type: string
 112                       type: object
 113                     type: array
 114                   serviceExternalIPs:
 115                     description: ServiceExternalIPs are the CIDR blocks for Kubernetes
 116                       Service External IPs. Kubernetes Service ExternalIPs will only be
 117                       advertised if they are within one of these blocks.
 118                     items:
 119                       description: ServiceExternalIPBlock represents a single allowed
 120                         External IP CIDR block.
 121                       properties:
 122                         cidr:
 123                           type: string
 124                       type: object
 125                     type: array
 126                   serviceLoadBalancerIPs:
 127                     description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes
 128                       Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress
 129                       IPs will only be advertised if they are within one of these blocks.
 130                     items:
 131                       description: ServiceLoadBalancerIPBlock represents a single allowed
 132                         LoadBalancer IP CIDR block.
 133                       properties:
 134                         cidr:
 135                           type: string
 136                       type: object
 137                     type: array
 138                 type: object
 139             type: object
 140         served: true
 141         storage: true
 142     status:
 143       acceptedNames:
 144         kind: ""
 145         plural: ""
 146       conditions: []
 147       storedVersions: []
 148     ---
 149     apiVersion: apiextensions.k8s.io/v1
 150     kind: CustomResourceDefinition
 151     metadata:
 152       name: bgppeers.crd.projectcalico.org
 153     spec:
 154       group: crd.projectcalico.org
 155       names:
 156         kind: BGPPeer
 157         listKind: BGPPeerList
 158         plural: bgppeers
 159         singular: bgppeer
 160       scope: Cluster
 161       versions:
 162       - name: v1
 163         schema:
 164           openAPIV3Schema:
 165             properties:
 166               apiVersion:
 167                 description: 'APIVersion defines the versioned schema of this representation
 168                   of an object. Servers should convert recognized schemas to the latest
 169                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 170                 type: string
 171               kind:
 172                 description: 'Kind is a string value representing the REST resource this
 173                   object represents. Servers may infer this from the endpoint the client
 174                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 175                 type: string
 176               metadata:
 177                 type: object
 178               spec:
 179                 description: BGPPeerSpec contains the specification for a BGPPeer resource.
 180                 properties:
 181                   asNumber:
 182                     description: The AS Number of the peer.
 183                     format: int32
 184                     type: integer
 185                   keepOriginalNextHop:
 186                     description: Option to keep the original nexthop field when routes
 187                       are sent to a BGP Peer. Setting "true" configures the selected BGP
 188                       Peers node to use the "next hop keep;" instead of "next hop self;"(default)
 189                       in the specific branch of the Node on "bird.cfg".
 190                     type: boolean
 191                   maxRestartTime:
 192                     description: Time to allow for software restart.  When specified,
 193                       this is configured as the graceful restart timeout.  When not specified,
 194                       the BIRD default of 120s is used.
 195                     type: string
 196                   node:
 197                     description: The node name identifying the Calico node instance that
 198                       is targeted by this peer. If this is not set, and no nodeSelector
 199                       is specified, then this BGP peer selects all nodes in the cluster.
 200                     type: string
 201                   nodeSelector:
 202                     description: Selector for the nodes that should have this peering.  When
 203                       this is set, the Node field must be empty.
 204                     type: string
 205                   password:
 206                     description: Optional BGP password for the peerings generated by this
 207                       BGPPeer resource.
 208                     properties:
 209                       secretKeyRef:
 210                         description: Selects a key of a secret in the node pod's namespace.
 211                         properties:
 212                           key:
 213                             description: The key of the secret to select from.  Must be
 214                               a valid secret key.
 215                             type: string
 216                           name:
 217                             description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 218                               TODO: Add other useful fields. apiVersion, kind, uid?'
 219                             type: string
 220                           optional:
 221                             description: Specify whether the Secret or its key must be
 222                               defined
 223                             type: boolean
 224                         required:
 225                         - key
 226                         type: object
 227                     type: object
 228                   peerIP:
 229                     description: The IP address of the peer followed by an optional port
 230                       number to peer with. If port number is given, format should be `[<IPv6>]:port`
 231                       or `<IPv4>:<port>` for IPv4. If optional port number is not set,
 232                       and this peer IP and ASNumber belongs to a calico/node with ListenPort
 233                       set in BGPConfiguration, then we use that port to peer.
 234                     type: string
 235                   peerSelector:
 236                     description: Selector for the remote nodes to peer with.  When this
 237                       is set, the PeerIP and ASNumber fields must be empty.  For each
 238                       peering between the local node and selected remote nodes, we configure
 239                       an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified,
 240                       and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified.  The
 241                       remote AS number comes from the remote node's NodeBGPSpec.ASNumber,
 242                       or the global default if that is not set.
 243                     type: string
 244                   sourceAddress:
 245                     description: Specifies whether and how to configure a source address
 246                       for the peerings generated by this BGPPeer resource.  Default value
 247                       "UseNodeIP" means to configure the node IP as the source address.  "None"
 248                       means not to configure a source address.
 249                     type: string
 250                 type: object
 251             type: object
 252         served: true
 253         storage: true
 254     status:
 255       acceptedNames:
 256         kind: ""
 257         plural: ""
 258       conditions: []
 259       storedVersions: []
 260     ---
 261     apiVersion: apiextensions.k8s.io/v1
 262     kind: CustomResourceDefinition
 263     metadata:
 264       name: blockaffinities.crd.projectcalico.org
 265     spec:
 266       group: crd.projectcalico.org
 267       names:
 268         kind: BlockAffinity
 269         listKind: BlockAffinityList
 270         plural: blockaffinities
 271         singular: blockaffinity
 272       scope: Cluster
 273       versions:
 274       - name: v1
 275         schema:
 276           openAPIV3Schema:
 277             properties:
 278               apiVersion:
 279                 description: 'APIVersion defines the versioned schema of this representation
 280                   of an object. Servers should convert recognized schemas to the latest
 281                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 282                 type: string
 283               kind:
 284                 description: 'Kind is a string value representing the REST resource this
 285                   object represents. Servers may infer this from the endpoint the client
 286                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 287                 type: string
 288               metadata:
 289                 type: object
 290               spec:
 291                 description: BlockAffinitySpec contains the specification for a BlockAffinity
 292                   resource.
 293                 properties:
 294                   cidr:
 295                     type: string
 296                   deleted:
 297                     description: Deleted indicates that this block affinity is being deleted.
 298                       This field is a string for compatibility with older releases that
 299                       mistakenly treat this field as a string.
 300                     type: string
 301                   node:
 302                     type: string
 303                   state:
 304                     type: string
 305                 required:
 306                 - cidr
 307                 - deleted
 308                 - node
 309                 - state
 310                 type: object
 311             type: object
 312         served: true
 313         storage: true
 314     status:
 315       acceptedNames:
 316         kind: ""
 317         plural: ""
 318       conditions: []
 319       storedVersions: []
 320     ---
 321     apiVersion: apiextensions.k8s.io/v1
 322     kind: CustomResourceDefinition
 323     metadata:
 324       annotations:
 325         controller-gen.kubebuilder.io/version: (devel)
 326       creationTimestamp: null
 327       name: caliconodestatuses.crd.projectcalico.org
 328     spec:
 329       group: crd.projectcalico.org
 330       names:
 331         kind: CalicoNodeStatus
 332         listKind: CalicoNodeStatusList
 333         plural: caliconodestatuses
 334         singular: caliconodestatus
 335       scope: Cluster
 336       versions:
 337       - name: v1
 338         schema:
 339           openAPIV3Schema:
 340             properties:
 341               apiVersion:
 342                 description: 'APIVersion defines the versioned schema of this representation
 343                   of an object. Servers should convert recognized schemas to the latest
 344                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 345                 type: string
 346               kind:
 347                 description: 'Kind is a string value representing the REST resource this
 348                   object represents. Servers may infer this from the endpoint the client
 349                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 350                 type: string
 351               metadata:
 352                 type: object
 353               spec:
 354                 description: CalicoNodeStatusSpec contains the specification for a CalicoNodeStatus
 355                   resource.
 356                 properties:
 357                   classes:
 358                     description: Classes declares the types of information to monitor
 359                       for this calico/node, and allows for selective status reporting
 360                       about certain subsets of information.
 361                     items:
 362                       type: string
 363                     type: array
 364                   node:
 365                     description: The node name identifies the Calico node instance for
 366                       node status.
 367                     type: string
 368                   updatePeriodSeconds:
 369                     description: UpdatePeriodSeconds is the period at which CalicoNodeStatus
 370                       should be updated. Set to 0 to disable CalicoNodeStatus refresh.
 371                       Maximum update period is one day.
 372                     format: int32
 373                     type: integer
 374                 type: object
 375               status:
 376                 description: CalicoNodeStatusStatus defines the observed state of CalicoNodeStatus.
 377                   No validation needed for status since it is updated by Calico.
 378                 properties:
 379                   agent:
 380                     description: Agent holds agent status on the node.
 381                     properties:
 382                       birdV4:
 383                         description: BIRDV4 represents the latest observed status of bird4.
 384                         properties:
 385                           lastBootTime:
 386                             description: LastBootTime holds the value of lastBootTime
 387                               from bird.ctl output.
 388                             type: string
 389                           lastReconfigurationTime:
 390                             description: LastReconfigurationTime holds the value of lastReconfigTime
 391                               from bird.ctl output.
 392                             type: string
 393                           routerID:
 394                             description: Router ID used by bird.
 395                             type: string
 396                           state:
 397                             description: The state of the BGP Daemon.
 398                             type: string
 399                           version:
 400                             description: Version of the BGP daemon
 401                             type: string
 402                         type: object
 403                       birdV6:
 404                         description: BIRDV6 represents the latest observed status of bird6.
 405                         properties:
 406                           lastBootTime:
 407                             description: LastBootTime holds the value of lastBootTime
 408                               from bird.ctl output.
 409                             type: string
 410                           lastReconfigurationTime:
 411                             description: LastReconfigurationTime holds the value of lastReconfigTime
 412                               from bird.ctl output.
 413                             type: string
 414                           routerID:
 415                             description: Router ID used by bird.
 416                             type: string
 417                           state:
 418                             description: The state of the BGP Daemon.
 419                             type: string
 420                           version:
 421                             description: Version of the BGP daemon
 422                             type: string
 423                         type: object
 424                     type: object
 425                   bgp:
 426                     description: BGP holds node BGP status.
 427                     properties:
 428                       numberEstablishedV4:
 429                         description: The total number of IPv4 established bgp sessions.
 430                         type: integer
 431                       numberEstablishedV6:
 432                         description: The total number of IPv6 established bgp sessions.
 433                         type: integer
 434                       numberNotEstablishedV4:
 435                         description: The total number of IPv4 non-established bgp sessions.
 436                         type: integer
 437                       numberNotEstablishedV6:
 438                         description: The total number of IPv6 non-established bgp sessions.
 439                         type: integer
 440                       peersV4:
 441                         description: PeersV4 represents IPv4 BGP peers status on the node.
 442                         items:
 443                           description: CalicoNodePeer contains the status of BGP peers
 444                             on the node.
 445                           properties:
 446                             peerIP:
 447                               description: IP address of the peer whose condition we are
 448                                 reporting.
 449                               type: string
 450                             since:
 451                               description: Since the state or reason last changed.
 452                               type: string
 453                             state:
 454                               description: State is the BGP session state.
 455                               type: string
 456                             type:
 457                               description: Type indicates whether this peer is configured
 458                                 via the node-to-node mesh, or via en explicit global or
 459                                 per-node BGPPeer object.
 460                               type: string
 461                           type: object
 462                         type: array
 463                       peersV6:
 464                         description: PeersV6 represents IPv6 BGP peers status on the node.
 465                         items:
 466                           description: CalicoNodePeer contains the status of BGP peers
 467                             on the node.
 468                           properties:
 469                             peerIP:
 470                               description: IP address of the peer whose condition we are
 471                                 reporting.
 472                               type: string
 473                             since:
 474                               description: Since the state or reason last changed.
 475                               type: string
 476                             state:
 477                               description: State is the BGP session state.
 478                               type: string
 479                             type:
 480                               description: Type indicates whether this peer is configured
 481                                 via the node-to-node mesh, or via en explicit global or
 482                                 per-node BGPPeer object.
 483                               type: string
 484                           type: object
 485                         type: array
 486                     required:
 487                     - numberEstablishedV4
 488                     - numberEstablishedV6
 489                     - numberNotEstablishedV4
 490                     - numberNotEstablishedV6
 491                     type: object
 492                   lastUpdated:
 493                     description: LastUpdated is a timestamp representing the server time
 494                       when CalicoNodeStatus object last updated. It is represented in
 495                       RFC3339 form and is in UTC.
 496                     format: date-time
 497                     nullable: true
 498                     type: string
 499                   routes:
 500                     description: Routes reports routes known to the Calico BGP daemon
 501                       on the node.
 502                     properties:
 503                       routesV4:
 504                         description: RoutesV4 represents IPv4 routes on the node.
 505                         items:
 506                           description: CalicoNodeRoute contains the status of BGP routes
 507                             on the node.
 508                           properties:
 509                             destination:
 510                               description: Destination of the route.
 511                               type: string
 512                             gateway:
 513                               description: Gateway for the destination.
 514                               type: string
 515                             interface:
 516                               description: Interface for the destination
 517                               type: string
 518                             learnedFrom:
 519                               description: LearnedFrom contains information regarding
 520                                 where this route originated.
 521                               properties:
 522                                 peerIP:
 523                                   description: If sourceType is NodeMesh or BGPPeer, IP
 524                                     address of the router that sent us this route.
 525                                   type: string
 526                                 sourceType:
 527                                   description: Type of the source where a route is learned
 528                                     from.
 529                                   type: string
 530                               type: object
 531                             type:
 532                               description: Type indicates if the route is being used for
 533                                 forwarding or not.
 534                               type: string
 535                           type: object
 536                         type: array
 537                       routesV6:
 538                         description: RoutesV6 represents IPv6 routes on the node.
 539                         items:
 540                           description: CalicoNodeRoute contains the status of BGP routes
 541                             on the node.
 542                           properties:
 543                             destination:
 544                               description: Destination of the route.
 545                               type: string
 546                             gateway:
 547                               description: Gateway for the destination.
 548                               type: string
 549                             interface:
 550                               description: Interface for the destination
 551                               type: string
 552                             learnedFrom:
 553                               description: LearnedFrom contains information regarding
 554                                 where this route originated.
 555                               properties:
 556                                 peerIP:
 557                                   description: If sourceType is NodeMesh or BGPPeer, IP
 558                                     address of the router that sent us this route.
 559                                   type: string
 560                                 sourceType:
 561                                   description: Type of the source where a route is learned
 562                                     from.
 563                                   type: string
 564                               type: object
 565                             type:
 566                               description: Type indicates if the route is being used for
 567                                 forwarding or not.
 568                               type: string
 569                           type: object
 570                         type: array
 571                     type: object
 572                 type: object
 573             type: object
 574         served: true
 575         storage: true
 576     status:
 577       acceptedNames:
 578         kind: ""
 579         plural: ""
 580       conditions: []
 581       storedVersions: []
 582     ---
 583     apiVersion: apiextensions.k8s.io/v1
 584     kind: CustomResourceDefinition
 585     metadata:
 586       name: clusterinformations.crd.projectcalico.org
 587     spec:
 588       group: crd.projectcalico.org
 589       names:
 590         kind: ClusterInformation
 591         listKind: ClusterInformationList
 592         plural: clusterinformations
 593         singular: clusterinformation
 594       scope: Cluster
 595       versions:
 596       - name: v1
 597         schema:
 598           openAPIV3Schema:
 599             description: ClusterInformation contains the cluster specific information.
 600             properties:
 601               apiVersion:
 602                 description: 'APIVersion defines the versioned schema of this representation
 603                   of an object. Servers should convert recognized schemas to the latest
 604                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 605                 type: string
 606               kind:
 607                 description: 'Kind is a string value representing the REST resource this
 608                   object represents. Servers may infer this from the endpoint the client
 609                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 610                 type: string
 611               metadata:
 612                 type: object
 613               spec:
 614                 description: ClusterInformationSpec contains the values of describing
 615                   the cluster.
 616                 properties:
 617                   calicoVersion:
 618                     description: CalicoVersion is the version of Calico that the cluster
 619                       is running
 620                     type: string
 621                   clusterGUID:
 622                     description: ClusterGUID is the GUID of the cluster
 623                     type: string
 624                   clusterType:
 625                     description: ClusterType describes the type of the cluster
 626                     type: string
 627                   datastoreReady:
 628                     description: DatastoreReady is used during significant datastore migrations
 629                       to signal to components such as Felix that it should wait before
 630                       accessing the datastore.
 631                     type: boolean
 632                   variant:
 633                     description: Variant declares which variant of Calico should be active.
 634                     type: string
 635                 type: object
 636             type: object
 637         served: true
 638         storage: true
 639     status:
 640       acceptedNames:
 641         kind: ""
 642         plural: ""
 643       conditions: []
 644       storedVersions: []
 645     ---
 646     apiVersion: apiextensions.k8s.io/v1
 647     kind: CustomResourceDefinition
 648     metadata:
 649       name: felixconfigurations.crd.projectcalico.org
 650     spec:
 651       group: crd.projectcalico.org
 652       names:
 653         kind: FelixConfiguration
 654         listKind: FelixConfigurationList
 655         plural: felixconfigurations
 656         singular: felixconfiguration
 657       scope: Cluster
 658       versions:
 659       - name: v1
 660         schema:
 661           openAPIV3Schema:
 662             description: Felix Configuration contains the configuration for Felix.
 663             properties:
 664               apiVersion:
 665                 description: 'APIVersion defines the versioned schema of this representation
 666                   of an object. Servers should convert recognized schemas to the latest
 667                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 668                 type: string
 669               kind:
 670                 description: 'Kind is a string value representing the REST resource this
 671                   object represents. Servers may infer this from the endpoint the client
 672                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 673                 type: string
 674               metadata:
 675                 type: object
 676               spec:
 677                 description: FelixConfigurationSpec contains the values of the Felix configuration.
 678                 properties:
 679                   allowIPIPPacketsFromWorkloads:
 680                     description: 'AllowIPIPPacketsFromWorkloads controls whether Felix
 681                       will add a rule to drop IPIP encapsulated traffic from workloads
 682                       [Default: false]'
 683                     type: boolean
 684                   allowVXLANPacketsFromWorkloads:
 685                     description: 'AllowVXLANPacketsFromWorkloads controls whether Felix
 686                       will add a rule to drop VXLAN encapsulated traffic from workloads
 687                       [Default: false]'
 688                     type: boolean
 689                   awsSrcDstCheck:
 690                     description: 'Set source-destination-check on AWS EC2 instances. Accepted
 691                       value must be one of "DoNothing", "Enable" or "Disable". [Default:
 692                       DoNothing]'
 693                     enum:
 694                     - DoNothing
 695                     - Enable
 696                     - Disable
 697                     type: string
 698                   bpfConnectTimeLoadBalancingEnabled:
 699                     description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode,
 700                       controls whether Felix installs the connection-time load balancer.  The
 701                       connect-time load balancer is required for the host to be able to
 702                       reach Kubernetes services and it improves the performance of pod-to-service
 703                       connections.  The only reason to disable it is for debugging purposes.  [Default:
 704                       true]'
 705                     type: boolean
 706                   bpfDataIfacePattern:
 707                     description: BPFDataIfacePattern is a regular expression that controls
 708                       which interfaces Felix should attach BPF programs to in order to
 709                       catch traffic to/from the network.  This needs to match the interfaces
 710                       that Calico workload traffic flows over as well as any interfaces
 711                       that handle incoming traffic to nodeports and services from outside
 712                       the cluster.  It should not match the workload interfaces (usually
 713                       named cali...).
 714                     type: string
 715                   bpfDisableUnprivileged:
 716                     description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled
 717                       sysctl to disable unprivileged use of BPF.  This ensures that unprivileged
 718                       users cannot access Calico''s BPF maps and cannot insert their own
 719                       BPF programs to interfere with Calico''s. [Default: true]'
 720                     type: boolean
 721                   bpfEnabled:
 722                     description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
 723                       [Default: false]'
 724                     type: boolean
 725                   bpfExtToServiceConnmark:
 726                     description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit
 727                       mark that is set on connections from an external client to a local
 728                       service. This mark allows us to control how packets of that connection
 729                       are routed within the host and how is routing intepreted by RPF
 730                       check. [Default: 0]'
 731                     type: integer
 732                   bpfExternalServiceMode:
 733                     description: 'BPFExternalServiceMode in BPF mode, controls how connections
 734                       from outside the cluster to services (node ports and cluster IPs)
 735                       are forwarded to remote workloads.  If set to "Tunnel" then both
 736                       request and response traffic is tunneled to the remote node.  If
 737                       set to "DSR", the request traffic is tunneled but the response traffic
 738                       is sent directly from the remote node.  In "DSR" mode, the remote
 739                       node appears to use the IP of the ingress node; this requires a
 740                       permissive L2 network.  [Default: Tunnel]'
 741                     type: string
 742                   bpfKubeProxyEndpointSlicesEnabled:
 743                     description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
 744                       whether Felix's embedded kube-proxy accepts EndpointSlices or not.
 745                     type: boolean
 746                   bpfKubeProxyIptablesCleanupEnabled:
 747                     description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF
 748                       mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s
 749                       iptables chains.  Should only be enabled if kube-proxy is not running.  [Default:
 750                       true]'
 751                     type: boolean
 752                   bpfKubeProxyMinSyncPeriod:
 753                     description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the
 754                       minimum time between updates to the dataplane for Felix''s embedded
 755                       kube-proxy.  Lower values give reduced set-up latency.  Higher values
 756                       reduce Felix CPU usage by batching up more work.  [Default: 1s]'
 757                     type: string
 758                   bpfLogLevel:
 759                     description: 'BPFLogLevel controls the log level of the BPF programs
 760                       when in BPF dataplane mode.  One of "Off", "Info", or "Debug".  The
 761                       logs are emitted to the BPF trace pipe, accessible with the command
 762                       `tc exec bpf debug`. [Default: Off].'
 763                     type: string
 764                   chainInsertMode:
 765                     description: 'ChainInsertMode controls whether Felix hooks the kernel''s
 766                       top-level iptables chains by inserting a rule at the top of the
 767                       chain or by appending a rule at the bottom. insert is the safe default
 768                       since it prevents Calico''s rules from being bypassed. If you switch
 769                       to append mode, be sure that the other rules in the chains signal
 770                       acceptance by falling through to the Calico rules, otherwise the
 771                       Calico policy will be bypassed. [Default: insert]'
 772                     type: string
 773                   dataplaneDriver:
 774                     type: string
 775                   debugDisableLogDropping:
 776                     type: boolean
 777                   debugMemoryProfilePath:
 778                     type: string
 779                   debugSimulateCalcGraphHangAfter:
 780                     type: string
 781                   debugSimulateDataplaneHangAfter:
 782                     type: string
 783                   defaultEndpointToHostAction:
 784                     description: 'DefaultEndpointToHostAction controls what happens to
 785                       traffic that goes from a workload endpoint to the host itself (after
 786                       the traffic hits the endpoint egress policy). By default Calico
 787                       blocks traffic from workload endpoints to the host itself with an
 788                       iptables "DROP" action. If you want to allow some or all traffic
 789                       from endpoint to host, set this parameter to RETURN or ACCEPT. Use
 790                       RETURN if you have your own rules in the iptables "INPUT" chain;
 791                       Calico will insert its rules at the top of that chain, then "RETURN"
 792                       packets to the "INPUT" chain once it has completed processing workload
 793                       endpoint egress policy. Use ACCEPT to unconditionally accept packets
 794                       from workloads after processing workload endpoint egress policy.
 795                       [Default: Drop]'
 796                     type: string
 797                   deviceRouteProtocol:
 798                     description: This defines the route protocol added to programmed device
 799                       routes, by default this will be RTPROT_BOOT when left blank.
 800                     type: integer
 801                   deviceRouteSourceAddress:
 802                     description: This is the source address to use on programmed device
 803                       routes. By default the source address is left blank, leaving the
 804                       kernel to choose the source address used.
 805                     type: string
 806                   disableConntrackInvalidCheck:
 807                     type: boolean
 808                   endpointReportingDelay:
 809                     type: string
 810                   endpointReportingEnabled:
 811                     type: boolean
 812                   externalNodesList:
 813                     description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes
 814                       which may source tunnel traffic and have the tunneled traffic be
 815                       accepted at calico nodes.
 816                     items:
 817                       type: string
 818                     type: array
 819                   failsafeInboundHostPorts:
 820                     description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports
 821                       and CIDRs that Felix will allow incoming traffic to host endpoints
 822                       on irrespective of the security policy. This is useful to avoid
 823                       accidentally cutting off a host with incorrect configuration. For
 824                       back-compatibility, if the protocol is not specified, it defaults
 825                       to "tcp". If a CIDR is not specified, it will allow traffic from
 826                       all addresses. To disable all inbound host ports, use the value
 827                       none. The default value allows ssh access and DHCP. [Default: tcp:22,
 828                       udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
 829                     items:
 830                       description: ProtoPort is combination of protocol, port, and CIDR.
 831                         Protocol and port must be specified.
 832                       properties:
 833                         net:
 834                           type: string
 835                         port:
 836                           type: integer
 837                         protocol:
 838                           type: string
 839                       required:
 840                       - port
 841                       - protocol
 842                       type: object
 843                     type: array
 844                   failsafeOutboundHostPorts:
 845                     description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports
 846                       and CIDRs that Felix will allow outgoing traffic from host endpoints
 847                       to irrespective of the security policy. This is useful to avoid
 848                       accidentally cutting off a host with incorrect configuration. For
 849                       back-compatibility, if the protocol is not specified, it defaults
 850                       to "tcp". If a CIDR is not specified, it will allow traffic from
 851                       all addresses. To disable all outbound host ports, use the value
 852                       none. The default value opens etcd''s standard ports to ensure that
 853                       Felix does not get cut off from etcd as well as allowing DHCP and
 854                       DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666,
 855                       tcp:6667, udp:53, udp:67]'
 856                     items:
 857                       description: ProtoPort is combination of protocol, port, and CIDR.
 858                         Protocol and port must be specified.
 859                       properties:
 860                         net:
 861                           type: string
 862                         port:
 863                           type: integer
 864                         protocol:
 865                           type: string
 866                       required:
 867                       - port
 868                       - protocol
 869                       type: object
 870                     type: array
 871                   featureDetectOverride:
 872                     description: FeatureDetectOverride is used to override the feature
 873                       detection. Values are specified in a comma separated list with no
 874                       spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=".
 875                       "true" or "false" will force the feature, empty or omitted values
 876                       are auto-detected.
 877                     type: string
 878                   genericXDPEnabled:
 879                     description: 'GenericXDPEnabled enables Generic XDP so network cards
 880                       that don''t support XDP offload or driver modes can use XDP. This
 881                       is not recommended since it doesn''t provide better performance
 882                       than iptables. [Default: false]'
 883                     type: boolean
 884                   healthEnabled:
 885                     type: boolean
 886                   healthHost:
 887                     type: string
 888                   healthPort:
 889                     type: integer
 890                   interfaceExclude:
 891                     description: 'InterfaceExclude is a comma-separated list of interfaces
 892                       that Felix should exclude when monitoring for host endpoints. The
 893                       default value ensures that Felix ignores Kubernetes'' IPVS dummy
 894                       interface, which is used internally by kube-proxy. If you want to
 895                       exclude multiple interface names using a single value, the list
 896                       supports regular expressions. For regular expressions you must wrap
 897                       the value with ''/''. For example having values ''/^kube/,veth1''
 898                       will exclude all interfaces that begin with ''kube'' and also the
 899                       interface ''veth1''. [Default: kube-ipvs0]'
 900                     type: string
 901                   interfacePrefix:
 902                     description: 'InterfacePrefix is the interface name prefix that identifies
 903                       workload endpoints and so distinguishes them from host endpoint
 904                       interfaces. Note: in environments other than bare metal, the orchestrators
 905                       configure this appropriately. For example our Kubernetes and Docker
 906                       integrations set the ''cali'' value, and our OpenStack integration
 907                       sets the ''tap'' value. [Default: cali]'
 908                     type: string
 909                   interfaceRefreshInterval:
 910                     description: InterfaceRefreshInterval is the period at which Felix
 911                       rescans local interfaces to verify their state. The rescan can be
 912                       disabled by setting the interval to 0.
 913                     type: string
 914                   ipipEnabled:
 915                     type: boolean
 916                   ipipMTU:
 917                     description: 'IPIPMTU is the MTU to set on the tunnel device. See
 918                       Configuring MTU [Default: 1440]'
 919                     type: integer
 920                   ipsetsRefreshInterval:
 921                     description: 'IpsetsRefreshInterval is the period at which Felix re-checks
 922                       all iptables state to ensure that no other process has accidentally
 923                       broken Calico''s rules. Set to 0 to disable iptables refresh. [Default:
 924                       90s]'
 925                     type: string
 926                   iptablesBackend:
 927                     description: IptablesBackend specifies which backend of iptables will
 928                       be used. The default is legacy.
 929                     type: string
 930                   iptablesFilterAllowAction:
 931                     type: string
 932                   iptablesLockFilePath:
 933                     description: 'IptablesLockFilePath is the location of the iptables
 934                       lock file. You may need to change this if the lock file is not in
 935                       its standard location (for example if you have mapped it into Felix''s
 936                       container at a different path). [Default: /run/xtables.lock]'
 937                     type: string
 938                   iptablesLockProbeInterval:
 939                     description: 'IptablesLockProbeInterval is the time that Felix will
 940                       wait between attempts to acquire the iptables lock if it is not
 941                       available. Lower values make Felix more responsive when the lock
 942                       is contended, but use more CPU. [Default: 50ms]'
 943                     type: string
 944                   iptablesLockTimeout:
 945                     description: 'IptablesLockTimeout is the time that Felix will wait
 946                       for the iptables lock, or 0, to disable. To use this feature, Felix
 947                       must share the iptables lock file with all other processes that
 948                       also take the lock. When running Felix inside a container, this
 949                       requires the /run directory of the host to be mounted into the calico/node
 950                       or calico/felix container. [Default: 0s disabled]'
 951                     type: string
 952                   iptablesMangleAllowAction:
 953                     type: string
 954                   iptablesMarkMask:
 955                     description: 'IptablesMarkMask is the mask that Felix selects its
 956                       IPTables Mark bits from. Should be a 32 bit hexadecimal number with
 957                       at least 8 bits set, none of which clash with any other mark bits
 958                       in use on the system. [Default: 0xff000000]'
 959                     format: int32
 960                     type: integer
 961                   iptablesNATOutgoingInterfaceFilter:
 962                     type: string
 963                   iptablesPostWriteCheckInterval:
 964                     description: 'IptablesPostWriteCheckInterval is the period after Felix
 965                       has done a write to the dataplane that it schedules an extra read
 966                       back in order to check the write was not clobbered by another process.
 967                       This should only occur if another application on the system doesn''t
 968                       respect the iptables lock. [Default: 1s]'
 969                     type: string
 970                   iptablesRefreshInterval:
 971                     description: 'IptablesRefreshInterval is the period at which Felix
 972                       re-checks the IP sets in the dataplane to ensure that no other process
 973                       has accidentally broken Calico''s rules. Set to 0 to disable IP
 974                       sets refresh. Note: the default for this value is lower than the
 975                       other refresh intervals as a workaround for a Linux kernel bug that
 976                       was fixed in kernel version 4.11. If you are using v4.11 or greater
 977                       you may want to set this to, a higher value to reduce Felix CPU
 978                       usage. [Default: 10s]'
 979                     type: string
 980                   ipv6Support:
 981                     type: boolean
 982                   kubeNodePortRanges:
 983                     description: 'KubeNodePortRanges holds list of port ranges used for
 984                       service node ports. Only used if felix detects kube-proxy running
 985                       in ipvs mode. Felix uses these ranges to separate host and workload
 986                       traffic. [Default: 30000:32767].'
 987                     items:
 988                       anyOf:
 989                       - type: integer
 990                       - type: string
 991                       pattern: ^.*
 992                       x-kubernetes-int-or-string: true
 993                     type: array
 994                   logFilePath:
 995                     description: 'LogFilePath is the full path to the Felix log. Set to
 996                       none to disable file logging. [Default: /var/log/calico/felix.log]'
 997                     type: string
 998                   logPrefix:
 999                     description: 'LogPrefix is the log prefix that Felix uses when rendering
1000                       LOG rules. [Default: calico-packet]'
1001                     type: string
1002                   logSeverityFile:
1003                     description: 'LogSeverityFile is the log severity above which logs
1004                       are sent to the log file. [Default: Info]'
1005                     type: string
1006                   logSeverityScreen:
1007                     description: 'LogSeverityScreen is the log severity above which logs
1008                       are sent to the stdout. [Default: Info]'
1009                     type: string
1010                   logSeveritySys:
1011                     description: 'LogSeveritySys is the log severity above which logs
1012                       are sent to the syslog. Set to None for no logging to syslog. [Default:
1013                       Info]'
1014                     type: string
1015                   maxIpsetSize:
1016                     type: integer
1017                   metadataAddr:
1018                     description: 'MetadataAddr is the IP address or domain name of the
1019                       server that can answer VM queries for cloud-init metadata. In OpenStack,
1020                       this corresponds to the machine running nova-api (or in Ubuntu,
1021                       nova-api-metadata). A value of none (case insensitive) means that
1022                       Felix should not set up any NAT rule for the metadata path. [Default:
1023                       127.0.0.1]'
1024                     type: string
1025                   metadataPort:
1026                     description: 'MetadataPort is the port of the metadata server. This,
1027                       combined with global.MetadataAddr (if not ''None''), is used to
1028                       set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
1029                       In most cases this should not need to be changed [Default: 8775].'
1030                     type: integer
1031                   mtuIfacePattern:
1032                     description: MTUIfacePattern is a regular expression that controls
1033                       which interfaces Felix should scan in order to calculate the host's
1034                       MTU. This should not match workload interfaces (usually named cali...).
1035                     type: string
1036                   natOutgoingAddress:
1037                     description: NATOutgoingAddress specifies an address to use when performing
1038                       source NAT for traffic in a natOutgoing pool that is leaving the
1039                       network. By default the address used is an address on the interface
1040                       the traffic is leaving on (ie it uses the iptables MASQUERADE target)
1041                     type: string
1042                   natPortRange:
1043                     anyOf:
1044                     - type: integer
1045                     - type: string
1046                     description: NATPortRange specifies the range of ports that is used
1047                       for port mapping when doing outgoing NAT. When unset the default
1048                       behavior of the network stack is used.
1049                     pattern: ^.*
1050                     x-kubernetes-int-or-string: true
1051                   netlinkTimeout:
1052                     type: string
1053                   openstackRegion:
1054                     description: 'OpenstackRegion is the name of the region that a particular
1055                       Felix belongs to. In a multi-region Calico/OpenStack deployment,
1056                       this must be configured somehow for each Felix (here in the datamodel,
1057                       or in felix.cfg or the environment on each compute node), and must
1058                       match the [calico] openstack_region value configured in neutron.conf
1059                       on each node. [Default: Empty]'
1060                     type: string
1061                   policySyncPathPrefix:
1062                     description: 'PolicySyncPathPrefix is used to by Felix to communicate
1063                       policy changes to external services, like Application layer policy.
1064                       [Default: Empty]'
1065                     type: string
1066                   prometheusGoMetricsEnabled:
1067                     description: 'PrometheusGoMetricsEnabled disables Go runtime metrics
1068                       collection, which the Prometheus client does by default, when set
1069                       to false. This reduces the number of metrics reported, reducing
1070                       Prometheus load. [Default: true]'
1071                     type: boolean
1072                   prometheusMetricsEnabled:
1073                     description: 'PrometheusMetricsEnabled enables the Prometheus metrics
1074                       server in Felix if set to true. [Default: false]'
1075                     type: boolean
1076                   prometheusMetricsHost:
1077                     description: 'PrometheusMetricsHost is the host that the Prometheus
1078                       metrics server should bind to. [Default: empty]'
1079                     type: string
1080                   prometheusMetricsPort:
1081                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
1082                       metrics server should bind to. [Default: 9091]'
1083                     type: integer
1084                   prometheusProcessMetricsEnabled:
1085                     description: 'PrometheusProcessMetricsEnabled disables process metrics
1086                       collection, which the Prometheus client does by default, when set
1087                       to false. This reduces the number of metrics reported, reducing
1088                       Prometheus load. [Default: true]'
1089                     type: boolean
1090                   prometheusWireGuardMetricsEnabled:
1091                     description: 'PrometheusWireGuardMetricsEnabled disables wireguard
1092                       metrics collection, which the Prometheus client does by default,
1093                       when set to false. This reduces the number of metrics reported,
1094                       reducing Prometheus load. [Default: true]'
1095                     type: boolean
1096                   removeExternalRoutes:
1097                     description: Whether or not to remove device routes that have not
1098                       been programmed by Felix. Disabling this will allow external applications
1099                       to also add device routes. This is enabled by default which means
1100                       we will remove externally added routes.
1101                     type: boolean
1102                   reportingInterval:
1103                     description: 'ReportingInterval is the interval at which Felix reports
1104                       its status into the datastore or 0 to disable. Must be non-zero
1105                       in OpenStack deployments. [Default: 30s]'
1106                     type: string
1107                   reportingTTL:
1108                     description: 'ReportingTTL is the time-to-live setting for process-wide
1109                       status reports. [Default: 90s]'
1110                     type: string
1111                   routeRefreshInterval:
1112                     description: 'RouteRefreshInterval is the period at which Felix re-checks
1113                       the routes in the dataplane to ensure that no other process has
1114                       accidentally broken Calico''s rules. Set to 0 to disable route refresh.
1115                       [Default: 90s]'
1116                     type: string
1117                   routeSource:
1118                     description: 'RouteSource configures where Felix gets its routing
1119                       information. - WorkloadIPs: use workload endpoints to construct
1120                       routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
1121                     type: string
1122                   routeTableRange:
1123                     description: Calico programs additional Linux route tables for various
1124                       purposes.  RouteTableRange specifies the indices of the route tables
1125                       that Calico should use.
1126                     properties:
1127                       max:
1128                         type: integer
1129                       min:
1130                         type: integer
1131                     required:
1132                     - max
1133                     - min
1134                     type: object
1135                   serviceLoopPrevention:
1136                     description: 'When service IP advertisement is enabled, prevent routing
1137                       loops to service IPs that are not in use, by dropping or rejecting
1138                       packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled",
1139                       in which case such routing loops continue to be allowed. [Default:
1140                       Drop]'
1141                     type: string
1142                   sidecarAccelerationEnabled:
1143                     description: 'SidecarAccelerationEnabled enables experimental sidecar
1144                       acceleration [Default: false]'
1145                     type: boolean
1146                   usageReportingEnabled:
1147                     description: 'UsageReportingEnabled reports anonymous Calico version
1148                       number and cluster size to projectcalico.org. Logs warnings returned
1149                       by the usage server. For example, if a significant security vulnerability
1150                       has been discovered in the version of Calico being used. [Default:
1151                       true]'
1152                     type: boolean
1153                   usageReportingInitialDelay:
1154                     description: 'UsageReportingInitialDelay controls the minimum delay
1155                       before Felix makes a report. [Default: 300s]'
1156                     type: string
1157                   usageReportingInterval:
1158                     description: 'UsageReportingInterval controls the interval at which
1159                       Felix makes reports. [Default: 86400s]'
1160                     type: string
1161                   useInternalDataplaneDriver:
1162                     type: boolean
1163                   vxlanEnabled:
1164                     type: boolean
1165                   vxlanMTU:
1166                     description: 'VXLANMTU is the MTU to set on the tunnel device. See
1167                       Configuring MTU [Default: 1440]'
1168                     type: integer
1169                   vxlanPort:
1170                     type: integer
1171                   vxlanVNI:
1172                     type: integer
1173                   wireguardEnabled:
1174                     description: 'WireguardEnabled controls whether Wireguard is enabled.
1175                       [Default: false]'
1176                     type: boolean
1177                   wireguardHostEncryptionEnabled:
1178                     description: 'WireguardHostEncryptionEnabled controls whether Wireguard
1179                       host-to-host encryption is enabled. [Default: false]'
1180                     type: boolean
1181                   wireguardInterfaceName:
1182                     description: 'WireguardInterfaceName specifies the name to use for
1183                       the Wireguard interface. [Default: wg.calico]'
1184                     type: string
1185                   wireguardListeningPort:
1186                     description: 'WireguardListeningPort controls the listening port used
1187                       by Wireguard. [Default: 51820]'
1188                     type: integer
1189                   wireguardMTU:
1190                     description: 'WireguardMTU controls the MTU on the Wireguard interface.
1191                       See Configuring MTU [Default: 1420]'
1192                     type: integer
1193                   wireguardRoutingRulePriority:
1194                     description: 'WireguardRoutingRulePriority controls the priority value
1195                       to use for the Wireguard routing rule. [Default: 99]'
1196                     type: integer
1197                   xdpEnabled:
1198                     description: 'XDPEnabled enables XDP acceleration for suitable untracked
1199                       incoming deny rules. [Default: true]'
1200                     type: boolean
1201                   xdpRefreshInterval:
1202                     description: 'XDPRefreshInterval is the period at which Felix re-checks
1203                       all XDP state to ensure that no other process has accidentally broken
1204                       Calico''s BPF maps or attached programs. Set to 0 to disable XDP
1205                       refresh. [Default: 90s]'
1206                     type: string
1207                 type: object
1208             type: object
1209         served: true
1210         storage: true
1211     status:
1212       acceptedNames:
1213         kind: ""
1214         plural: ""
1215       conditions: []
1216       storedVersions: []
1217     ---
1218     apiVersion: apiextensions.k8s.io/v1
1219     kind: CustomResourceDefinition
1220     metadata:
1221       name: globalnetworkpolicies.crd.projectcalico.org
1222     spec:
1223       group: crd.projectcalico.org
1224       names:
1225         kind: GlobalNetworkPolicy
1226         listKind: GlobalNetworkPolicyList
1227         plural: globalnetworkpolicies
1228         singular: globalnetworkpolicy
1229       scope: Cluster
1230       versions:
1231       - name: v1
1232         schema:
1233           openAPIV3Schema:
1234             properties:
1235               apiVersion:
1236                 description: 'APIVersion defines the versioned schema of this representation
1237                   of an object. Servers should convert recognized schemas to the latest
1238                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
1239                 type: string
1240               kind:
1241                 description: 'Kind is a string value representing the REST resource this
1242                   object represents. Servers may infer this from the endpoint the client
1243                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
1244                 type: string
1245               metadata:
1246                 type: object
1247               spec:
1248                 properties:
1249                   applyOnForward:
1250                     description: ApplyOnForward indicates to apply the rules in this policy
1251                       on forward traffic.
1252                     type: boolean
1253                   doNotTrack:
1254                     description: DoNotTrack indicates whether packets matched by the rules
1255                       in this policy should go through the data plane's connection tracking,
1256                       such as Linux conntrack.  If True, the rules in this policy are
1257                       applied before any data plane connection tracking, and packets allowed
1258                       by this policy are marked as not to be tracked.
1259                     type: boolean
1260                   egress:
1261                     description: The ordered set of egress rules.  Each rule contains
1262                       a set of packet match criteria and a corresponding action to apply.
1263                     items:
1264                       description: "A Rule encapsulates a set of match criteria and an
1265                         action.  Both selector-based security Policy and security Profiles
1266                         reference rules - separated out as a list of rules for both ingress
1267                         and egress packet matching. \n Each positive match criteria has
1268                         a negated version, prefixed with \"Not\". All the match criteria
1269                         within a rule must be satisfied for a packet to match. A single
1270                         rule can contain the positive and negative version of a match
1271                         and both must be satisfied for the rule to match."
1272                       properties:
1273                         action:
1274                           type: string
1275                         destination:
1276                           description: Destination contains the match criteria that apply
1277                             to destination entity.
1278                           properties:
1279                             namespaceSelector:
1280                               description: "NamespaceSelector is an optional field that
1281                                 contains a selector expression. Only traffic that originates
1282                                 from (or terminates at) endpoints within the selected
1283                                 namespaces will be matched. When both NamespaceSelector
1284                                 and another selector are defined on the same rule, then
1285                                 only workload endpoints that are matched by both selectors
1286                                 will be selected by the rule. \n For NetworkPolicy, an
1287                                 empty NamespaceSelector implies that the Selector is limited
1288                                 to selecting only workload endpoints in the same namespace
1289                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
1290                                 NamespaceSelector implies that the Selector is limited
1291                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
1292                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
1293                                 the Selector applies to workload endpoints across all
1294                                 namespaces."
1295                               type: string
1296                             nets:
1297                               description: Nets is an optional field that restricts the
1298                                 rule to only apply to traffic that originates from (or
1299                                 terminates at) IP addresses in any of the given subnets.
1300                               items:
1301                                 type: string
1302                               type: array
1303                             notNets:
1304                               description: NotNets is the negated version of the Nets
1305                                 field.
1306                               items:
1307                                 type: string
1308                               type: array
1309                             notPorts:
1310                               description: NotPorts is the negated version of the Ports
1311                                 field. Since only some protocols have ports, if any ports
1312                                 are specified it requires the Protocol match in the Rule
1313                                 to be set to "TCP" or "UDP".
1314                               items:
1315                                 anyOf:
1316                                 - type: integer
1317                                 - type: string
1318                                 pattern: ^.*
1319                                 x-kubernetes-int-or-string: true
1320                               type: array
1321                             notSelector:
1322                               description: NotSelector is the negated version of the Selector
1323                                 field.  See Selector field for subtleties with negated
1324                                 selectors.
1325                               type: string
1326                             ports:
1327                               description: "Ports is an optional field that restricts
1328                                 the rule to only apply to traffic that has a source (destination)
1329                                 port that matches one of these ranges/values. This value
1330                                 is a list of integers or strings that represent ranges
1331                                 of ports. \n Since only some protocols have ports, if
1332                                 any ports are specified it requires the Protocol match
1333                                 in the Rule to be set to \"TCP\" or \"UDP\"."
1334                               items:
1335                                 anyOf:
1336                                 - type: integer
1337                                 - type: string
1338                                 pattern: ^.*
1339                                 x-kubernetes-int-or-string: true
1340                               type: array
1341                             selector:
1342                               description: "Selector is an optional field that contains
1343                                 a selector expression (see Policy for sample syntax).
1344                                 \ Only traffic that originates from (terminates at) endpoints
1345                                 matching the selector will be matched. \n Note that: in
1346                                 addition to the negated version of the Selector (see NotSelector
1347                                 below), the selector expression syntax itself supports
1348                                 negation.  The two types of negation are subtly different.
1349                                 One negates the set of matched endpoints, the other negates
1350                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
1351                                 packets that are from other Calico-controlled \tendpoints
1352                                 that do not have the label \"my_label\". \n \tNotSelector
1353                                 = \"has(my_label)\" matches packets that are not from
1354                                 Calico-controlled \tendpoints that do have the label \"my_label\".
1355                                 \n The effect is that the latter will accept packets from
1356                                 non-Calico sources whereas the former is limited to packets
1357                                 from Calico-controlled endpoints."
1358                               type: string
1359                             serviceAccounts:
1360                               description: ServiceAccounts is an optional field that restricts
1361                                 the rule to only apply to traffic that originates from
1362                                 (or terminates at) a pod running as a matching service
1363                                 account.
1364                               properties:
1365                                 names:
1366                                   description: Names is an optional field that restricts
1367                                     the rule to only apply to traffic that originates
1368                                     from (or terminates at) a pod running as a service
1369                                     account whose name is in the list.
1370                                   items:
1371                                     type: string
1372                                   type: array
1373                                 selector:
1374                                   description: Selector is an optional field that restricts
1375                                     the rule to only apply to traffic that originates
1376                                     from (or terminates at) a pod running as a service
1377                                     account that matches the given label selector. If
1378                                     both Names and Selector are specified then they are
1379                                     AND'ed.
1380                                   type: string
1381                               type: object
1382                             services:
1383                               description: "Services is an optional field that contains
1384                                 options for matching Kubernetes Services. If specified,
1385                                 only traffic that originates from or terminates at endpoints
1386                                 within the selected service(s) will be matched, and only
1387                                 to/from each endpoint's port. \n Services cannot be specified
1388                                 on the same rule as Selector, NotSelector, NamespaceSelector,
1389                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
1390                                 can only be specified with Services on ingress rules."
1391                               properties:
1392                                 name:
1393                                   description: Name specifies the name of a Kubernetes
1394                                     Service to match.
1395                                   type: string
1396                                 namespace:
1397                                   description: Namespace specifies the namespace of the
1398                                     given Service. If left empty, the rule will match
1399                                     within this policy's namespace.
1400                                   type: string
1401                               type: object
1402                           type: object
1403                         http:
1404                           description: HTTP contains match criteria that apply to HTTP
1405                             requests.
1406                           properties:
1407                             methods:
1408                               description: Methods is an optional field that restricts
1409                                 the rule to apply only to HTTP requests that use one of
1410                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
1411                                 methods are OR'd together.
1412                               items:
1413                                 type: string
1414                               type: array
1415                             paths:
1416                               description: 'Paths is an optional field that restricts
1417                                 the rule to apply to HTTP requests that use one of the
1418                                 listed HTTP Paths. Multiple paths are OR''d together.
1419                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
1420                                 ONLY specify either a `exact` or a `prefix` match. The
1421                                 validator will check for it.'
1422                               items:
1423                                 description: 'HTTPPath specifies an HTTP path to match.
1424                                   It may be either of the form: exact: <path>: which matches
1425                                   the path exactly or prefix: <path-prefix>: which matches
1426                                   the path prefix'
1427                                 properties:
1428                                   exact:
1429                                     type: string
1430                                   prefix:
1431                                     type: string
1432                                 type: object
1433                               type: array
1434                           type: object
1435                         icmp:
1436                           description: ICMP is an optional field that restricts the rule
1437                             to apply to a specific type and code of ICMP traffic.  This
1438                             should only be specified if the Protocol field is set to "ICMP"
1439                             or "ICMPv6".
1440                           properties:
1441                             code:
1442                               description: Match on a specific ICMP code.  If specified,
1443                                 the Type value must also be specified. This is a technical
1444                                 limitation imposed by the kernel's iptables firewall,
1445                                 which Calico uses to enforce the rule.
1446                               type: integer
1447                             type:
1448                               description: Match on a specific ICMP type.  For example
1449                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
1450                               type: integer
1451                           type: object
1452                         ipVersion:
1453                           description: IPVersion is an optional field that restricts the
1454                             rule to only match a specific IP version.
1455                           type: integer
1456                         metadata:
1457                           description: Metadata contains additional information for this
1458                             rule
1459                           properties:
1460                             annotations:
1461                               additionalProperties:
1462                                 type: string
1463                               description: Annotations is a set of key value pairs that
1464                                 give extra information about the rule
1465                               type: object
1466                           type: object
1467                         notICMP:
1468                           description: NotICMP is the negated version of the ICMP field.
1469                           properties:
1470                             code:
1471                               description: Match on a specific ICMP code.  If specified,
1472                                 the Type value must also be specified. This is a technical
1473                                 limitation imposed by the kernel's iptables firewall,
1474                                 which Calico uses to enforce the rule.
1475                               type: integer
1476                             type:
1477                               description: Match on a specific ICMP type.  For example
1478                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
1479                               type: integer
1480                           type: object
1481                         notProtocol:
1482                           anyOf:
1483                           - type: integer
1484                           - type: string
1485                           description: NotProtocol is the negated version of the Protocol
1486                             field.
1487                           pattern: ^.*
1488                           x-kubernetes-int-or-string: true
1489                         protocol:
1490                           anyOf:
1491                           - type: integer
1492                           - type: string
1493                           description: "Protocol is an optional field that restricts the
1494                             rule to only apply to traffic of a specific IP protocol. Required
1495                             if any of the EntityRules contain Ports (because ports only
1496                             apply to certain protocols). \n Must be one of these string
1497                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
1498                             \"UDPLite\" or an integer in the range 1-255."
1499                           pattern: ^.*
1500                           x-kubernetes-int-or-string: true
1501                         source:
1502                           description: Source contains the match criteria that apply to
1503                             source entity.
1504                           properties:
1505                             namespaceSelector:
1506                               description: "NamespaceSelector is an optional field that
1507                                 contains a selector expression. Only traffic that originates
1508                                 from (or terminates at) endpoints within the selected
1509                                 namespaces will be matched. When both NamespaceSelector
1510                                 and another selector are defined on the same rule, then
1511                                 only workload endpoints that are matched by both selectors
1512                                 will be selected by the rule. \n For NetworkPolicy, an
1513                                 empty NamespaceSelector implies that the Selector is limited
1514                                 to selecting only workload endpoints in the same namespace
1515                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
1516                                 NamespaceSelector implies that the Selector is limited
1517                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
1518                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
1519                                 the Selector applies to workload endpoints across all
1520                                 namespaces."
1521                               type: string
1522                             nets:
1523                               description: Nets is an optional field that restricts the
1524                                 rule to only apply to traffic that originates from (or
1525                                 terminates at) IP addresses in any of the given subnets.
1526                               items:
1527                                 type: string
1528                               type: array
1529                             notNets:
1530                               description: NotNets is the negated version of the Nets
1531                                 field.
1532                               items:
1533                                 type: string
1534                               type: array
1535                             notPorts:
1536                               description: NotPorts is the negated version of the Ports
1537                                 field. Since only some protocols have ports, if any ports
1538                                 are specified it requires the Protocol match in the Rule
1539                                 to be set to "TCP" or "UDP".
1540                               items:
1541                                 anyOf:
1542                                 - type: integer
1543                                 - type: string
1544                                 pattern: ^.*
1545                                 x-kubernetes-int-or-string: true
1546                               type: array
1547                             notSelector:
1548                               description: NotSelector is the negated version of the Selector
1549                                 field.  See Selector field for subtleties with negated
1550                                 selectors.
1551                               type: string
1552                             ports:
1553                               description: "Ports is an optional field that restricts
1554                                 the rule to only apply to traffic that has a source (destination)
1555                                 port that matches one of these ranges/values. This value
1556                                 is a list of integers or strings that represent ranges
1557                                 of ports. \n Since only some protocols have ports, if
1558                                 any ports are specified it requires the Protocol match
1559                                 in the Rule to be set to \"TCP\" or \"UDP\"."
1560                               items:
1561                                 anyOf:
1562                                 - type: integer
1563                                 - type: string
1564                                 pattern: ^.*
1565                                 x-kubernetes-int-or-string: true
1566                               type: array
1567                             selector:
1568                               description: "Selector is an optional field that contains
1569                                 a selector expression (see Policy for sample syntax).
1570                                 \ Only traffic that originates from (terminates at) endpoints
1571                                 matching the selector will be matched. \n Note that: in
1572                                 addition to the negated version of the Selector (see NotSelector
1573                                 below), the selector expression syntax itself supports
1574                                 negation.  The two types of negation are subtly different.
1575                                 One negates the set of matched endpoints, the other negates
1576                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
1577                                 packets that are from other Calico-controlled \tendpoints
1578                                 that do not have the label \"my_label\". \n \tNotSelector
1579                                 = \"has(my_label)\" matches packets that are not from
1580                                 Calico-controlled \tendpoints that do have the label \"my_label\".
1581                                 \n The effect is that the latter will accept packets from
1582                                 non-Calico sources whereas the former is limited to packets
1583                                 from Calico-controlled endpoints."
1584                               type: string
1585                             serviceAccounts:
1586                               description: ServiceAccounts is an optional field that restricts
1587                                 the rule to only apply to traffic that originates from
1588                                 (or terminates at) a pod running as a matching service
1589                                 account.
1590                               properties:
1591                                 names:
1592                                   description: Names is an optional field that restricts
1593                                     the rule to only apply to traffic that originates
1594                                     from (or terminates at) a pod running as a service
1595                                     account whose name is in the list.
1596                                   items:
1597                                     type: string
1598                                   type: array
1599                                 selector:
1600                                   description: Selector is an optional field that restricts
1601                                     the rule to only apply to traffic that originates
1602                                     from (or terminates at) a pod running as a service
1603                                     account that matches the given label selector. If
1604                                     both Names and Selector are specified then they are
1605                                     AND'ed.
1606                                   type: string
1607                               type: object
1608                             services:
1609                               description: "Services is an optional field that contains
1610                                 options for matching Kubernetes Services. If specified,
1611                                 only traffic that originates from or terminates at endpoints
1612                                 within the selected service(s) will be matched, and only
1613                                 to/from each endpoint's port. \n Services cannot be specified
1614                                 on the same rule as Selector, NotSelector, NamespaceSelector,
1615                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
1616                                 can only be specified with Services on ingress rules."
1617                               properties:
1618                                 name:
1619                                   description: Name specifies the name of a Kubernetes
1620                                     Service to match.
1621                                   type: string
1622                                 namespace:
1623                                   description: Namespace specifies the namespace of the
1624                                     given Service. If left empty, the rule will match
1625                                     within this policy's namespace.
1626                                   type: string
1627                               type: object
1628                           type: object
1629                       required:
1630                       - action
1631                       type: object
1632                     type: array
1633                   ingress:
1634                     description: The ordered set of ingress rules.  Each rule contains
1635                       a set of packet match criteria and a corresponding action to apply.
1636                     items:
1637                       description: "A Rule encapsulates a set of match criteria and an
1638                         action.  Both selector-based security Policy and security Profiles
1639                         reference rules - separated out as a list of rules for both ingress
1640                         and egress packet matching. \n Each positive match criteria has
1641                         a negated version, prefixed with \"Not\". All the match criteria
1642                         within a rule must be satisfied for a packet to match. A single
1643                         rule can contain the positive and negative version of a match
1644                         and both must be satisfied for the rule to match."
1645                       properties:
1646                         action:
1647                           type: string
1648                         destination:
1649                           description: Destination contains the match criteria that apply
1650                             to destination entity.
1651                           properties:
1652                             namespaceSelector:
1653                               description: "NamespaceSelector is an optional field that
1654                                 contains a selector expression. Only traffic that originates
1655                                 from (or terminates at) endpoints within the selected
1656                                 namespaces will be matched. When both NamespaceSelector
1657                                 and another selector are defined on the same rule, then
1658                                 only workload endpoints that are matched by both selectors
1659                                 will be selected by the rule. \n For NetworkPolicy, an
1660                                 empty NamespaceSelector implies that the Selector is limited
1661                                 to selecting only workload endpoints in the same namespace
1662                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
1663                                 NamespaceSelector implies that the Selector is limited
1664                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
1665                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
1666                                 the Selector applies to workload endpoints across all
1667                                 namespaces."
1668                               type: string
1669                             nets:
1670                               description: Nets is an optional field that restricts the
1671                                 rule to only apply to traffic that originates from (or
1672                                 terminates at) IP addresses in any of the given subnets.
1673                               items:
1674                                 type: string
1675                               type: array
1676                             notNets:
1677                               description: NotNets is the negated version of the Nets
1678                                 field.
1679                               items:
1680                                 type: string
1681                               type: array
1682                             notPorts:
1683                               description: NotPorts is the negated version of the Ports
1684                                 field. Since only some protocols have ports, if any ports
1685                                 are specified it requires the Protocol match in the Rule
1686                                 to be set to "TCP" or "UDP".
1687                               items:
1688                                 anyOf:
1689                                 - type: integer
1690                                 - type: string
1691                                 pattern: ^.*
1692                                 x-kubernetes-int-or-string: true
1693                               type: array
1694                             notSelector:
1695                               description: NotSelector is the negated version of the Selector
1696                                 field.  See Selector field for subtleties with negated
1697                                 selectors.
1698                               type: string
1699                             ports:
1700                               description: "Ports is an optional field that restricts
1701                                 the rule to only apply to traffic that has a source (destination)
1702                                 port that matches one of these ranges/values. This value
1703                                 is a list of integers or strings that represent ranges
1704                                 of ports. \n Since only some protocols have ports, if
1705                                 any ports are specified it requires the Protocol match
1706                                 in the Rule to be set to \"TCP\" or \"UDP\"."
1707                               items:
1708                                 anyOf:
1709                                 - type: integer
1710                                 - type: string
1711                                 pattern: ^.*
1712                                 x-kubernetes-int-or-string: true
1713                               type: array
1714                             selector:
1715                               description: "Selector is an optional field that contains
1716                                 a selector expression (see Policy for sample syntax).
1717                                 \ Only traffic that originates from (terminates at) endpoints
1718                                 matching the selector will be matched. \n Note that: in
1719                                 addition to the negated version of the Selector (see NotSelector
1720                                 below), the selector expression syntax itself supports
1721                                 negation.  The two types of negation are subtly different.
1722                                 One negates the set of matched endpoints, the other negates
1723                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
1724                                 packets that are from other Calico-controlled \tendpoints
1725                                 that do not have the label \"my_label\". \n \tNotSelector
1726                                 = \"has(my_label)\" matches packets that are not from
1727                                 Calico-controlled \tendpoints that do have the label \"my_label\".
1728                                 \n The effect is that the latter will accept packets from
1729                                 non-Calico sources whereas the former is limited to packets
1730                                 from Calico-controlled endpoints."
1731                               type: string
1732                             serviceAccounts:
1733                               description: ServiceAccounts is an optional field that restricts
1734                                 the rule to only apply to traffic that originates from
1735                                 (or terminates at) a pod running as a matching service
1736                                 account.
1737                               properties:
1738                                 names:
1739                                   description: Names is an optional field that restricts
1740                                     the rule to only apply to traffic that originates
1741                                     from (or terminates at) a pod running as a service
1742                                     account whose name is in the list.
1743                                   items:
1744                                     type: string
1745                                   type: array
1746                                 selector:
1747                                   description: Selector is an optional field that restricts
1748                                     the rule to only apply to traffic that originates
1749                                     from (or terminates at) a pod running as a service
1750                                     account that matches the given label selector. If
1751                                     both Names and Selector are specified then they are
1752                                     AND'ed.
1753                                   type: string
1754                               type: object
1755                             services:
1756                               description: "Services is an optional field that contains
1757                                 options for matching Kubernetes Services. If specified,
1758                                 only traffic that originates from or terminates at endpoints
1759                                 within the selected service(s) will be matched, and only
1760                                 to/from each endpoint's port. \n Services cannot be specified
1761                                 on the same rule as Selector, NotSelector, NamespaceSelector,
1762                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
1763                                 can only be specified with Services on ingress rules."
1764                               properties:
1765                                 name:
1766                                   description: Name specifies the name of a Kubernetes
1767                                     Service to match.
1768                                   type: string
1769                                 namespace:
1770                                   description: Namespace specifies the namespace of the
1771                                     given Service. If left empty, the rule will match
1772                                     within this policy's namespace.
1773                                   type: string
1774                               type: object
1775                           type: object
1776                         http:
1777                           description: HTTP contains match criteria that apply to HTTP
1778                             requests.
1779                           properties:
1780                             methods:
1781                               description: Methods is an optional field that restricts
1782                                 the rule to apply only to HTTP requests that use one of
1783                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
1784                                 methods are OR'd together.
1785                               items:
1786                                 type: string
1787                               type: array
1788                             paths:
1789                               description: 'Paths is an optional field that restricts
1790                                 the rule to apply to HTTP requests that use one of the
1791                                 listed HTTP Paths. Multiple paths are OR''d together.
1792                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
1793                                 ONLY specify either a `exact` or a `prefix` match. The
1794                                 validator will check for it.'
1795                               items:
1796                                 description: 'HTTPPath specifies an HTTP path to match.
1797                                   It may be either of the form: exact: <path>: which matches
1798                                   the path exactly or prefix: <path-prefix>: which matches
1799                                   the path prefix'
1800                                 properties:
1801                                   exact:
1802                                     type: string
1803                                   prefix:
1804                                     type: string
1805                                 type: object
1806                               type: array
1807                           type: object
1808                         icmp:
1809                           description: ICMP is an optional field that restricts the rule
1810                             to apply to a specific type and code of ICMP traffic.  This
1811                             should only be specified if the Protocol field is set to "ICMP"
1812                             or "ICMPv6".
1813                           properties:
1814                             code:
1815                               description: Match on a specific ICMP code.  If specified,
1816                                 the Type value must also be specified. This is a technical
1817                                 limitation imposed by the kernel's iptables firewall,
1818                                 which Calico uses to enforce the rule.
1819                               type: integer
1820                             type:
1821                               description: Match on a specific ICMP type.  For example
1822                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
1823                               type: integer
1824                           type: object
1825                         ipVersion:
1826                           description: IPVersion is an optional field that restricts the
1827                             rule to only match a specific IP version.
1828                           type: integer
1829                         metadata:
1830                           description: Metadata contains additional information for this
1831                             rule
1832                           properties:
1833                             annotations:
1834                               additionalProperties:
1835                                 type: string
1836                               description: Annotations is a set of key value pairs that
1837                                 give extra information about the rule
1838                               type: object
1839                           type: object
1840                         notICMP:
1841                           description: NotICMP is the negated version of the ICMP field.
1842                           properties:
1843                             code:
1844                               description: Match on a specific ICMP code.  If specified,
1845                                 the Type value must also be specified. This is a technical
1846                                 limitation imposed by the kernel's iptables firewall,
1847                                 which Calico uses to enforce the rule.
1848                               type: integer
1849                             type:
1850                               description: Match on a specific ICMP type.  For example
1851                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
1852                               type: integer
1853                           type: object
1854                         notProtocol:
1855                           anyOf:
1856                           - type: integer
1857                           - type: string
1858                           description: NotProtocol is the negated version of the Protocol
1859                             field.
1860                           pattern: ^.*
1861                           x-kubernetes-int-or-string: true
1862                         protocol:
1863                           anyOf:
1864                           - type: integer
1865                           - type: string
1866                           description: "Protocol is an optional field that restricts the
1867                             rule to only apply to traffic of a specific IP protocol. Required
1868                             if any of the EntityRules contain Ports (because ports only
1869                             apply to certain protocols). \n Must be one of these string
1870                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
1871                             \"UDPLite\" or an integer in the range 1-255."
1872                           pattern: ^.*
1873                           x-kubernetes-int-or-string: true
1874                         source:
1875                           description: Source contains the match criteria that apply to
1876                             source entity.
1877                           properties:
1878                             namespaceSelector:
1879                               description: "NamespaceSelector is an optional field that
1880                                 contains a selector expression. Only traffic that originates
1881                                 from (or terminates at) endpoints within the selected
1882                                 namespaces will be matched. When both NamespaceSelector
1883                                 and another selector are defined on the same rule, then
1884                                 only workload endpoints that are matched by both selectors
1885                                 will be selected by the rule. \n For NetworkPolicy, an
1886                                 empty NamespaceSelector implies that the Selector is limited
1887                                 to selecting only workload endpoints in the same namespace
1888                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
1889                                 NamespaceSelector implies that the Selector is limited
1890                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
1891                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
1892                                 the Selector applies to workload endpoints across all
1893                                 namespaces."
1894                               type: string
1895                             nets:
1896                               description: Nets is an optional field that restricts the
1897                                 rule to only apply to traffic that originates from (or
1898                                 terminates at) IP addresses in any of the given subnets.
1899                               items:
1900                                 type: string
1901                               type: array
1902                             notNets:
1903                               description: NotNets is the negated version of the Nets
1904                                 field.
1905                               items:
1906                                 type: string
1907                               type: array
1908                             notPorts:
1909                               description: NotPorts is the negated version of the Ports
1910                                 field. Since only some protocols have ports, if any ports
1911                                 are specified it requires the Protocol match in the Rule
1912                                 to be set to "TCP" or "UDP".
1913                               items:
1914                                 anyOf:
1915                                 - type: integer
1916                                 - type: string
1917                                 pattern: ^.*
1918                                 x-kubernetes-int-or-string: true
1919                               type: array
1920                             notSelector:
1921                               description: NotSelector is the negated version of the Selector
1922                                 field.  See Selector field for subtleties with negated
1923                                 selectors.
1924                               type: string
1925                             ports:
1926                               description: "Ports is an optional field that restricts
1927                                 the rule to only apply to traffic that has a source (destination)
1928                                 port that matches one of these ranges/values. This value
1929                                 is a list of integers or strings that represent ranges
1930                                 of ports. \n Since only some protocols have ports, if
1931                                 any ports are specified it requires the Protocol match
1932                                 in the Rule to be set to \"TCP\" or \"UDP\"."
1933                               items:
1934                                 anyOf:
1935                                 - type: integer
1936                                 - type: string
1937                                 pattern: ^.*
1938                                 x-kubernetes-int-or-string: true
1939                               type: array
1940                             selector:
1941                               description: "Selector is an optional field that contains
1942                                 a selector expression (see Policy for sample syntax).
1943                                 \ Only traffic that originates from (terminates at) endpoints
1944                                 matching the selector will be matched. \n Note that: in
1945                                 addition to the negated version of the Selector (see NotSelector
1946                                 below), the selector expression syntax itself supports
1947                                 negation.  The two types of negation are subtly different.
1948                                 One negates the set of matched endpoints, the other negates
1949                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
1950                                 packets that are from other Calico-controlled \tendpoints
1951                                 that do not have the label \"my_label\". \n \tNotSelector
1952                                 = \"has(my_label)\" matches packets that are not from
1953                                 Calico-controlled \tendpoints that do have the label \"my_label\".
1954                                 \n The effect is that the latter will accept packets from
1955                                 non-Calico sources whereas the former is limited to packets
1956                                 from Calico-controlled endpoints."
1957                               type: string
1958                             serviceAccounts:
1959                               description: ServiceAccounts is an optional field that restricts
1960                                 the rule to only apply to traffic that originates from
1961                                 (or terminates at) a pod running as a matching service
1962                                 account.
1963                               properties:
1964                                 names:
1965                                   description: Names is an optional field that restricts
1966                                     the rule to only apply to traffic that originates
1967                                     from (or terminates at) a pod running as a service
1968                                     account whose name is in the list.
1969                                   items:
1970                                     type: string
1971                                   type: array
1972                                 selector:
1973                                   description: Selector is an optional field that restricts
1974                                     the rule to only apply to traffic that originates
1975                                     from (or terminates at) a pod running as a service
1976                                     account that matches the given label selector. If
1977                                     both Names and Selector are specified then they are
1978                                     AND'ed.
1979                                   type: string
1980                               type: object
1981                             services:
1982                               description: "Services is an optional field that contains
1983                                 options for matching Kubernetes Services. If specified,
1984                                 only traffic that originates from or terminates at endpoints
1985                                 within the selected service(s) will be matched, and only
1986                                 to/from each endpoint's port. \n Services cannot be specified
1987                                 on the same rule as Selector, NotSelector, NamespaceSelector,
1988                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
1989                                 can only be specified with Services on ingress rules."
1990                               properties:
1991                                 name:
1992                                   description: Name specifies the name of a Kubernetes
1993                                     Service to match.
1994                                   type: string
1995                                 namespace:
1996                                   description: Namespace specifies the namespace of the
1997                                     given Service. If left empty, the rule will match
1998                                     within this policy's namespace.
1999                                   type: string
2000                               type: object
2001                           type: object
2002                       required:
2003                       - action
2004                       type: object
2005                     type: array
2006                   namespaceSelector:
2007                     description: NamespaceSelector is an optional field for an expression
2008                       used to select a pod based on namespaces.
2009                     type: string
2010                   order:
2011                     description: Order is an optional field that specifies the order in
2012                       which the policy is applied. Policies with higher "order" are applied
2013                       after those with lower order.  If the order is omitted, it may be
2014                       considered to be "infinite" - i.e. the policy will be applied last.  Policies
2015                       with identical order will be applied in alphanumerical order based
2016                       on the Policy "Name".
2017                     type: number
2018                   preDNAT:
2019                     description: PreDNAT indicates to apply the rules in this policy before
2020                       any DNAT.
2021                     type: boolean
2022                   selector:
2023                     description: "The selector is an expression used to pick pick out
2024                       the endpoints that the policy should be applied to. \n Selector
2025                       expressions follow this syntax: \n \tlabel == \"string_literal\"
2026                       \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
2027                       \  ->  not equal; also matches if label is not present \tlabel in
2028                       { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
2029                       one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
2030                       ... }  ->  true if the value of label X is not one of \"a\", \"b\",
2031                       \"c\" \thas(label_name)  -> True if that label is present \t! expr
2032                       -> negation of expr \texpr && expr  -> Short-circuit and \texpr
2033                       || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
2034                       or the empty selector -> matches all endpoints. \n Label names are
2035                       allowed to contain alphanumerics, -, _ and /. String literals are
2036                       more permissive but they do not support escape characters. \n Examples
2037                       (with made-up labels): \n \ttype == \"webserver\" && deployment
2038                       == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
2039                       \"dev\" \t! has(label_name)"
2040                     type: string
2041                   serviceAccountSelector:
2042                     description: ServiceAccountSelector is an optional field for an expression
2043                       used to select a pod based on service accounts.
2044                     type: string
2045                   types:
2046                     description: "Types indicates whether this policy applies to ingress,
2047                       or to egress, or to both.  When not explicitly specified (and so
2048                       the value on creation is empty or nil), Calico defaults Types according
2049                       to what Ingress and Egress rules are present in the policy.  The
2050                       default is: \n - [ PolicyTypeIngress ], if there are no Egress rules
2051                       (including the case where there are   also no Ingress rules) \n
2052                       - [ PolicyTypeEgress ], if there are Egress rules but no Ingress
2053                       rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are
2054                       both Ingress and Egress rules. \n When the policy is read back again,
2055                       Types will always be one of these values, never empty or nil."
2056                     items:
2057                       description: PolicyType enumerates the possible values of the PolicySpec
2058                         Types field.
2059                       type: string
2060                     type: array
2061                 type: object
2062             type: object
2063         served: true
2064         storage: true
2065     status:
2066       acceptedNames:
2067         kind: ""
2068         plural: ""
2069       conditions: []
2070       storedVersions: []
2071     ---
2072     apiVersion: apiextensions.k8s.io/v1
2073     kind: CustomResourceDefinition
2074     metadata:
2075       name: globalnetworksets.crd.projectcalico.org
2076     spec:
2077       group: crd.projectcalico.org
2078       names:
2079         kind: GlobalNetworkSet
2080         listKind: GlobalNetworkSetList
2081         plural: globalnetworksets
2082         singular: globalnetworkset
2083       scope: Cluster
2084       versions:
2085       - name: v1
2086         schema:
2087           openAPIV3Schema:
2088             description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
2089               that share labels to allow rules to refer to them via selectors.  The labels
2090               of GlobalNetworkSet are not namespaced.
2091             properties:
2092               apiVersion:
2093                 description: 'APIVersion defines the versioned schema of this representation
2094                   of an object. Servers should convert recognized schemas to the latest
2095                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2096                 type: string
2097               kind:
2098                 description: 'Kind is a string value representing the REST resource this
2099                   object represents. Servers may infer this from the endpoint the client
2100                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2101                 type: string
2102               metadata:
2103                 type: object
2104               spec:
2105                 description: GlobalNetworkSetSpec contains the specification for a NetworkSet
2106                   resource.
2107                 properties:
2108                   nets:
2109                     description: The list of IP networks that belong to this set.
2110                     items:
2111                       type: string
2112                     type: array
2113                 type: object
2114             type: object
2115         served: true
2116         storage: true
2117     status:
2118       acceptedNames:
2119         kind: ""
2120         plural: ""
2121       conditions: []
2122       storedVersions: []
2123     ---
2124     apiVersion: apiextensions.k8s.io/v1
2125     kind: CustomResourceDefinition
2126     metadata:
2127       name: hostendpoints.crd.projectcalico.org
2128     spec:
2129       group: crd.projectcalico.org
2130       names:
2131         kind: HostEndpoint
2132         listKind: HostEndpointList
2133         plural: hostendpoints
2134         singular: hostendpoint
2135       scope: Cluster
2136       versions:
2137       - name: v1
2138         schema:
2139           openAPIV3Schema:
2140             properties:
2141               apiVersion:
2142                 description: 'APIVersion defines the versioned schema of this representation
2143                   of an object. Servers should convert recognized schemas to the latest
2144                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2145                 type: string
2146               kind:
2147                 description: 'Kind is a string value representing the REST resource this
2148                   object represents. Servers may infer this from the endpoint the client
2149                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2150                 type: string
2151               metadata:
2152                 type: object
2153               spec:
2154                 description: HostEndpointSpec contains the specification for a HostEndpoint
2155                   resource.
2156                 properties:
2157                   expectedIPs:
2158                     description: "The expected IP addresses (IPv4 and IPv6) of the endpoint.
2159                       If \"InterfaceName\" is not present, Calico will look for an interface
2160                       matching any of the IPs in the list and apply policy to that. Note:
2161                       \tWhen using the selector match criteria in an ingress or egress
2162                       security Policy \tor Profile, Calico converts the selector into
2163                       a set of IP addresses. For host \tendpoints, the ExpectedIPs field
2164                       is used for that purpose. (If only the interface \tname is specified,
2165                       Calico does not learn the IPs of the interface for use in match
2166                       \tcriteria.)"
2167                     items:
2168                       type: string
2169                     type: array
2170                   interfaceName:
2171                     description: "Either \"*\", or the name of a specific Linux interface
2172                       to apply policy to; or empty.  \"*\" indicates that this HostEndpoint
2173                       governs all traffic to, from or through the default network namespace
2174                       of the host named by the \"Node\" field; entering and leaving that
2175                       namespace via any interface, including those from/to non-host-networked
2176                       local workloads. \n If InterfaceName is not \"*\", this HostEndpoint
2177                       only governs traffic that enters or leaves the host through the
2178                       specific interface named by InterfaceName, or - when InterfaceName
2179                       is empty - through the specific interface that has one of the IPs
2180                       in ExpectedIPs. Therefore, when InterfaceName is empty, at least
2181                       one expected IP must be specified.  Only external interfaces (such
2182                       as \"eth0\") are supported here; it isn't possible for a HostEndpoint
2183                       to protect traffic through a specific local workload interface.
2184                       \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
2185                       initially just pre-DNAT policy.  Please check Calico documentation
2186                       for the latest position."
2187                     type: string
2188                   node:
2189                     description: The node name identifying the Calico node instance.
2190                     type: string
2191                   ports:
2192                     description: Ports contains the endpoint's named ports, which may
2193                       be referenced in security policy rules.
2194                     items:
2195                       properties:
2196                         name:
2197                           type: string
2198                         port:
2199                           type: integer
2200                         protocol:
2201                           anyOf:
2202                           - type: integer
2203                           - type: string
2204                           pattern: ^.*
2205                           x-kubernetes-int-or-string: true
2206                       required:
2207                       - name
2208                       - port
2209                       - protocol
2210                       type: object
2211                     type: array
2212                   profiles:
2213                     description: A list of identifiers of security Profile objects that
2214                       apply to this endpoint. Each profile is applied in the order that
2215                       they appear in this list.  Profile rules are applied after the selector-based
2216                       security policy.
2217                     items:
2218                       type: string
2219                     type: array
2220                 type: object
2221             type: object
2222         served: true
2223         storage: true
2224     status:
2225       acceptedNames:
2226         kind: ""
2227         plural: ""
2228       conditions: []
2229       storedVersions: []
2230     ---
2231     apiVersion: apiextensions.k8s.io/v1
2232     kind: CustomResourceDefinition
2233     metadata:
2234       name: ipamblocks.crd.projectcalico.org
2235     spec:
2236       group: crd.projectcalico.org
2237       names:
2238         kind: IPAMBlock
2239         listKind: IPAMBlockList
2240         plural: ipamblocks
2241         singular: ipamblock
2242       scope: Cluster
2243       versions:
2244       - name: v1
2245         schema:
2246           openAPIV3Schema:
2247             properties:
2248               apiVersion:
2249                 description: 'APIVersion defines the versioned schema of this representation
2250                   of an object. Servers should convert recognized schemas to the latest
2251                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2252                 type: string
2253               kind:
2254                 description: 'Kind is a string value representing the REST resource this
2255                   object represents. Servers may infer this from the endpoint the client
2256                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2257                 type: string
2258               metadata:
2259                 type: object
2260               spec:
2261                 description: IPAMBlockSpec contains the specification for an IPAMBlock
2262                   resource.
2263                 properties:
2264                   affinity:
2265                     type: string
2266                   allocations:
2267                     items:
2268                       nullable: true
2269                       type: integer
2270                     type: array
2271                   attributes:
2272                     items:
2273                       properties:
2274                         handle_id:
2275                           type: string
2276                         secondary:
2277                           additionalProperties:
2278                             type: string
2279                           type: object
2280                       type: object
2281                     type: array
2282                   cidr:
2283                     type: string
2284                   deleted:
2285                     type: boolean
2286                   strictAffinity:
2287                     type: boolean
2288                   unallocated:
2289                     items:
2290                       type: integer
2291                     type: array
2292                 required:
2293                 - allocations
2294                 - attributes
2295                 - cidr
2296                 - strictAffinity
2297                 - unallocated
2298                 type: object
2299             type: object
2300         served: true
2301         storage: true
2302     status:
2303       acceptedNames:
2304         kind: ""
2305         plural: ""
2306       conditions: []
2307       storedVersions: []
2308     ---
2309     apiVersion: apiextensions.k8s.io/v1
2310     kind: CustomResourceDefinition
2311     metadata:
2312       name: ipamconfigs.crd.projectcalico.org
2313     spec:
2314       group: crd.projectcalico.org
2315       names:
2316         kind: IPAMConfig
2317         listKind: IPAMConfigList
2318         plural: ipamconfigs
2319         singular: ipamconfig
2320       scope: Cluster
2321       versions:
2322       - name: v1
2323         schema:
2324           openAPIV3Schema:
2325             properties:
2326               apiVersion:
2327                 description: 'APIVersion defines the versioned schema of this representation
2328                   of an object. Servers should convert recognized schemas to the latest
2329                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2330                 type: string
2331               kind:
2332                 description: 'Kind is a string value representing the REST resource this
2333                   object represents. Servers may infer this from the endpoint the client
2334                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2335                 type: string
2336               metadata:
2337                 type: object
2338               spec:
2339                 description: IPAMConfigSpec contains the specification for an IPAMConfig
2340                   resource.
2341                 properties:
2342                   autoAllocateBlocks:
2343                     type: boolean
2344                   maxBlocksPerHost:
2345                     description: MaxBlocksPerHost, if non-zero, is the max number of blocks
2346                       that can be affine to each host.
2347                     type: integer
2348                   strictAffinity:
2349                     type: boolean
2350                 required:
2351                 - autoAllocateBlocks
2352                 - strictAffinity
2353                 type: object
2354             type: object
2355         served: true
2356         storage: true
2357     status:
2358       acceptedNames:
2359         kind: ""
2360         plural: ""
2361       conditions: []
2362       storedVersions: []
2363     ---
2364     apiVersion: apiextensions.k8s.io/v1
2365     kind: CustomResourceDefinition
2366     metadata:
2367       name: ipamhandles.crd.projectcalico.org
2368     spec:
2369       group: crd.projectcalico.org
2370       names:
2371         kind: IPAMHandle
2372         listKind: IPAMHandleList
2373         plural: ipamhandles
2374         singular: ipamhandle
2375       scope: Cluster
2376       versions:
2377       - name: v1
2378         schema:
2379           openAPIV3Schema:
2380             properties:
2381               apiVersion:
2382                 description: 'APIVersion defines the versioned schema of this representation
2383                   of an object. Servers should convert recognized schemas to the latest
2384                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2385                 type: string
2386               kind:
2387                 description: 'Kind is a string value representing the REST resource this
2388                   object represents. Servers may infer this from the endpoint the client
2389                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2390                 type: string
2391               metadata:
2392                 type: object
2393               spec:
2394                 description: IPAMHandleSpec contains the specification for an IPAMHandle
2395                   resource.
2396                 properties:
2397                   block:
2398                     additionalProperties:
2399                       type: integer
2400                     type: object
2401                   deleted:
2402                     type: boolean
2403                   handleID:
2404                     type: string
2405                 required:
2406                 - block
2407                 - handleID
2408                 type: object
2409             type: object
2410         served: true
2411         storage: true
2412     status:
2413       acceptedNames:
2414         kind: ""
2415         plural: ""
2416       conditions: []
2417       storedVersions: []
2418     ---
2419     apiVersion: apiextensions.k8s.io/v1
2420     kind: CustomResourceDefinition
2421     metadata:
2422       name: ippools.crd.projectcalico.org
2423     spec:
2424       group: crd.projectcalico.org
2425       names:
2426         kind: IPPool
2427         listKind: IPPoolList
2428         plural: ippools
2429         singular: ippool
2430       scope: Cluster
2431       versions:
2432       - name: v1
2433         schema:
2434           openAPIV3Schema:
2435             properties:
2436               apiVersion:
2437                 description: 'APIVersion defines the versioned schema of this representation
2438                   of an object. Servers should convert recognized schemas to the latest
2439                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2440                 type: string
2441               kind:
2442                 description: 'Kind is a string value representing the REST resource this
2443                   object represents. Servers may infer this from the endpoint the client
2444                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2445                 type: string
2446               metadata:
2447                 type: object
2448               spec:
2449                 description: IPPoolSpec contains the specification for an IPPool resource.
2450                 properties:
2451                   allowedUses:
2452                     description: AllowedUse controls what the IP pool will be used for.  If
2453                       not specified or empty, defaults to ["Tunnel", "Workload"] for back-compatibility
2454                     items:
2455                       type: string
2456                     type: array
2457                   blockSize:
2458                     description: The block size to use for IP address assignments from
2459                       this pool. Defaults to 26 for IPv4 and 112 for IPv6.
2460                     type: integer
2461                   cidr:
2462                     description: The pool CIDR.
2463                     type: string
2464                   disableBGPExport:
2465                     description: 'Disable exporting routes from this IP Pool''s CIDR over
2466                       BGP. [Default: false]'
2467                     type: boolean
2468                   disabled:
2469                     description: When disabled is true, Calico IPAM will not assign addresses
2470                       from this pool.
2471                     type: boolean
2472                   ipip:
2473                     description: 'Deprecated: this field is only used for APIv1 backwards
2474                       compatibility. Setting this field is not allowed, this field is
2475                       for internal use only.'
2476                     properties:
2477                       enabled:
2478                         description: When enabled is true, ipip tunneling will be used
2479                           to deliver packets to destinations within this pool.
2480                         type: boolean
2481                       mode:
2482                         description: The IPIP mode.  This can be one of "always" or "cross-subnet".  A
2483                           mode of "always" will also use IPIP tunneling for routing to
2484                           destination IP addresses within this pool.  A mode of "cross-subnet"
2485                           will only use IPIP tunneling when the destination node is on
2486                           a different subnet to the originating node.  The default value
2487                           (if not specified) is "always".
2488                         type: string
2489                     type: object
2490                   ipipMode:
2491                     description: Contains configuration for IPIP tunneling for this pool.
2492                       If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling
2493                       is disabled).
2494                     type: string
2495                   nat-outgoing:
2496                     description: 'Deprecated: this field is only used for APIv1 backwards
2497                       compatibility. Setting this field is not allowed, this field is
2498                       for internal use only.'
2499                     type: boolean
2500                   natOutgoing:
2501                     description: When nat-outgoing is true, packets sent from Calico networked
2502                       containers in this pool to destinations outside of this pool will
2503                       be masqueraded.
2504                     type: boolean
2505                   nodeSelector:
2506                     description: Allows IPPool to allocate for a specific node by label
2507                       selector.
2508                     type: string
2509                   vxlanMode:
2510                     description: Contains configuration for VXLAN tunneling for this pool.
2511                       If not specified, then this is defaulted to "Never" (i.e. VXLAN
2512                       tunneling is disabled).
2513                     type: string
2514                 required:
2515                 - cidr
2516                 type: object
2517             type: object
2518         served: true
2519         storage: true
2520     status:
2521       acceptedNames:
2522         kind: ""
2523         plural: ""
2524       conditions: []
2525       storedVersions: []
2526     ---
2527     apiVersion: apiextensions.k8s.io/v1
2528     kind: CustomResourceDefinition
2529     metadata:
2530       name: ipreservations.crd.projectcalico.org
2531     spec:
2532       group: crd.projectcalico.org
2533       names:
2534         kind: IPReservation
2535         listKind: IPReservationList
2536         plural: ipreservations
2537         singular: ipreservation
2538       scope: Cluster
2539       versions:
2540       - name: v1
2541         schema:
2542           openAPIV3Schema:
2543             properties:
2544               apiVersion:
2545                 description: 'APIVersion defines the versioned schema of this representation
2546                   of an object. Servers should convert recognized schemas to the latest
2547                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2548                 type: string
2549               kind:
2550                 description: 'Kind is a string value representing the REST resource this
2551                   object represents. Servers may infer this from the endpoint the client
2552                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2553                 type: string
2554               metadata:
2555                 type: object
2556               spec:
2557                 description: IPReservationSpec contains the specification for an IPReservation
2558                   resource.
2559                 properties:
2560                   reservedCIDRs:
2561                     description: ReservedCIDRs is a list of CIDRs and/or IP addresses
2562                       that Calico IPAM will exclude from new allocations.
2563                     items:
2564                       type: string
2565                     type: array
2566                 type: object
2567             type: object
2568         served: true
2569         storage: true
2570     status:
2571       acceptedNames:
2572         kind: ""
2573         plural: ""
2574       conditions: []
2575       storedVersions: []
2576     ---
2577     apiVersion: apiextensions.k8s.io/v1
2578     kind: CustomResourceDefinition
2579     metadata:
2580       name: kubecontrollersconfigurations.crd.projectcalico.org
2581     spec:
2582       group: crd.projectcalico.org
2583       names:
2584         kind: KubeControllersConfiguration
2585         listKind: KubeControllersConfigurationList
2586         plural: kubecontrollersconfigurations
2587         singular: kubecontrollersconfiguration
2588       scope: Cluster
2589       versions:
2590       - name: v1
2591         schema:
2592           openAPIV3Schema:
2593             properties:
2594               apiVersion:
2595                 description: 'APIVersion defines the versioned schema of this representation
2596                   of an object. Servers should convert recognized schemas to the latest
2597                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2598                 type: string
2599               kind:
2600                 description: 'Kind is a string value representing the REST resource this
2601                   object represents. Servers may infer this from the endpoint the client
2602                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2603                 type: string
2604               metadata:
2605                 type: object
2606               spec:
2607                 description: KubeControllersConfigurationSpec contains the values of the
2608                   Kubernetes controllers configuration.
2609                 properties:
2610                   controllers:
2611                     description: Controllers enables and configures individual Kubernetes
2612                       controllers
2613                     properties:
2614                       namespace:
2615                         description: Namespace enables and configures the namespace controller.
2616                           Enabled by default, set to nil to disable.
2617                         properties:
2618                           reconcilerPeriod:
2619                             description: 'ReconcilerPeriod is the period to perform reconciliation
2620                               with the Calico datastore. [Default: 5m]'
2621                             type: string
2622                         type: object
2623                       node:
2624                         description: Node enables and configures the node controller.
2625                           Enabled by default, set to nil to disable.
2626                         properties:
2627                           hostEndpoint:
2628                             description: HostEndpoint controls syncing nodes to host endpoints.
2629                               Disabled by default, set to nil to disable.
2630                             properties:
2631                               autoCreate:
2632                                 description: 'AutoCreate enables automatic creation of
2633                                   host endpoints for every node. [Default: Disabled]'
2634                                 type: string
2635                             type: object
2636                           leakGracePeriod:
2637                             description: 'LeakGracePeriod is the period used by the controller
2638                               to determine if an IP address has been leaked. Set to 0
2639                               to disable IP garbage collection. [Default: 15m]'
2640                             type: string
2641                           reconcilerPeriod:
2642                             description: 'ReconcilerPeriod is the period to perform reconciliation
2643                               with the Calico datastore. [Default: 5m]'
2644                             type: string
2645                           syncLabels:
2646                             description: 'SyncLabels controls whether to copy Kubernetes
2647                               node labels to Calico nodes. [Default: Enabled]'
2648                             type: string
2649                         type: object
2650                       policy:
2651                         description: Policy enables and configures the policy controller.
2652                           Enabled by default, set to nil to disable.
2653                         properties:
2654                           reconcilerPeriod:
2655                             description: 'ReconcilerPeriod is the period to perform reconciliation
2656                               with the Calico datastore. [Default: 5m]'
2657                             type: string
2658                         type: object
2659                       serviceAccount:
2660                         description: ServiceAccount enables and configures the service
2661                           account controller. Enabled by default, set to nil to disable.
2662                         properties:
2663                           reconcilerPeriod:
2664                             description: 'ReconcilerPeriod is the period to perform reconciliation
2665                               with the Calico datastore. [Default: 5m]'
2666                             type: string
2667                         type: object
2668                       workloadEndpoint:
2669                         description: WorkloadEndpoint enables and configures the workload
2670                           endpoint controller. Enabled by default, set to nil to disable.
2671                         properties:
2672                           reconcilerPeriod:
2673                             description: 'ReconcilerPeriod is the period to perform reconciliation
2674                               with the Calico datastore. [Default: 5m]'
2675                             type: string
2676                         type: object
2677                     type: object
2678                   etcdV3CompactionPeriod:
2679                     description: 'EtcdV3CompactionPeriod is the period between etcdv3
2680                       compaction requests. Set to 0 to disable. [Default: 10m]'
2681                     type: string
2682                   healthChecks:
2683                     description: 'HealthChecks enables or disables support for health
2684                       checks [Default: Enabled]'
2685                     type: string
2686                   logSeverityScreen:
2687                     description: 'LogSeverityScreen is the log severity above which logs
2688                       are sent to the stdout. [Default: Info]'
2689                     type: string
2690                   prometheusMetricsPort:
2691                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
2692                       metrics server should bind to. Set to 0 to disable. [Default: 9094]'
2693                     type: integer
2694                 required:
2695                 - controllers
2696                 type: object
2697               status:
2698                 description: KubeControllersConfigurationStatus represents the status
2699                   of the configuration. It's useful for admins to be able to see the actual
2700                   config that was applied, which can be modified by environment variables
2701                   on the kube-controllers process.
2702                 properties:
2703                   environmentVars:
2704                     additionalProperties:
2705                       type: string
2706                     description: EnvironmentVars contains the environment variables on
2707                       the kube-controllers that influenced the RunningConfig.
2708                     type: object
2709                   runningConfig:
2710                     description: RunningConfig contains the effective config that is running
2711                       in the kube-controllers pod, after merging the API resource with
2712                       any environment variables.
2713                     properties:
2714                       controllers:
2715                         description: Controllers enables and configures individual Kubernetes
2716                           controllers
2717                         properties:
2718                           namespace:
2719                             description: Namespace enables and configures the namespace
2720                               controller. Enabled by default, set to nil to disable.
2721                             properties:
2722                               reconcilerPeriod:
2723                                 description: 'ReconcilerPeriod is the period to perform
2724                                   reconciliation with the Calico datastore. [Default:
2725                                   5m]'
2726                                 type: string
2727                             type: object
2728                           node:
2729                             description: Node enables and configures the node controller.
2730                               Enabled by default, set to nil to disable.
2731                             properties:
2732                               hostEndpoint:
2733                                 description: HostEndpoint controls syncing nodes to host
2734                                   endpoints. Disabled by default, set to nil to disable.
2735                                 properties:
2736                                   autoCreate:
2737                                     description: 'AutoCreate enables automatic creation
2738                                       of host endpoints for every node. [Default: Disabled]'
2739                                     type: string
2740                                 type: object
2741                               leakGracePeriod:
2742                                 description: 'LeakGracePeriod is the period used by the
2743                                   controller to determine if an IP address has been leaked.
2744                                   Set to 0 to disable IP garbage collection. [Default:
2745                                   15m]'
2746                                 type: string
2747                               reconcilerPeriod:
2748                                 description: 'ReconcilerPeriod is the period to perform
2749                                   reconciliation with the Calico datastore. [Default:
2750                                   5m]'
2751                                 type: string
2752                               syncLabels:
2753                                 description: 'SyncLabels controls whether to copy Kubernetes
2754                                   node labels to Calico nodes. [Default: Enabled]'
2755                                 type: string
2756                             type: object
2757                           policy:
2758                             description: Policy enables and configures the policy controller.
2759                               Enabled by default, set to nil to disable.
2760                             properties:
2761                               reconcilerPeriod:
2762                                 description: 'ReconcilerPeriod is the period to perform
2763                                   reconciliation with the Calico datastore. [Default:
2764                                   5m]'
2765                                 type: string
2766                             type: object
2767                           serviceAccount:
2768                             description: ServiceAccount enables and configures the service
2769                               account controller. Enabled by default, set to nil to disable.
2770                             properties:
2771                               reconcilerPeriod:
2772                                 description: 'ReconcilerPeriod is the period to perform
2773                                   reconciliation with the Calico datastore. [Default:
2774                                   5m]'
2775                                 type: string
2776                             type: object
2777                           workloadEndpoint:
2778                             description: WorkloadEndpoint enables and configures the workload
2779                               endpoint controller. Enabled by default, set to nil to disable.
2780                             properties:
2781                               reconcilerPeriod:
2782                                 description: 'ReconcilerPeriod is the period to perform
2783                                   reconciliation with the Calico datastore. [Default:
2784                                   5m]'
2785                                 type: string
2786                             type: object
2787                         type: object
2788                       etcdV3CompactionPeriod:
2789                         description: 'EtcdV3CompactionPeriod is the period between etcdv3
2790                           compaction requests. Set to 0 to disable. [Default: 10m]'
2791                         type: string
2792                       healthChecks:
2793                         description: 'HealthChecks enables or disables support for health
2794                           checks [Default: Enabled]'
2795                         type: string
2796                       logSeverityScreen:
2797                         description: 'LogSeverityScreen is the log severity above which
2798                           logs are sent to the stdout. [Default: Info]'
2799                         type: string
2800                       prometheusMetricsPort:
2801                         description: 'PrometheusMetricsPort is the TCP port that the Prometheus
2802                           metrics server should bind to. Set to 0 to disable. [Default:
2803                           9094]'
2804                         type: integer
2805                     required:
2806                     - controllers
2807                     type: object
2808                 type: object
2809             type: object
2810         served: true
2811         storage: true
2812     status:
2813       acceptedNames:
2814         kind: ""
2815         plural: ""
2816       conditions: []
2817       storedVersions: []
2818     ---
2819     apiVersion: apiextensions.k8s.io/v1
2820     kind: CustomResourceDefinition
2821     metadata:
2822       name: networkpolicies.crd.projectcalico.org
2823     spec:
2824       group: crd.projectcalico.org
2825       names:
2826         kind: NetworkPolicy
2827         listKind: NetworkPolicyList
2828         plural: networkpolicies
2829         singular: networkpolicy
2830       scope: Namespaced
2831       versions:
2832       - name: v1
2833         schema:
2834           openAPIV3Schema:
2835             properties:
2836               apiVersion:
2837                 description: 'APIVersion defines the versioned schema of this representation
2838                   of an object. Servers should convert recognized schemas to the latest
2839                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2840                 type: string
2841               kind:
2842                 description: 'Kind is a string value representing the REST resource this
2843                   object represents. Servers may infer this from the endpoint the client
2844                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2845                 type: string
2846               metadata:
2847                 type: object
2848               spec:
2849                 properties:
2850                   egress:
2851                     description: The ordered set of egress rules.  Each rule contains
2852                       a set of packet match criteria and a corresponding action to apply.
2853                     items:
2854                       description: "A Rule encapsulates a set of match criteria and an
2855                         action.  Both selector-based security Policy and security Profiles
2856                         reference rules - separated out as a list of rules for both ingress
2857                         and egress packet matching. \n Each positive match criteria has
2858                         a negated version, prefixed with \"Not\". All the match criteria
2859                         within a rule must be satisfied for a packet to match. A single
2860                         rule can contain the positive and negative version of a match
2861                         and both must be satisfied for the rule to match."
2862                       properties:
2863                         action:
2864                           type: string
2865                         destination:
2866                           description: Destination contains the match criteria that apply
2867                             to destination entity.
2868                           properties:
2869                             namespaceSelector:
2870                               description: "NamespaceSelector is an optional field that
2871                                 contains a selector expression. Only traffic that originates
2872                                 from (or terminates at) endpoints within the selected
2873                                 namespaces will be matched. When both NamespaceSelector
2874                                 and another selector are defined on the same rule, then
2875                                 only workload endpoints that are matched by both selectors
2876                                 will be selected by the rule. \n For NetworkPolicy, an
2877                                 empty NamespaceSelector implies that the Selector is limited
2878                                 to selecting only workload endpoints in the same namespace
2879                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
2880                                 NamespaceSelector implies that the Selector is limited
2881                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
2882                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
2883                                 the Selector applies to workload endpoints across all
2884                                 namespaces."
2885                               type: string
2886                             nets:
2887                               description: Nets is an optional field that restricts the
2888                                 rule to only apply to traffic that originates from (or
2889                                 terminates at) IP addresses in any of the given subnets.
2890                               items:
2891                                 type: string
2892                               type: array
2893                             notNets:
2894                               description: NotNets is the negated version of the Nets
2895                                 field.
2896                               items:
2897                                 type: string
2898                               type: array
2899                             notPorts:
2900                               description: NotPorts is the negated version of the Ports
2901                                 field. Since only some protocols have ports, if any ports
2902                                 are specified it requires the Protocol match in the Rule
2903                                 to be set to "TCP" or "UDP".
2904                               items:
2905                                 anyOf:
2906                                 - type: integer
2907                                 - type: string
2908                                 pattern: ^.*
2909                                 x-kubernetes-int-or-string: true
2910                               type: array
2911                             notSelector:
2912                               description: NotSelector is the negated version of the Selector
2913                                 field.  See Selector field for subtleties with negated
2914                                 selectors.
2915                               type: string
2916                             ports:
2917                               description: "Ports is an optional field that restricts
2918                                 the rule to only apply to traffic that has a source (destination)
2919                                 port that matches one of these ranges/values. This value
2920                                 is a list of integers or strings that represent ranges
2921                                 of ports. \n Since only some protocols have ports, if
2922                                 any ports are specified it requires the Protocol match
2923                                 in the Rule to be set to \"TCP\" or \"UDP\"."
2924                               items:
2925                                 anyOf:
2926                                 - type: integer
2927                                 - type: string
2928                                 pattern: ^.*
2929                                 x-kubernetes-int-or-string: true
2930                               type: array
2931                             selector:
2932                               description: "Selector is an optional field that contains
2933                                 a selector expression (see Policy for sample syntax).
2934                                 \ Only traffic that originates from (terminates at) endpoints
2935                                 matching the selector will be matched. \n Note that: in
2936                                 addition to the negated version of the Selector (see NotSelector
2937                                 below), the selector expression syntax itself supports
2938                                 negation.  The two types of negation are subtly different.
2939                                 One negates the set of matched endpoints, the other negates
2940                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
2941                                 packets that are from other Calico-controlled \tendpoints
2942                                 that do not have the label \"my_label\". \n \tNotSelector
2943                                 = \"has(my_label)\" matches packets that are not from
2944                                 Calico-controlled \tendpoints that do have the label \"my_label\".
2945                                 \n The effect is that the latter will accept packets from
2946                                 non-Calico sources whereas the former is limited to packets
2947                                 from Calico-controlled endpoints."
2948                               type: string
2949                             serviceAccounts:
2950                               description: ServiceAccounts is an optional field that restricts
2951                                 the rule to only apply to traffic that originates from
2952                                 (or terminates at) a pod running as a matching service
2953                                 account.
2954                               properties:
2955                                 names:
2956                                   description: Names is an optional field that restricts
2957                                     the rule to only apply to traffic that originates
2958                                     from (or terminates at) a pod running as a service
2959                                     account whose name is in the list.
2960                                   items:
2961                                     type: string
2962                                   type: array
2963                                 selector:
2964                                   description: Selector is an optional field that restricts
2965                                     the rule to only apply to traffic that originates
2966                                     from (or terminates at) a pod running as a service
2967                                     account that matches the given label selector. If
2968                                     both Names and Selector are specified then they are
2969                                     AND'ed.
2970                                   type: string
2971                               type: object
2972                             services:
2973                               description: "Services is an optional field that contains
2974                                 options for matching Kubernetes Services. If specified,
2975                                 only traffic that originates from or terminates at endpoints
2976                                 within the selected service(s) will be matched, and only
2977                                 to/from each endpoint's port. \n Services cannot be specified
2978                                 on the same rule as Selector, NotSelector, NamespaceSelector,
2979                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
2980                                 can only be specified with Services on ingress rules."
2981                               properties:
2982                                 name:
2983                                   description: Name specifies the name of a Kubernetes
2984                                     Service to match.
2985                                   type: string
2986                                 namespace:
2987                                   description: Namespace specifies the namespace of the
2988                                     given Service. If left empty, the rule will match
2989                                     within this policy's namespace.
2990                                   type: string
2991                               type: object
2992                           type: object
2993                         http:
2994                           description: HTTP contains match criteria that apply to HTTP
2995                             requests.
2996                           properties:
2997                             methods:
2998                               description: Methods is an optional field that restricts
2999                                 the rule to apply only to HTTP requests that use one of
3000                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
3001                                 methods are OR'd together.
3002                               items:
3003                                 type: string
3004                               type: array
3005                             paths:
3006                               description: 'Paths is an optional field that restricts
3007                                 the rule to apply to HTTP requests that use one of the
3008                                 listed HTTP Paths. Multiple paths are OR''d together.
3009                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
3010                                 ONLY specify either a `exact` or a `prefix` match. The
3011                                 validator will check for it.'
3012                               items:
3013                                 description: 'HTTPPath specifies an HTTP path to match.
3014                                   It may be either of the form: exact: <path>: which matches
3015                                   the path exactly or prefix: <path-prefix>: which matches
3016                                   the path prefix'
3017                                 properties:
3018                                   exact:
3019                                     type: string
3020                                   prefix:
3021                                     type: string
3022                                 type: object
3023                               type: array
3024                           type: object
3025                         icmp:
3026                           description: ICMP is an optional field that restricts the rule
3027                             to apply to a specific type and code of ICMP traffic.  This
3028                             should only be specified if the Protocol field is set to "ICMP"
3029                             or "ICMPv6".
3030                           properties:
3031                             code:
3032                               description: Match on a specific ICMP code.  If specified,
3033                                 the Type value must also be specified. This is a technical
3034                                 limitation imposed by the kernel's iptables firewall,
3035                                 which Calico uses to enforce the rule.
3036                               type: integer
3037                             type:
3038                               description: Match on a specific ICMP type.  For example
3039                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
3040                               type: integer
3041                           type: object
3042                         ipVersion:
3043                           description: IPVersion is an optional field that restricts the
3044                             rule to only match a specific IP version.
3045                           type: integer
3046                         metadata:
3047                           description: Metadata contains additional information for this
3048                             rule
3049                           properties:
3050                             annotations:
3051                               additionalProperties:
3052                                 type: string
3053                               description: Annotations is a set of key value pairs that
3054                                 give extra information about the rule
3055                               type: object
3056                           type: object
3057                         notICMP:
3058                           description: NotICMP is the negated version of the ICMP field.
3059                           properties:
3060                             code:
3061                               description: Match on a specific ICMP code.  If specified,
3062                                 the Type value must also be specified. This is a technical
3063                                 limitation imposed by the kernel's iptables firewall,
3064                                 which Calico uses to enforce the rule.
3065                               type: integer
3066                             type:
3067                               description: Match on a specific ICMP type.  For example
3068                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
3069                               type: integer
3070                           type: object
3071                         notProtocol:
3072                           anyOf:
3073                           - type: integer
3074                           - type: string
3075                           description: NotProtocol is the negated version of the Protocol
3076                             field.
3077                           pattern: ^.*
3078                           x-kubernetes-int-or-string: true
3079                         protocol:
3080                           anyOf:
3081                           - type: integer
3082                           - type: string
3083                           description: "Protocol is an optional field that restricts the
3084                             rule to only apply to traffic of a specific IP protocol. Required
3085                             if any of the EntityRules contain Ports (because ports only
3086                             apply to certain protocols). \n Must be one of these string
3087                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
3088                             \"UDPLite\" or an integer in the range 1-255."
3089                           pattern: ^.*
3090                           x-kubernetes-int-or-string: true
3091                         source:
3092                           description: Source contains the match criteria that apply to
3093                             source entity.
3094                           properties:
3095                             namespaceSelector:
3096                               description: "NamespaceSelector is an optional field that
3097                                 contains a selector expression. Only traffic that originates
3098                                 from (or terminates at) endpoints within the selected
3099                                 namespaces will be matched. When both NamespaceSelector
3100                                 and another selector are defined on the same rule, then
3101                                 only workload endpoints that are matched by both selectors
3102                                 will be selected by the rule. \n For NetworkPolicy, an
3103                                 empty NamespaceSelector implies that the Selector is limited
3104                                 to selecting only workload endpoints in the same namespace
3105                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
3106                                 NamespaceSelector implies that the Selector is limited
3107                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
3108                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
3109                                 the Selector applies to workload endpoints across all
3110                                 namespaces."
3111                               type: string
3112                             nets:
3113                               description: Nets is an optional field that restricts the
3114                                 rule to only apply to traffic that originates from (or
3115                                 terminates at) IP addresses in any of the given subnets.
3116                               items:
3117                                 type: string
3118                               type: array
3119                             notNets:
3120                               description: NotNets is the negated version of the Nets
3121                                 field.
3122                               items:
3123                                 type: string
3124                               type: array
3125                             notPorts:
3126                               description: NotPorts is the negated version of the Ports
3127                                 field. Since only some protocols have ports, if any ports
3128                                 are specified it requires the Protocol match in the Rule
3129                                 to be set to "TCP" or "UDP".
3130                               items:
3131                                 anyOf:
3132                                 - type: integer
3133                                 - type: string
3134                                 pattern: ^.*
3135                                 x-kubernetes-int-or-string: true
3136                               type: array
3137                             notSelector:
3138                               description: NotSelector is the negated version of the Selector
3139                                 field.  See Selector field for subtleties with negated
3140                                 selectors.
3141                               type: string
3142                             ports:
3143                               description: "Ports is an optional field that restricts
3144                                 the rule to only apply to traffic that has a source (destination)
3145                                 port that matches one of these ranges/values. This value
3146                                 is a list of integers or strings that represent ranges
3147                                 of ports. \n Since only some protocols have ports, if
3148                                 any ports are specified it requires the Protocol match
3149                                 in the Rule to be set to \"TCP\" or \"UDP\"."
3150                               items:
3151                                 anyOf:
3152                                 - type: integer
3153                                 - type: string
3154                                 pattern: ^.*
3155                                 x-kubernetes-int-or-string: true
3156                               type: array
3157                             selector:
3158                               description: "Selector is an optional field that contains
3159                                 a selector expression (see Policy for sample syntax).
3160                                 \ Only traffic that originates from (terminates at) endpoints
3161                                 matching the selector will be matched. \n Note that: in
3162                                 addition to the negated version of the Selector (see NotSelector
3163                                 below), the selector expression syntax itself supports
3164                                 negation.  The two types of negation are subtly different.
3165                                 One negates the set of matched endpoints, the other negates
3166                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
3167                                 packets that are from other Calico-controlled \tendpoints
3168                                 that do not have the label \"my_label\". \n \tNotSelector
3169                                 = \"has(my_label)\" matches packets that are not from
3170                                 Calico-controlled \tendpoints that do have the label \"my_label\".
3171                                 \n The effect is that the latter will accept packets from
3172                                 non-Calico sources whereas the former is limited to packets
3173                                 from Calico-controlled endpoints."
3174                               type: string
3175                             serviceAccounts:
3176                               description: ServiceAccounts is an optional field that restricts
3177                                 the rule to only apply to traffic that originates from
3178                                 (or terminates at) a pod running as a matching service
3179                                 account.
3180                               properties:
3181                                 names:
3182                                   description: Names is an optional field that restricts
3183                                     the rule to only apply to traffic that originates
3184                                     from (or terminates at) a pod running as a service
3185                                     account whose name is in the list.
3186                                   items:
3187                                     type: string
3188                                   type: array
3189                                 selector:
3190                                   description: Selector is an optional field that restricts
3191                                     the rule to only apply to traffic that originates
3192                                     from (or terminates at) a pod running as a service
3193                                     account that matches the given label selector. If
3194                                     both Names and Selector are specified then they are
3195                                     AND'ed.
3196                                   type: string
3197                               type: object
3198                             services:
3199                               description: "Services is an optional field that contains
3200                                 options for matching Kubernetes Services. If specified,
3201                                 only traffic that originates from or terminates at endpoints
3202                                 within the selected service(s) will be matched, and only
3203                                 to/from each endpoint's port. \n Services cannot be specified
3204                                 on the same rule as Selector, NotSelector, NamespaceSelector,
3205                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
3206                                 can only be specified with Services on ingress rules."
3207                               properties:
3208                                 name:
3209                                   description: Name specifies the name of a Kubernetes
3210                                     Service to match.
3211                                   type: string
3212                                 namespace:
3213                                   description: Namespace specifies the namespace of the
3214                                     given Service. If left empty, the rule will match
3215                                     within this policy's namespace.
3216                                   type: string
3217                               type: object
3218                           type: object
3219                       required:
3220                       - action
3221                       type: object
3222                     type: array
3223                   ingress:
3224                     description: The ordered set of ingress rules.  Each rule contains
3225                       a set of packet match criteria and a corresponding action to apply.
3226                     items:
3227                       description: "A Rule encapsulates a set of match criteria and an
3228                         action.  Both selector-based security Policy and security Profiles
3229                         reference rules - separated out as a list of rules for both ingress
3230                         and egress packet matching. \n Each positive match criteria has
3231                         a negated version, prefixed with \"Not\". All the match criteria
3232                         within a rule must be satisfied for a packet to match. A single
3233                         rule can contain the positive and negative version of a match
3234                         and both must be satisfied for the rule to match."
3235                       properties:
3236                         action:
3237                           type: string
3238                         destination:
3239                           description: Destination contains the match criteria that apply
3240                             to destination entity.
3241                           properties:
3242                             namespaceSelector:
3243                               description: "NamespaceSelector is an optional field that
3244                                 contains a selector expression. Only traffic that originates
3245                                 from (or terminates at) endpoints within the selected
3246                                 namespaces will be matched. When both NamespaceSelector
3247                                 and another selector are defined on the same rule, then
3248                                 only workload endpoints that are matched by both selectors
3249                                 will be selected by the rule. \n For NetworkPolicy, an
3250                                 empty NamespaceSelector implies that the Selector is limited
3251                                 to selecting only workload endpoints in the same namespace
3252                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
3253                                 NamespaceSelector implies that the Selector is limited
3254                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
3255                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
3256                                 the Selector applies to workload endpoints across all
3257                                 namespaces."
3258                               type: string
3259                             nets:
3260                               description: Nets is an optional field that restricts the
3261                                 rule to only apply to traffic that originates from (or
3262                                 terminates at) IP addresses in any of the given subnets.
3263                               items:
3264                                 type: string
3265                               type: array
3266                             notNets:
3267                               description: NotNets is the negated version of the Nets
3268                                 field.
3269                               items:
3270                                 type: string
3271                               type: array
3272                             notPorts:
3273                               description: NotPorts is the negated version of the Ports
3274                                 field. Since only some protocols have ports, if any ports
3275                                 are specified it requires the Protocol match in the Rule
3276                                 to be set to "TCP" or "UDP".
3277                               items:
3278                                 anyOf:
3279                                 - type: integer
3280                                 - type: string
3281                                 pattern: ^.*
3282                                 x-kubernetes-int-or-string: true
3283                               type: array
3284                             notSelector:
3285                               description: NotSelector is the negated version of the Selector
3286                                 field.  See Selector field for subtleties with negated
3287                                 selectors.
3288                               type: string
3289                             ports:
3290                               description: "Ports is an optional field that restricts
3291                                 the rule to only apply to traffic that has a source (destination)
3292                                 port that matches one of these ranges/values. This value
3293                                 is a list of integers or strings that represent ranges
3294                                 of ports. \n Since only some protocols have ports, if
3295                                 any ports are specified it requires the Protocol match
3296                                 in the Rule to be set to \"TCP\" or \"UDP\"."
3297                               items:
3298                                 anyOf:
3299                                 - type: integer
3300                                 - type: string
3301                                 pattern: ^.*
3302                                 x-kubernetes-int-or-string: true
3303                               type: array
3304                             selector:
3305                               description: "Selector is an optional field that contains
3306                                 a selector expression (see Policy for sample syntax).
3307                                 \ Only traffic that originates from (terminates at) endpoints
3308                                 matching the selector will be matched. \n Note that: in
3309                                 addition to the negated version of the Selector (see NotSelector
3310                                 below), the selector expression syntax itself supports
3311                                 negation.  The two types of negation are subtly different.
3312                                 One negates the set of matched endpoints, the other negates
3313                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
3314                                 packets that are from other Calico-controlled \tendpoints
3315                                 that do not have the label \"my_label\". \n \tNotSelector
3316                                 = \"has(my_label)\" matches packets that are not from
3317                                 Calico-controlled \tendpoints that do have the label \"my_label\".
3318                                 \n The effect is that the latter will accept packets from
3319                                 non-Calico sources whereas the former is limited to packets
3320                                 from Calico-controlled endpoints."
3321                               type: string
3322                             serviceAccounts:
3323                               description: ServiceAccounts is an optional field that restricts
3324                                 the rule to only apply to traffic that originates from
3325                                 (or terminates at) a pod running as a matching service
3326                                 account.
3327                               properties:
3328                                 names:
3329                                   description: Names is an optional field that restricts
3330                                     the rule to only apply to traffic that originates
3331                                     from (or terminates at) a pod running as a service
3332                                     account whose name is in the list.
3333                                   items:
3334                                     type: string
3335                                   type: array
3336                                 selector:
3337                                   description: Selector is an optional field that restricts
3338                                     the rule to only apply to traffic that originates
3339                                     from (or terminates at) a pod running as a service
3340                                     account that matches the given label selector. If
3341                                     both Names and Selector are specified then they are
3342                                     AND'ed.
3343                                   type: string
3344                               type: object
3345                             services:
3346                               description: "Services is an optional field that contains
3347                                 options for matching Kubernetes Services. If specified,
3348                                 only traffic that originates from or terminates at endpoints
3349                                 within the selected service(s) will be matched, and only
3350                                 to/from each endpoint's port. \n Services cannot be specified
3351                                 on the same rule as Selector, NotSelector, NamespaceSelector,
3352                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
3353                                 can only be specified with Services on ingress rules."
3354                               properties:
3355                                 name:
3356                                   description: Name specifies the name of a Kubernetes
3357                                     Service to match.
3358                                   type: string
3359                                 namespace:
3360                                   description: Namespace specifies the namespace of the
3361                                     given Service. If left empty, the rule will match
3362                                     within this policy's namespace.
3363                                   type: string
3364                               type: object
3365                           type: object
3366                         http:
3367                           description: HTTP contains match criteria that apply to HTTP
3368                             requests.
3369                           properties:
3370                             methods:
3371                               description: Methods is an optional field that restricts
3372                                 the rule to apply only to HTTP requests that use one of
3373                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
3374                                 methods are OR'd together.
3375                               items:
3376                                 type: string
3377                               type: array
3378                             paths:
3379                               description: 'Paths is an optional field that restricts
3380                                 the rule to apply to HTTP requests that use one of the
3381                                 listed HTTP Paths. Multiple paths are OR''d together.
3382                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
3383                                 ONLY specify either a `exact` or a `prefix` match. The
3384                                 validator will check for it.'
3385                               items:
3386                                 description: 'HTTPPath specifies an HTTP path to match.
3387                                   It may be either of the form: exact: <path>: which matches
3388                                   the path exactly or prefix: <path-prefix>: which matches
3389                                   the path prefix'
3390                                 properties:
3391                                   exact:
3392                                     type: string
3393                                   prefix:
3394                                     type: string
3395                                 type: object
3396                               type: array
3397                           type: object
3398                         icmp:
3399                           description: ICMP is an optional field that restricts the rule
3400                             to apply to a specific type and code of ICMP traffic.  This
3401                             should only be specified if the Protocol field is set to "ICMP"
3402                             or "ICMPv6".
3403                           properties:
3404                             code:
3405                               description: Match on a specific ICMP code.  If specified,
3406                                 the Type value must also be specified. This is a technical
3407                                 limitation imposed by the kernel's iptables firewall,
3408                                 which Calico uses to enforce the rule.
3409                               type: integer
3410                             type:
3411                               description: Match on a specific ICMP type.  For example
3412                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
3413                               type: integer
3414                           type: object
3415                         ipVersion:
3416                           description: IPVersion is an optional field that restricts the
3417                             rule to only match a specific IP version.
3418                           type: integer
3419                         metadata:
3420                           description: Metadata contains additional information for this
3421                             rule
3422                           properties:
3423                             annotations:
3424                               additionalProperties:
3425                                 type: string
3426                               description: Annotations is a set of key value pairs that
3427                                 give extra information about the rule
3428                               type: object
3429                           type: object
3430                         notICMP:
3431                           description: NotICMP is the negated version of the ICMP field.
3432                           properties:
3433                             code:
3434                               description: Match on a specific ICMP code.  If specified,
3435                                 the Type value must also be specified. This is a technical
3436                                 limitation imposed by the kernel's iptables firewall,
3437                                 which Calico uses to enforce the rule.
3438                               type: integer
3439                             type:
3440                               description: Match on a specific ICMP type.  For example
3441                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
3442                               type: integer
3443                           type: object
3444                         notProtocol:
3445                           anyOf:
3446                           - type: integer
3447                           - type: string
3448                           description: NotProtocol is the negated version of the Protocol
3449                             field.
3450                           pattern: ^.*
3451                           x-kubernetes-int-or-string: true
3452                         protocol:
3453                           anyOf:
3454                           - type: integer
3455                           - type: string
3456                           description: "Protocol is an optional field that restricts the
3457                             rule to only apply to traffic of a specific IP protocol. Required
3458                             if any of the EntityRules contain Ports (because ports only
3459                             apply to certain protocols). \n Must be one of these string
3460                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
3461                             \"UDPLite\" or an integer in the range 1-255."
3462                           pattern: ^.*
3463                           x-kubernetes-int-or-string: true
3464                         source:
3465                           description: Source contains the match criteria that apply to
3466                             source entity.
3467                           properties:
3468                             namespaceSelector:
3469                               description: "NamespaceSelector is an optional field that
3470                                 contains a selector expression. Only traffic that originates
3471                                 from (or terminates at) endpoints within the selected
3472                                 namespaces will be matched. When both NamespaceSelector
3473                                 and another selector are defined on the same rule, then
3474                                 only workload endpoints that are matched by both selectors
3475                                 will be selected by the rule. \n For NetworkPolicy, an
3476                                 empty NamespaceSelector implies that the Selector is limited
3477                                 to selecting only workload endpoints in the same namespace
3478                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
3479                                 NamespaceSelector implies that the Selector is limited
3480                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
3481                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
3482                                 the Selector applies to workload endpoints across all
3483                                 namespaces."
3484                               type: string
3485                             nets:
3486                               description: Nets is an optional field that restricts the
3487                                 rule to only apply to traffic that originates from (or
3488                                 terminates at) IP addresses in any of the given subnets.
3489                               items:
3490                                 type: string
3491                               type: array
3492                             notNets:
3493                               description: NotNets is the negated version of the Nets
3494                                 field.
3495                               items:
3496                                 type: string
3497                               type: array
3498                             notPorts:
3499                               description: NotPorts is the negated version of the Ports
3500                                 field. Since only some protocols have ports, if any ports
3501                                 are specified it requires the Protocol match in the Rule
3502                                 to be set to "TCP" or "UDP".
3503                               items:
3504                                 anyOf:
3505                                 - type: integer
3506                                 - type: string
3507                                 pattern: ^.*
3508                                 x-kubernetes-int-or-string: true
3509                               type: array
3510                             notSelector:
3511                               description: NotSelector is the negated version of the Selector
3512                                 field.  See Selector field for subtleties with negated
3513                                 selectors.
3514                               type: string
3515                             ports:
3516                               description: "Ports is an optional field that restricts
3517                                 the rule to only apply to traffic that has a source (destination)
3518                                 port that matches one of these ranges/values. This value
3519                                 is a list of integers or strings that represent ranges
3520                                 of ports. \n Since only some protocols have ports, if
3521                                 any ports are specified it requires the Protocol match
3522                                 in the Rule to be set to \"TCP\" or \"UDP\"."
3523                               items:
3524                                 anyOf:
3525                                 - type: integer
3526                                 - type: string
3527                                 pattern: ^.*
3528                                 x-kubernetes-int-or-string: true
3529                               type: array
3530                             selector:
3531                               description: "Selector is an optional field that contains
3532                                 a selector expression (see Policy for sample syntax).
3533                                 \ Only traffic that originates from (terminates at) endpoints
3534                                 matching the selector will be matched. \n Note that: in
3535                                 addition to the negated version of the Selector (see NotSelector
3536                                 below), the selector expression syntax itself supports
3537                                 negation.  The two types of negation are subtly different.
3538                                 One negates the set of matched endpoints, the other negates
3539                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
3540                                 packets that are from other Calico-controlled \tendpoints
3541                                 that do not have the label \"my_label\". \n \tNotSelector
3542                                 = \"has(my_label)\" matches packets that are not from
3543                                 Calico-controlled \tendpoints that do have the label \"my_label\".
3544                                 \n The effect is that the latter will accept packets from
3545                                 non-Calico sources whereas the former is limited to packets
3546                                 from Calico-controlled endpoints."
3547                               type: string
3548                             serviceAccounts:
3549                               description: ServiceAccounts is an optional field that restricts
3550                                 the rule to only apply to traffic that originates from
3551                                 (or terminates at) a pod running as a matching service
3552                                 account.
3553                               properties:
3554                                 names:
3555                                   description: Names is an optional field that restricts
3556                                     the rule to only apply to traffic that originates
3557                                     from (or terminates at) a pod running as a service
3558                                     account whose name is in the list.
3559                                   items:
3560                                     type: string
3561                                   type: array
3562                                 selector:
3563                                   description: Selector is an optional field that restricts
3564                                     the rule to only apply to traffic that originates
3565                                     from (or terminates at) a pod running as a service
3566                                     account that matches the given label selector. If
3567                                     both Names and Selector are specified then they are
3568                                     AND'ed.
3569                                   type: string
3570                               type: object
3571                             services:
3572                               description: "Services is an optional field that contains
3573                                 options for matching Kubernetes Services. If specified,
3574                                 only traffic that originates from or terminates at endpoints
3575                                 within the selected service(s) will be matched, and only
3576                                 to/from each endpoint's port. \n Services cannot be specified
3577                                 on the same rule as Selector, NotSelector, NamespaceSelector,
3578                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
3579                                 can only be specified with Services on ingress rules."
3580                               properties:
3581                                 name:
3582                                   description: Name specifies the name of a Kubernetes
3583                                     Service to match.
3584                                   type: string
3585                                 namespace:
3586                                   description: Namespace specifies the namespace of the
3587                                     given Service. If left empty, the rule will match
3588                                     within this policy's namespace.
3589                                   type: string
3590                               type: object
3591                           type: object
3592                       required:
3593                       - action
3594                       type: object
3595                     type: array
3596                   order:
3597                     description: Order is an optional field that specifies the order in
3598                       which the policy is applied. Policies with higher "order" are applied
3599                       after those with lower order.  If the order is omitted, it may be
3600                       considered to be "infinite" - i.e. the policy will be applied last.  Policies
3601                       with identical order will be applied in alphanumerical order based
3602                       on the Policy "Name".
3603                     type: number
3604                   selector:
3605                     description: "The selector is an expression used to pick pick out
3606                       the endpoints that the policy should be applied to. \n Selector
3607                       expressions follow this syntax: \n \tlabel == \"string_literal\"
3608                       \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
3609                       \  ->  not equal; also matches if label is not present \tlabel in
3610                       { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
3611                       one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
3612                       ... }  ->  true if the value of label X is not one of \"a\", \"b\",
3613                       \"c\" \thas(label_name)  -> True if that label is present \t! expr
3614                       -> negation of expr \texpr && expr  -> Short-circuit and \texpr
3615                       || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
3616                       or the empty selector -> matches all endpoints. \n Label names are
3617                       allowed to contain alphanumerics, -, _ and /. String literals are
3618                       more permissive but they do not support escape characters. \n Examples
3619                       (with made-up labels): \n \ttype == \"webserver\" && deployment
3620                       == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
3621                       \"dev\" \t! has(label_name)"
3622                     type: string
3623                   serviceAccountSelector:
3624                     description: ServiceAccountSelector is an optional field for an expression
3625                       used to select a pod based on service accounts.
3626                     type: string
3627                   types:
3628                     description: "Types indicates whether this policy applies to ingress,
3629                       or to egress, or to both.  When not explicitly specified (and so
3630                       the value on creation is empty or nil), Calico defaults Types according
3631                       to what Ingress and Egress are present in the policy.  The default
3632                       is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
3633                       the case where there are   also no Ingress rules) \n - [ PolicyTypeEgress
3634                       ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
3635                       PolicyTypeEgress ], if there are both Ingress and Egress rules.
3636                       \n When the policy is read back again, Types will always be one
3637                       of these values, never empty or nil."
3638                     items:
3639                       description: PolicyType enumerates the possible values of the PolicySpec
3640                         Types field.
3641                       type: string
3642                     type: array
3643                 type: object
3644             type: object
3645         served: true
3646         storage: true
3647     status:
3648       acceptedNames:
3649         kind: ""
3650         plural: ""
3651       conditions: []
3652       storedVersions: []
3653     ---
3654     apiVersion: apiextensions.k8s.io/v1
3655     kind: CustomResourceDefinition
3656     metadata:
3657       name: networksets.crd.projectcalico.org
3658     spec:
3659       group: crd.projectcalico.org
3660       names:
3661         kind: NetworkSet
3662         listKind: NetworkSetList
3663         plural: networksets
3664         singular: networkset
3665       scope: Namespaced
3666       versions:
3667       - name: v1
3668         schema:
3669           openAPIV3Schema:
3670             description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet.
3671             properties:
3672               apiVersion:
3673                 description: 'APIVersion defines the versioned schema of this representation
3674                   of an object. Servers should convert recognized schemas to the latest
3675                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
3676                 type: string
3677               kind:
3678                 description: 'Kind is a string value representing the REST resource this
3679                   object represents. Servers may infer this from the endpoint the client
3680                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
3681                 type: string
3682               metadata:
3683                 type: object
3684               spec:
3685                 description: NetworkSetSpec contains the specification for a NetworkSet
3686                   resource.
3687                 properties:
3688                   nets:
3689                     description: The list of IP networks that belong to this set.
3690                     items:
3691                       type: string
3692                     type: array
3693                 type: object
3694             type: object
3695         served: true
3696         storage: true
3697     status:
3698       acceptedNames:
3699         kind: ""
3700         plural: ""
3701       conditions: []
3702       storedVersions: []
3703     ---
3704     apiVersion: v1
3705     kind: ServiceAccount
3706     metadata:
3707       name: calico-kube-controllers
3708       namespace: kube-system
3709     ---
3710     apiVersion: v1
3711     kind: ServiceAccount
3712     metadata:
3713       name: calico-node
3714       namespace: kube-system
3715     ---
3716     apiVersion: rbac.authorization.k8s.io/v1
3717     kind: ClusterRole
3718     metadata:
3719       name: calico-kube-controllers
3720     rules:
3721     - apiGroups:
3722       - ""
3723       resources:
3724       - nodes
3725       verbs:
3726       - watch
3727       - list
3728       - get
3729     - apiGroups:
3730       - ""
3731       resources:
3732       - pods
3733       verbs:
3734       - get
3735       - list
3736       - watch
3737     - apiGroups:
3738       - crd.projectcalico.org
3739       resources:
3740       - ippools
3741       - ipreservations
3742       verbs:
3743       - list
3744     - apiGroups:
3745       - crd.projectcalico.org
3746       resources:
3747       - blockaffinities
3748       - ipamblocks
3749       - ipamhandles
3750       verbs:
3751       - get
3752       - list
3753       - create
3754       - update
3755       - delete
3756       - watch
3757     - apiGroups:
3758       - crd.projectcalico.org
3759       resources:
3760       - hostendpoints
3761       verbs:
3762       - get
3763       - list
3764       - create
3765       - update
3766       - delete
3767     - apiGroups:
3768       - crd.projectcalico.org
3769       resources:
3770       - clusterinformations
3771       verbs:
3772       - get
3773       - create
3774       - update
3775     - apiGroups:
3776       - crd.projectcalico.org
3777       resources:
3778       - kubecontrollersconfigurations
3779       verbs:
3780       - get
3781       - create
3782       - update
3783       - watch
3784     ---
3785     apiVersion: rbac.authorization.k8s.io/v1
3786     kind: ClusterRole
3787     metadata:
3788       name: calico-node
3789     rules:
3790     - apiGroups:
3791       - ""
3792       resources:
3793       - pods
3794       - nodes
3795       - namespaces
3796       verbs:
3797       - get
3798     - apiGroups:
3799       - discovery.k8s.io
3800       resources:
3801       - endpointslices
3802       verbs:
3803       - watch
3804       - list
3805     - apiGroups:
3806       - ""
3807       resources:
3808       - endpoints
3809       - services
3810       verbs:
3811       - watch
3812       - list
3813       - get
3814     - apiGroups:
3815       - ""
3816       resources:
3817       - configmaps
3818       verbs:
3819       - get
3820     - apiGroups:
3821       - ""
3822       resources:
3823       - nodes/status
3824       verbs:
3825       - patch
3826       - update
3827     - apiGroups:
3828       - networking.k8s.io
3829       resources:
3830       - networkpolicies
3831       verbs:
3832       - watch
3833       - list
3834     - apiGroups:
3835       - ""
3836       resources:
3837       - pods
3838       - namespaces
3839       - serviceaccounts
3840       verbs:
3841       - list
3842       - watch
3843     - apiGroups:
3844       - ""
3845       resources:
3846       - pods/status
3847       verbs:
3848       - patch
3849     - apiGroups:
3850       - crd.projectcalico.org
3851       resources:
3852       - globalfelixconfigs
3853       - felixconfigurations
3854       - bgppeers
3855       - globalbgpconfigs
3856       - bgpconfigurations
3857       - ippools
3858       - ipreservations
3859       - ipamblocks
3860       - globalnetworkpolicies
3861       - globalnetworksets
3862       - networkpolicies
3863       - networksets
3864       - clusterinformations
3865       - hostendpoints
3866       - blockaffinities
3867       - caliconodestatuses
3868       verbs:
3869       - get
3870       - list
3871       - watch
3872     - apiGroups:
3873       - crd.projectcalico.org
3874       resources:
3875       - ippools
3876       - felixconfigurations
3877       - clusterinformations
3878       verbs:
3879       - create
3880       - update
3881     - apiGroups:
3882       - crd.projectcalico.org
3883       resources:
3884       - caliconodestatuses
3885       verbs:
3886       - update
3887     - apiGroups:
3888       - ""
3889       resources:
3890       - nodes
3891       verbs:
3892       - get
3893       - list
3894       - watch
3895     - apiGroups:
3896       - crd.projectcalico.org
3897       resources:
3898       - bgpconfigurations
3899       - bgppeers
3900       verbs:
3901       - create
3902       - update
3903     - apiGroups:
3904       - crd.projectcalico.org
3905       resources:
3906       - blockaffinities
3907       - ipamblocks
3908       - ipamhandles
3909       verbs:
3910       - get
3911       - list
3912       - create
3913       - update
3914       - delete
3915     - apiGroups:
3916       - crd.projectcalico.org
3917       resources:
3918       - ipamconfigs
3919       verbs:
3920       - get
3921     - apiGroups:
3922       - crd.projectcalico.org
3923       resources:
3924       - blockaffinities
3925       verbs:
3926       - watch
3927     - apiGroups:
3928       - apps
3929       resources:
3930       - daemonsets
3931       verbs:
3932       - get
3933     ---
3934     apiVersion: rbac.authorization.k8s.io/v1
3935     kind: ClusterRoleBinding
3936     metadata:
3937       name: calico-kube-controllers
3938     roleRef:
3939       apiGroup: rbac.authorization.k8s.io
3940       kind: ClusterRole
3941       name: calico-kube-controllers
3942     subjects:
3943     - kind: ServiceAccount
3944       name: calico-kube-controllers
3945       namespace: kube-system
3946     ---
3947     apiVersion: rbac.authorization.k8s.io/v1
3948     kind: ClusterRoleBinding
3949     metadata:
3950       name: calico-node
3951     roleRef:
3952       apiGroup: rbac.authorization.k8s.io
3953       kind: ClusterRole
3954       name: calico-node
3955     subjects:
3956     - kind: ServiceAccount
3957       name: calico-node
3958       namespace: kube-system
3959     ---
3960     apiVersion: v1
3961     data:
3962       calico_backend: bird
3963       cni_network_config: |-
3964         {
3965           "name": "k8s-pod-network",
3966           "cniVersion": "0.3.1",
3967           "plugins": [
3968             {
3969               "type": "calico",
3970               "log_level": "info",
3971               "log_file_path": "/var/log/calico/cni/cni.log",
3972               "datastore_type": "kubernetes",
3973               "nodename": "__KUBERNETES_NODE_NAME__",
3974               "mtu": __CNI_MTU__,
3975               "ipam": {
3976                   "type": "calico-ipam"
3977               },
3978               "policy": {
3979                   "type": "k8s"
3980               },
3981               "kubernetes": {
3982                   "kubeconfig": "__KUBECONFIG_FILEPATH__"
3983               }
3984             },
3985             {
3986               "type": "portmap",
3987               "snat": true,
3988               "capabilities": {"portMappings": true}
3989             },
3990             {
3991               "type": "bandwidth",
3992               "capabilities": {"bandwidth": true}
3993             }
3994           ]
3995         }
3996       typha_service_name: none
3997       veth_mtu: "0"
3998     kind: ConfigMap
3999     metadata:
4000       name: calico-config
4001       namespace: kube-system
4002     ---
4003     apiVersion: apps/v1
4004     kind: Deployment
4005     metadata:
4006       labels:
4007         k8s-app: calico-kube-controllers
4008       name: calico-kube-controllers
4009       namespace: kube-system
4010     spec:
4011       replicas: 1
4012       selector:
4013         matchLabels:
4014           k8s-app: calico-kube-controllers
4015       strategy:
4016         type: Recreate
4017       template:
4018         metadata:
4019           labels:
4020             k8s-app: calico-kube-controllers
4021           name: calico-kube-controllers
4022           namespace: kube-system
4023         spec:
4024           containers:
4025           - env:
4026             - name: ENABLED_CONTROLLERS
4027               value: node
4028             - name: DATASTORE_TYPE
4029               value: kubernetes
4030             image: docker.io/calico/kube-controllers:v3.22.1
4031             livenessProbe:
4032               exec:
4033                 command:
4034                 - /usr/bin/check-status
4035                 - -l
4036               failureThreshold: 6
4037               initialDelaySeconds: 10
4038               periodSeconds: 10
4039               timeoutSeconds: 10
4040             name: calico-kube-controllers
4041             readinessProbe:
4042               exec:
4043                 command:
4044                 - /usr/bin/check-status
4045                 - -r
4046               periodSeconds: 10
4047           nodeSelector:
4048             kubernetes.io/os: linux
4049           priorityClassName: system-cluster-critical
4050           serviceAccountName: calico-kube-controllers
4051           tolerations:
4052           - key: CriticalAddonsOnly
4053             operator: Exists
4054           - effect: NoSchedule
4055             key: node-role.kubernetes.io/master
4056     ---
4057     apiVersion: policy/v1beta1
4058     kind: PodDisruptionBudget
4059     metadata:
4060       labels:
4061         k8s-app: calico-kube-controllers
4062       name: calico-kube-controllers
4063       namespace: kube-system
4064     spec:
4065       maxUnavailable: 1
4066       selector:
4067         matchLabels:
4068           k8s-app: calico-kube-controllers
4069     ---
4070     apiVersion: apps/v1
4071     kind: DaemonSet
4072     metadata:
4073       labels:
4074         k8s-app: calico-node
4075       name: calico-node
4076       namespace: kube-system
4077     spec:
4078       selector:
4079         matchLabels:
4080           k8s-app: calico-node
4081       template:
4082         metadata:
4083           labels:
4084             k8s-app: calico-node
4085         spec:
4086           containers:
4087           - env:
4088             - name: IP_AUTODETECTION_METHOD
4089               value: can-reach=www.google.com
4090             - name: DATASTORE_TYPE
4091               value: kubernetes
4092             - name: WAIT_FOR_DATASTORE
4093               value: "true"
4094             - name: NODENAME
4095               valueFrom:
4096                 fieldRef:
4097                   fieldPath: spec.nodeName
4098             - name: CALICO_NETWORKING_BACKEND
4099               valueFrom:
4100                 configMapKeyRef:
4101                   key: calico_backend
4102                   name: calico-config
4103             - name: CLUSTER_TYPE
4104               value: k8s,bgp
4105             - name: IP
4106               value: autodetect
4107             - name: CALICO_IPV4POOL_IPIP
4108               value: Always
4109             - name: CALICO_IPV4POOL_VXLAN
4110               value: Never
4111             - name: FELIX_IPINIPMTU
4112               valueFrom:
4113                 configMapKeyRef:
4114                   key: veth_mtu
4115                   name: calico-config
4116             - name: FELIX_VXLANMTU
4117               valueFrom:
4118                 configMapKeyRef:
4119                   key: veth_mtu
4120                   name: calico-config
4121             - name: FELIX_WIREGUARDMTU
4122               valueFrom:
4123                 configMapKeyRef:
4124                   key: veth_mtu
4125                   name: calico-config
4126             - name: CALICO_DISABLE_FILE_LOGGING
4127               value: "true"
4128             - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
4129               value: ACCEPT
4130             - name: FELIX_IPV6SUPPORT
4131               value: "false"
4132             - name: FELIX_HEALTHENABLED
4133               value: "true"
4134             envFrom:
4135             - configMapRef:
4136                 name: kubernetes-services-endpoint
4137                 optional: true
4138             image: docker.io/calico/node:v3.22.1
4139             lifecycle:
4140               preStop:
4141                 exec:
4142                   command:
4143                   - /bin/calico-node
4144                   - -shutdown
4145             livenessProbe:
4146               exec:
4147                 command:
4148                 - /bin/calico-node
4149                 - -felix-live
4150                 - -bird-live
4151               failureThreshold: 6
4152               initialDelaySeconds: 10
4153               periodSeconds: 10
4154               timeoutSeconds: 10
4155             name: calico-node
4156             readinessProbe:
4157               exec:
4158                 command:
4159                 - /bin/calico-node
4160                 - -felix-ready
4161                 - -bird-ready
4162               periodSeconds: 10
4163               timeoutSeconds: 10
4164             resources:
4165               requests:
4166                 cpu: 250m
4167             securityContext:
4168               privileged: true
4169             volumeMounts:
4170             - mountPath: /host/etc/cni/net.d
4171               name: cni-net-dir
4172               readOnly: false
4173             - mountPath: /lib/modules
4174               name: lib-modules
4175               readOnly: true
4176             - mountPath: /run/xtables.lock
4177               name: xtables-lock
4178               readOnly: false
4179             - mountPath: /var/run/calico
4180               name: var-run-calico
4181               readOnly: false
4182             - mountPath: /var/lib/calico
4183               name: var-lib-calico
4184               readOnly: false
4185             - mountPath: /var/run/nodeagent
4186               name: policysync
4187             - mountPath: /sys/fs/
4188               mountPropagation: Bidirectional
4189               name: sysfs
4190             - mountPath: /var/log/calico/cni
4191               name: cni-log-dir
4192               readOnly: true
4193           hostNetwork: true
4194           initContainers:
4195           - command:
4196             - /opt/cni/bin/calico-ipam
4197             - -upgrade
4198             env:
4199             - name: KUBERNETES_NODE_NAME
4200               valueFrom:
4201                 fieldRef:
4202                   fieldPath: spec.nodeName
4203             - name: CALICO_NETWORKING_BACKEND
4204               valueFrom:
4205                 configMapKeyRef:
4206                   key: calico_backend
4207                   name: calico-config
4208             envFrom:
4209             - configMapRef:
4210                 name: kubernetes-services-endpoint
4211                 optional: true
4212             image: docker.io/calico/cni:v3.22.1
4213             name: upgrade-ipam
4214             securityContext:
4215               privileged: true
4216             volumeMounts:
4217             - mountPath: /var/lib/cni/networks
4218               name: host-local-net-dir
4219             - mountPath: /host/opt/cni/bin
4220               name: cni-bin-dir
4221           - command:
4222             - /opt/cni/bin/install
4223             env:
4224             - name: CNI_CONF_NAME
4225               value: 10-calico.conflist
4226             - name: CNI_NETWORK_CONFIG
4227               valueFrom:
4228                 configMapKeyRef:
4229                   key: cni_network_config
4230                   name: calico-config
4231             - name: KUBERNETES_NODE_NAME
4232               valueFrom:
4233                 fieldRef:
4234                   fieldPath: spec.nodeName
4235             - name: CNI_MTU
4236               valueFrom:
4237                 configMapKeyRef:
4238                   key: veth_mtu
4239                   name: calico-config
4240             - name: SLEEP
4241               value: "false"
4242             envFrom:
4243             - configMapRef:
4244                 name: kubernetes-services-endpoint
4245                 optional: true
4246             image: docker.io/calico/cni:v3.22.1
4247             name: install-cni
4248             securityContext:
4249               privileged: true
4250             volumeMounts:
4251             - mountPath: /host/opt/cni/bin
4252               name: cni-bin-dir
4253             - mountPath: /host/etc/cni/net.d
4254               name: cni-net-dir
4255           - image: docker.io/calico/pod2daemon-flexvol:v3.22.1
4256             name: flexvol-driver
4257             securityContext:
4258               privileged: true
4259             volumeMounts:
4260             - mountPath: /host/driver
4261               name: flexvol-driver-host
4262           nodeSelector:
4263             kubernetes.io/os: linux
4264           priorityClassName: system-node-critical
4265           serviceAccountName: calico-node
4266           terminationGracePeriodSeconds: 0
4267           tolerations:
4268           - effect: NoSchedule
4269             operator: Exists
4270           - key: CriticalAddonsOnly
4271             operator: Exists
4272           - effect: NoExecute
4273             operator: Exists
4274           volumes:
4275           - hostPath:
4276               path: /lib/modules
4277             name: lib-modules
4278           - hostPath:
4279               path: /var/run/calico
4280             name: var-run-calico
4281           - hostPath:
4282               path: /var/lib/calico
4283             name: var-lib-calico
4284           - hostPath:
4285               path: /run/xtables.lock
4286               type: FileOrCreate
4287             name: xtables-lock
4288           - hostPath:
4289               path: /sys/fs/
4290               type: DirectoryOrCreate
4291             name: sysfs
4292           - hostPath:
4293               path: /opt/cni/bin
4294             name: cni-bin-dir
4295           - hostPath:
4296               path: /etc/cni/net.d
4297             name: cni-net-dir
4298           - hostPath:
4299               path: /var/log/calico/cni
4300             name: cni-log-dir
4301           - hostPath:
4302               path: /var/lib/cni/networks
4303             name: host-local-net-dir
4304           - hostPath:
4305               path: /var/run/nodeagent
4306               type: DirectoryOrCreate
4307             name: policysync
4308           - hostPath:
4309               path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
4310               type: DirectoryOrCreate
4311             name: flexvol-driver-host
4312       updateStrategy:
4313         rollingUpdate:
4314           maxUnavailable: 1
4315         type: RollingUpdate
4316 kind: ConfigMap
4317 metadata:
4318   creationTimestamp: null
4319   name: {{ .Values.clusterName }}-calico-addon
4320 {{- end }}
4321 {{- if eq .Values.ipam "dualstack" }}
4322 ---
4323 apiVersion: v1
4324 data:
4325   calico.yaml: |
4326     apiVersion: apiextensions.k8s.io/v1
4327     kind: CustomResourceDefinition
4328     metadata:
4329       name: bgpconfigurations.crd.projectcalico.org
4330     spec:
4331       group: crd.projectcalico.org
4332       names:
4333         kind: BGPConfiguration
4334         listKind: BGPConfigurationList
4335         plural: bgpconfigurations
4336         singular: bgpconfiguration
4337       scope: Cluster
4338       versions:
4339       - name: v1
4340         schema:
4341           openAPIV3Schema:
4342             description: BGPConfiguration contains the configuration for any BGP routing.
4343             properties:
4344               apiVersion:
4345                 description: 'APIVersion defines the versioned schema of this representation
4346                   of an object. Servers should convert recognized schemas to the latest
4347                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
4348                 type: string
4349               kind:
4350                 description: 'Kind is a string value representing the REST resource this
4351                   object represents. Servers may infer this from the endpoint the client
4352                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
4353                 type: string
4354               metadata:
4355                 type: object
4356               spec:
4357                 description: BGPConfigurationSpec contains the values of the BGP configuration.
4358                 properties:
4359                   asNumber:
4360                     description: 'ASNumber is the default AS number used by a node. [Default:
4361                       64512]'
4362                     format: int32
4363                     type: integer
4364                   communities:
4365                     description: Communities is a list of BGP community values and their
4366                       arbitrary names for tagging routes.
4367                     items:
4368                       description: Community contains standard or large community value
4369                         and its name.
4370                       properties:
4371                         name:
4372                           description: Name given to community value.
4373                           type: string
4374                         value:
4375                           description: Value must be of format `aa:nn` or `aa:nn:mm`.
4376                             For standard community use `aa:nn` format, where `aa` and
4377                             `nn` are 16 bit number. For large community use `aa:nn:mm`
4378                             format, where `aa`, `nn` and `mm` are 32 bit number. Where,
4379                             `aa` is an AS Number, `nn` and `mm` are per-AS identifier.
4380                           pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$
4381                           type: string
4382                       type: object
4383                     type: array
4384                   listenPort:
4385                     description: ListenPort is the port where BGP protocol should listen.
4386                       Defaults to 179
4387                     maximum: 65535
4388                     minimum: 1
4389                     type: integer
4390                   logSeverityScreen:
4391                     description: 'LogSeverityScreen is the log severity above which logs
4392                       are sent to the stdout. [Default: INFO]'
4393                     type: string
4394                   nodeToNodeMeshEnabled:
4395                     description: 'NodeToNodeMeshEnabled sets whether full node to node
4396                       BGP mesh is enabled. [Default: true]'
4397                     type: boolean
4398                   prefixAdvertisements:
4399                     description: PrefixAdvertisements contains per-prefix advertisement
4400                       configuration.
4401                     items:
4402                       description: PrefixAdvertisement configures advertisement properties
4403                         for the specified CIDR.
4404                       properties:
4405                         cidr:
4406                           description: CIDR for which properties should be advertised.
4407                           type: string
4408                         communities:
4409                           description: Communities can be list of either community names
4410                             already defined in `Specs.Communities` or community value
4411                             of format `aa:nn` or `aa:nn:mm`. For standard community use
4412                             `aa:nn` format, where `aa` and `nn` are 16 bit number. For
4413                             large community use `aa:nn:mm` format, where `aa`, `nn` and
4414                             `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and
4415                             `mm` are per-AS identifier.
4416                           items:
4417                             type: string
4418                           type: array
4419                       type: object
4420                     type: array
4421                   serviceClusterIPs:
4422                     description: ServiceClusterIPs are the CIDR blocks from which service
4423                       cluster IPs are allocated. If specified, Calico will advertise these
4424                       blocks, as well as any cluster IPs within them.
4425                     items:
4426                       description: ServiceClusterIPBlock represents a single allowed ClusterIP
4427                         CIDR block.
4428                       properties:
4429                         cidr:
4430                           type: string
4431                       type: object
4432                     type: array
4433                   serviceExternalIPs:
4434                     description: ServiceExternalIPs are the CIDR blocks for Kubernetes
4435                       Service External IPs. Kubernetes Service ExternalIPs will only be
4436                       advertised if they are within one of these blocks.
4437                     items:
4438                       description: ServiceExternalIPBlock represents a single allowed
4439                         External IP CIDR block.
4440                       properties:
4441                         cidr:
4442                           type: string
4443                       type: object
4444                     type: array
4445                   serviceLoadBalancerIPs:
4446                     description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes
4447                       Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress
4448                       IPs will only be advertised if they are within one of these blocks.
4449                     items:
4450                       description: ServiceLoadBalancerIPBlock represents a single allowed
4451                         LoadBalancer IP CIDR block.
4452                       properties:
4453                         cidr:
4454                           type: string
4455                       type: object
4456                     type: array
4457                 type: object
4458             type: object
4459         served: true
4460         storage: true
4461     status:
4462       acceptedNames:
4463         kind: ""
4464         plural: ""
4465       conditions: []
4466       storedVersions: []
4467     ---
4468     apiVersion: apiextensions.k8s.io/v1
4469     kind: CustomResourceDefinition
4470     metadata:
4471       name: bgppeers.crd.projectcalico.org
4472     spec:
4473       group: crd.projectcalico.org
4474       names:
4475         kind: BGPPeer
4476         listKind: BGPPeerList
4477         plural: bgppeers
4478         singular: bgppeer
4479       scope: Cluster
4480       versions:
4481       - name: v1
4482         schema:
4483           openAPIV3Schema:
4484             properties:
4485               apiVersion:
4486                 description: 'APIVersion defines the versioned schema of this representation
4487                   of an object. Servers should convert recognized schemas to the latest
4488                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
4489                 type: string
4490               kind:
4491                 description: 'Kind is a string value representing the REST resource this
4492                   object represents. Servers may infer this from the endpoint the client
4493                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
4494                 type: string
4495               metadata:
4496                 type: object
4497               spec:
4498                 description: BGPPeerSpec contains the specification for a BGPPeer resource.
4499                 properties:
4500                   asNumber:
4501                     description: The AS Number of the peer.
4502                     format: int32
4503                     type: integer
4504                   keepOriginalNextHop:
4505                     description: Option to keep the original nexthop field when routes
4506                       are sent to a BGP Peer. Setting "true" configures the selected BGP
4507                       Peers node to use the "next hop keep;" instead of "next hop self;"(default)
4508                       in the specific branch of the Node on "bird.cfg".
4509                     type: boolean
4510                   maxRestartTime:
4511                     description: Time to allow for software restart.  When specified,
4512                       this is configured as the graceful restart timeout.  When not specified,
4513                       the BIRD default of 120s is used.
4514                     type: string
4515                   node:
4516                     description: The node name identifying the Calico node instance that
4517                       is targeted by this peer. If this is not set, and no nodeSelector
4518                       is specified, then this BGP peer selects all nodes in the cluster.
4519                     type: string
4520                   nodeSelector:
4521                     description: Selector for the nodes that should have this peering.  When
4522                       this is set, the Node field must be empty.
4523                     type: string
4524                   password:
4525                     description: Optional BGP password for the peerings generated by this
4526                       BGPPeer resource.
4527                     properties:
4528                       secretKeyRef:
4529                         description: Selects a key of a secret in the node pod's namespace.
4530                         properties:
4531                           key:
4532                             description: The key of the secret to select from.  Must be
4533                               a valid secret key.
4534                             type: string
4535                           name:
4536                             description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4537                               TODO: Add other useful fields. apiVersion, kind, uid?'
4538                             type: string
4539                           optional:
4540                             description: Specify whether the Secret or its key must be
4541                               defined
4542                             type: boolean
4543                         required:
4544                         - key
4545                         type: object
4546                     type: object
4547                   peerIP:
4548                     description: The IP address of the peer followed by an optional port
4549                       number to peer with. If port number is given, format should be `[<IPv6>]:port`
4550                       or `<IPv4>:<port>` for IPv4. If optional port number is not set,
4551                       and this peer IP and ASNumber belongs to a calico/node with ListenPort
4552                       set in BGPConfiguration, then we use that port to peer.
4553                     type: string
4554                   peerSelector:
4555                     description: Selector for the remote nodes to peer with.  When this
4556                       is set, the PeerIP and ASNumber fields must be empty.  For each
4557                       peering between the local node and selected remote nodes, we configure
4558                       an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified,
4559                       and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified.  The
4560                       remote AS number comes from the remote node's NodeBGPSpec.ASNumber,
4561                       or the global default if that is not set.
4562                     type: string
4563                   sourceAddress:
4564                     description: Specifies whether and how to configure a source address
4565                       for the peerings generated by this BGPPeer resource.  Default value
4566                       "UseNodeIP" means to configure the node IP as the source address.  "None"
4567                       means not to configure a source address.
4568                     type: string
4569                 type: object
4570             type: object
4571         served: true
4572         storage: true
4573     status:
4574       acceptedNames:
4575         kind: ""
4576         plural: ""
4577       conditions: []
4578       storedVersions: []
4579     ---
4580     apiVersion: apiextensions.k8s.io/v1
4581     kind: CustomResourceDefinition
4582     metadata:
4583       name: blockaffinities.crd.projectcalico.org
4584     spec:
4585       group: crd.projectcalico.org
4586       names:
4587         kind: BlockAffinity
4588         listKind: BlockAffinityList
4589         plural: blockaffinities
4590         singular: blockaffinity
4591       scope: Cluster
4592       versions:
4593       - name: v1
4594         schema:
4595           openAPIV3Schema:
4596             properties:
4597               apiVersion:
4598                 description: 'APIVersion defines the versioned schema of this representation
4599                   of an object. Servers should convert recognized schemas to the latest
4600                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
4601                 type: string
4602               kind:
4603                 description: 'Kind is a string value representing the REST resource this
4604                   object represents. Servers may infer this from the endpoint the client
4605                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
4606                 type: string
4607               metadata:
4608                 type: object
4609               spec:
4610                 description: BlockAffinitySpec contains the specification for a BlockAffinity
4611                   resource.
4612                 properties:
4613                   cidr:
4614                     type: string
4615                   deleted:
4616                     description: Deleted indicates that this block affinity is being deleted.
4617                       This field is a string for compatibility with older releases that
4618                       mistakenly treat this field as a string.
4619                     type: string
4620                   node:
4621                     type: string
4622                   state:
4623                     type: string
4624                 required:
4625                 - cidr
4626                 - deleted
4627                 - node
4628                 - state
4629                 type: object
4630             type: object
4631         served: true
4632         storage: true
4633     status:
4634       acceptedNames:
4635         kind: ""
4636         plural: ""
4637       conditions: []
4638       storedVersions: []
4639     ---
4640     apiVersion: apiextensions.k8s.io/v1
4641     kind: CustomResourceDefinition
4642     metadata:
4643       annotations:
4644         controller-gen.kubebuilder.io/version: (devel)
4645       creationTimestamp: null
4646       name: caliconodestatuses.crd.projectcalico.org
4647     spec:
4648       group: crd.projectcalico.org
4649       names:
4650         kind: CalicoNodeStatus
4651         listKind: CalicoNodeStatusList
4652         plural: caliconodestatuses
4653         singular: caliconodestatus
4654       scope: Cluster
4655       versions:
4656       - name: v1
4657         schema:
4658           openAPIV3Schema:
4659             properties:
4660               apiVersion:
4661                 description: 'APIVersion defines the versioned schema of this representation
4662                   of an object. Servers should convert recognized schemas to the latest
4663                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
4664                 type: string
4665               kind:
4666                 description: 'Kind is a string value representing the REST resource this
4667                   object represents. Servers may infer this from the endpoint the client
4668                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
4669                 type: string
4670               metadata:
4671                 type: object
4672               spec:
4673                 description: CalicoNodeStatusSpec contains the specification for a CalicoNodeStatus
4674                   resource.
4675                 properties:
4676                   classes:
4677                     description: Classes declares the types of information to monitor
4678                       for this calico/node, and allows for selective status reporting
4679                       about certain subsets of information.
4680                     items:
4681                       type: string
4682                     type: array
4683                   node:
4684                     description: The node name identifies the Calico node instance for
4685                       node status.
4686                     type: string
4687                   updatePeriodSeconds:
4688                     description: UpdatePeriodSeconds is the period at which CalicoNodeStatus
4689                       should be updated. Set to 0 to disable CalicoNodeStatus refresh.
4690                       Maximum update period is one day.
4691                     format: int32
4692                     type: integer
4693                 type: object
4694               status:
4695                 description: CalicoNodeStatusStatus defines the observed state of CalicoNodeStatus.
4696                   No validation needed for status since it is updated by Calico.
4697                 properties:
4698                   agent:
4699                     description: Agent holds agent status on the node.
4700                     properties:
4701                       birdV4:
4702                         description: BIRDV4 represents the latest observed status of bird4.
4703                         properties:
4704                           lastBootTime:
4705                             description: LastBootTime holds the value of lastBootTime
4706                               from bird.ctl output.
4707                             type: string
4708                           lastReconfigurationTime:
4709                             description: LastReconfigurationTime holds the value of lastReconfigTime
4710                               from bird.ctl output.
4711                             type: string
4712                           routerID:
4713                             description: Router ID used by bird.
4714                             type: string
4715                           state:
4716                             description: The state of the BGP Daemon.
4717                             type: string
4718                           version:
4719                             description: Version of the BGP daemon
4720                             type: string
4721                         type: object
4722                       birdV6:
4723                         description: BIRDV6 represents the latest observed status of bird6.
4724                         properties:
4725                           lastBootTime:
4726                             description: LastBootTime holds the value of lastBootTime
4727                               from bird.ctl output.
4728                             type: string
4729                           lastReconfigurationTime:
4730                             description: LastReconfigurationTime holds the value of lastReconfigTime
4731                               from bird.ctl output.
4732                             type: string
4733                           routerID:
4734                             description: Router ID used by bird.
4735                             type: string
4736                           state:
4737                             description: The state of the BGP Daemon.
4738                             type: string
4739                           version:
4740                             description: Version of the BGP daemon
4741                             type: string
4742                         type: object
4743                     type: object
4744                   bgp:
4745                     description: BGP holds node BGP status.
4746                     properties:
4747                       numberEstablishedV4:
4748                         description: The total number of IPv4 established bgp sessions.
4749                         type: integer
4750                       numberEstablishedV6:
4751                         description: The total number of IPv6 established bgp sessions.
4752                         type: integer
4753                       numberNotEstablishedV4:
4754                         description: The total number of IPv4 non-established bgp sessions.
4755                         type: integer
4756                       numberNotEstablishedV6:
4757                         description: The total number of IPv6 non-established bgp sessions.
4758                         type: integer
4759                       peersV4:
4760                         description: PeersV4 represents IPv4 BGP peers status on the node.
4761                         items:
4762                           description: CalicoNodePeer contains the status of BGP peers
4763                             on the node.
4764                           properties:
4765                             peerIP:
4766                               description: IP address of the peer whose condition we are
4767                                 reporting.
4768                               type: string
4769                             since:
4770                               description: Since the state or reason last changed.
4771                               type: string
4772                             state:
4773                               description: State is the BGP session state.
4774                               type: string
4775                             type:
4776                               description: Type indicates whether this peer is configured
4777                                 via the node-to-node mesh, or via en explicit global or
4778                                 per-node BGPPeer object.
4779                               type: string
4780                           type: object
4781                         type: array
4782                       peersV6:
4783                         description: PeersV6 represents IPv6 BGP peers status on the node.
4784                         items:
4785                           description: CalicoNodePeer contains the status of BGP peers
4786                             on the node.
4787                           properties:
4788                             peerIP:
4789                               description: IP address of the peer whose condition we are
4790                                 reporting.
4791                               type: string
4792                             since:
4793                               description: Since the state or reason last changed.
4794                               type: string
4795                             state:
4796                               description: State is the BGP session state.
4797                               type: string
4798                             type:
4799                               description: Type indicates whether this peer is configured
4800                                 via the node-to-node mesh, or via en explicit global or
4801                                 per-node BGPPeer object.
4802                               type: string
4803                           type: object
4804                         type: array
4805                     required:
4806                     - numberEstablishedV4
4807                     - numberEstablishedV6
4808                     - numberNotEstablishedV4
4809                     - numberNotEstablishedV6
4810                     type: object
4811                   lastUpdated:
4812                     description: LastUpdated is a timestamp representing the server time
4813                       when CalicoNodeStatus object last updated. It is represented in
4814                       RFC3339 form and is in UTC.
4815                     format: date-time
4816                     nullable: true
4817                     type: string
4818                   routes:
4819                     description: Routes reports routes known to the Calico BGP daemon
4820                       on the node.
4821                     properties:
4822                       routesV4:
4823                         description: RoutesV4 represents IPv4 routes on the node.
4824                         items:
4825                           description: CalicoNodeRoute contains the status of BGP routes
4826                             on the node.
4827                           properties:
4828                             destination:
4829                               description: Destination of the route.
4830                               type: string
4831                             gateway:
4832                               description: Gateway for the destination.
4833                               type: string
4834                             interface:
4835                               description: Interface for the destination
4836                               type: string
4837                             learnedFrom:
4838                               description: LearnedFrom contains information regarding
4839                                 where this route originated.
4840                               properties:
4841                                 peerIP:
4842                                   description: If sourceType is NodeMesh or BGPPeer, IP
4843                                     address of the router that sent us this route.
4844                                   type: string
4845                                 sourceType:
4846                                   description: Type of the source where a route is learned
4847                                     from.
4848                                   type: string
4849                               type: object
4850                             type:
4851                               description: Type indicates if the route is being used for
4852                                 forwarding or not.
4853                               type: string
4854                           type: object
4855                         type: array
4856                       routesV6:
4857                         description: RoutesV6 represents IPv6 routes on the node.
4858                         items:
4859                           description: CalicoNodeRoute contains the status of BGP routes
4860                             on the node.
4861                           properties:
4862                             destination:
4863                               description: Destination of the route.
4864                               type: string
4865                             gateway:
4866                               description: Gateway for the destination.
4867                               type: string
4868                             interface:
4869                               description: Interface for the destination
4870                               type: string
4871                             learnedFrom:
4872                               description: LearnedFrom contains information regarding
4873                                 where this route originated.
4874                               properties:
4875                                 peerIP:
4876                                   description: If sourceType is NodeMesh or BGPPeer, IP
4877                                     address of the router that sent us this route.
4878                                   type: string
4879                                 sourceType:
4880                                   description: Type of the source where a route is learned
4881                                     from.
4882                                   type: string
4883                               type: object
4884                             type:
4885                               description: Type indicates if the route is being used for
4886                                 forwarding or not.
4887                               type: string
4888                           type: object
4889                         type: array
4890                     type: object
4891                 type: object
4892             type: object
4893         served: true
4894         storage: true
4895     status:
4896       acceptedNames:
4897         kind: ""
4898         plural: ""
4899       conditions: []
4900       storedVersions: []
4901     ---
4902     apiVersion: apiextensions.k8s.io/v1
4903     kind: CustomResourceDefinition
4904     metadata:
4905       name: clusterinformations.crd.projectcalico.org
4906     spec:
4907       group: crd.projectcalico.org
4908       names:
4909         kind: ClusterInformation
4910         listKind: ClusterInformationList
4911         plural: clusterinformations
4912         singular: clusterinformation
4913       scope: Cluster
4914       versions:
4915       - name: v1
4916         schema:
4917           openAPIV3Schema:
4918             description: ClusterInformation contains the cluster specific information.
4919             properties:
4920               apiVersion:
4921                 description: 'APIVersion defines the versioned schema of this representation
4922                   of an object. Servers should convert recognized schemas to the latest
4923                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
4924                 type: string
4925               kind:
4926                 description: 'Kind is a string value representing the REST resource this
4927                   object represents. Servers may infer this from the endpoint the client
4928                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
4929                 type: string
4930               metadata:
4931                 type: object
4932               spec:
4933                 description: ClusterInformationSpec contains the values of describing
4934                   the cluster.
4935                 properties:
4936                   calicoVersion:
4937                     description: CalicoVersion is the version of Calico that the cluster
4938                       is running
4939                     type: string
4940                   clusterGUID:
4941                     description: ClusterGUID is the GUID of the cluster
4942                     type: string
4943                   clusterType:
4944                     description: ClusterType describes the type of the cluster
4945                     type: string
4946                   datastoreReady:
4947                     description: DatastoreReady is used during significant datastore migrations
4948                       to signal to components such as Felix that it should wait before
4949                       accessing the datastore.
4950                     type: boolean
4951                   variant:
4952                     description: Variant declares which variant of Calico should be active.
4953                     type: string
4954                 type: object
4955             type: object
4956         served: true
4957         storage: true
4958     status:
4959       acceptedNames:
4960         kind: ""
4961         plural: ""
4962       conditions: []
4963       storedVersions: []
4964     ---
4965     apiVersion: apiextensions.k8s.io/v1
4966     kind: CustomResourceDefinition
4967     metadata:
4968       name: felixconfigurations.crd.projectcalico.org
4969     spec:
4970       group: crd.projectcalico.org
4971       names:
4972         kind: FelixConfiguration
4973         listKind: FelixConfigurationList
4974         plural: felixconfigurations
4975         singular: felixconfiguration
4976       scope: Cluster
4977       versions:
4978       - name: v1
4979         schema:
4980           openAPIV3Schema:
4981             description: Felix Configuration contains the configuration for Felix.
4982             properties:
4983               apiVersion:
4984                 description: 'APIVersion defines the versioned schema of this representation
4985                   of an object. Servers should convert recognized schemas to the latest
4986                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
4987                 type: string
4988               kind:
4989                 description: 'Kind is a string value representing the REST resource this
4990                   object represents. Servers may infer this from the endpoint the client
4991                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
4992                 type: string
4993               metadata:
4994                 type: object
4995               spec:
4996                 description: FelixConfigurationSpec contains the values of the Felix configuration.
4997                 properties:
4998                   allowIPIPPacketsFromWorkloads:
4999                     description: 'AllowIPIPPacketsFromWorkloads controls whether Felix
5000                       will add a rule to drop IPIP encapsulated traffic from workloads
5001                       [Default: false]'
5002                     type: boolean
5003                   allowVXLANPacketsFromWorkloads:
5004                     description: 'AllowVXLANPacketsFromWorkloads controls whether Felix
5005                       will add a rule to drop VXLAN encapsulated traffic from workloads
5006                       [Default: false]'
5007                     type: boolean
5008                   awsSrcDstCheck:
5009                     description: 'Set source-destination-check on AWS EC2 instances. Accepted
5010                       value must be one of "DoNothing", "Enable" or "Disable". [Default:
5011                       DoNothing]'
5012                     enum:
5013                     - DoNothing
5014                     - Enable
5015                     - Disable
5016                     type: string
5017                   bpfConnectTimeLoadBalancingEnabled:
5018                     description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode,
5019                       controls whether Felix installs the connection-time load balancer.  The
5020                       connect-time load balancer is required for the host to be able to
5021                       reach Kubernetes services and it improves the performance of pod-to-service
5022                       connections.  The only reason to disable it is for debugging purposes.  [Default:
5023                       true]'
5024                     type: boolean
5025                   bpfDataIfacePattern:
5026                     description: BPFDataIfacePattern is a regular expression that controls
5027                       which interfaces Felix should attach BPF programs to in order to
5028                       catch traffic to/from the network.  This needs to match the interfaces
5029                       that Calico workload traffic flows over as well as any interfaces
5030                       that handle incoming traffic to nodeports and services from outside
5031                       the cluster.  It should not match the workload interfaces (usually
5032                       named cali...).
5033                     type: string
5034                   bpfDisableUnprivileged:
5035                     description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled
5036                       sysctl to disable unprivileged use of BPF.  This ensures that unprivileged
5037                       users cannot access Calico''s BPF maps and cannot insert their own
5038                       BPF programs to interfere with Calico''s. [Default: true]'
5039                     type: boolean
5040                   bpfEnabled:
5041                     description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
5042                       [Default: false]'
5043                     type: boolean
5044                   bpfExtToServiceConnmark:
5045                     description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit
5046                       mark that is set on connections from an external client to a local
5047                       service. This mark allows us to control how packets of that connection
5048                       are routed within the host and how is routing intepreted by RPF
5049                       check. [Default: 0]'
5050                     type: integer
5051                   bpfExternalServiceMode:
5052                     description: 'BPFExternalServiceMode in BPF mode, controls how connections
5053                       from outside the cluster to services (node ports and cluster IPs)
5054                       are forwarded to remote workloads.  If set to "Tunnel" then both
5055                       request and response traffic is tunneled to the remote node.  If
5056                       set to "DSR", the request traffic is tunneled but the response traffic
5057                       is sent directly from the remote node.  In "DSR" mode, the remote
5058                       node appears to use the IP of the ingress node; this requires a
5059                       permissive L2 network.  [Default: Tunnel]'
5060                     type: string
5061                   bpfKubeProxyEndpointSlicesEnabled:
5062                     description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
5063                       whether Felix's embedded kube-proxy accepts EndpointSlices or not.
5064                     type: boolean
5065                   bpfKubeProxyIptablesCleanupEnabled:
5066                     description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF
5067                       mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s
5068                       iptables chains.  Should only be enabled if kube-proxy is not running.  [Default:
5069                       true]'
5070                     type: boolean
5071                   bpfKubeProxyMinSyncPeriod:
5072                     description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the
5073                       minimum time between updates to the dataplane for Felix''s embedded
5074                       kube-proxy.  Lower values give reduced set-up latency.  Higher values
5075                       reduce Felix CPU usage by batching up more work.  [Default: 1s]'
5076                     type: string
5077                   bpfLogLevel:
5078                     description: 'BPFLogLevel controls the log level of the BPF programs
5079                       when in BPF dataplane mode.  One of "Off", "Info", or "Debug".  The
5080                       logs are emitted to the BPF trace pipe, accessible with the command
5081                       `tc exec bpf debug`. [Default: Off].'
5082                     type: string
5083                   chainInsertMode:
5084                     description: 'ChainInsertMode controls whether Felix hooks the kernel''s
5085                       top-level iptables chains by inserting a rule at the top of the
5086                       chain or by appending a rule at the bottom. insert is the safe default
5087                       since it prevents Calico''s rules from being bypassed. If you switch
5088                       to append mode, be sure that the other rules in the chains signal
5089                       acceptance by falling through to the Calico rules, otherwise the
5090                       Calico policy will be bypassed. [Default: insert]'
5091                     type: string
5092                   dataplaneDriver:
5093                     type: string
5094                   debugDisableLogDropping:
5095                     type: boolean
5096                   debugMemoryProfilePath:
5097                     type: string
5098                   debugSimulateCalcGraphHangAfter:
5099                     type: string
5100                   debugSimulateDataplaneHangAfter:
5101                     type: string
5102                   defaultEndpointToHostAction:
5103                     description: 'DefaultEndpointToHostAction controls what happens to
5104                       traffic that goes from a workload endpoint to the host itself (after
5105                       the traffic hits the endpoint egress policy). By default Calico
5106                       blocks traffic from workload endpoints to the host itself with an
5107                       iptables "DROP" action. If you want to allow some or all traffic
5108                       from endpoint to host, set this parameter to RETURN or ACCEPT. Use
5109                       RETURN if you have your own rules in the iptables "INPUT" chain;
5110                       Calico will insert its rules at the top of that chain, then "RETURN"
5111                       packets to the "INPUT" chain once it has completed processing workload
5112                       endpoint egress policy. Use ACCEPT to unconditionally accept packets
5113                       from workloads after processing workload endpoint egress policy.
5114                       [Default: Drop]'
5115                     type: string
5116                   deviceRouteProtocol:
5117                     description: This defines the route protocol added to programmed device
5118                       routes, by default this will be RTPROT_BOOT when left blank.
5119                     type: integer
5120                   deviceRouteSourceAddress:
5121                     description: This is the source address to use on programmed device
5122                       routes. By default the source address is left blank, leaving the
5123                       kernel to choose the source address used.
5124                     type: string
5125                   disableConntrackInvalidCheck:
5126                     type: boolean
5127                   endpointReportingDelay:
5128                     type: string
5129                   endpointReportingEnabled:
5130                     type: boolean
5131                   externalNodesList:
5132                     description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes
5133                       which may source tunnel traffic and have the tunneled traffic be
5134                       accepted at calico nodes.
5135                     items:
5136                       type: string
5137                     type: array
5138                   failsafeInboundHostPorts:
5139                     description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports
5140                       and CIDRs that Felix will allow incoming traffic to host endpoints
5141                       on irrespective of the security policy. This is useful to avoid
5142                       accidentally cutting off a host with incorrect configuration. For
5143                       back-compatibility, if the protocol is not specified, it defaults
5144                       to "tcp". If a CIDR is not specified, it will allow traffic from
5145                       all addresses. To disable all inbound host ports, use the value
5146                       none. The default value allows ssh access and DHCP. [Default: tcp:22,
5147                       udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
5148                     items:
5149                       description: ProtoPort is combination of protocol, port, and CIDR.
5150                         Protocol and port must be specified.
5151                       properties:
5152                         net:
5153                           type: string
5154                         port:
5155                           type: integer
5156                         protocol:
5157                           type: string
5158                       required:
5159                       - port
5160                       - protocol
5161                       type: object
5162                     type: array
5163                   failsafeOutboundHostPorts:
5164                     description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports
5165                       and CIDRs that Felix will allow outgoing traffic from host endpoints
5166                       to irrespective of the security policy. This is useful to avoid
5167                       accidentally cutting off a host with incorrect configuration. For
5168                       back-compatibility, if the protocol is not specified, it defaults
5169                       to "tcp". If a CIDR is not specified, it will allow traffic from
5170                       all addresses. To disable all outbound host ports, use the value
5171                       none. The default value opens etcd''s standard ports to ensure that
5172                       Felix does not get cut off from etcd as well as allowing DHCP and
5173                       DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666,
5174                       tcp:6667, udp:53, udp:67]'
5175                     items:
5176                       description: ProtoPort is combination of protocol, port, and CIDR.
5177                         Protocol and port must be specified.
5178                       properties:
5179                         net:
5180                           type: string
5181                         port:
5182                           type: integer
5183                         protocol:
5184                           type: string
5185                       required:
5186                       - port
5187                       - protocol
5188                       type: object
5189                     type: array
5190                   featureDetectOverride:
5191                     description: FeatureDetectOverride is used to override the feature
5192                       detection. Values are specified in a comma separated list with no
5193                       spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=".
5194                       "true" or "false" will force the feature, empty or omitted values
5195                       are auto-detected.
5196                     type: string
5197                   genericXDPEnabled:
5198                     description: 'GenericXDPEnabled enables Generic XDP so network cards
5199                       that don''t support XDP offload or driver modes can use XDP. This
5200                       is not recommended since it doesn''t provide better performance
5201                       than iptables. [Default: false]'
5202                     type: boolean
5203                   healthEnabled:
5204                     type: boolean
5205                   healthHost:
5206                     type: string
5207                   healthPort:
5208                     type: integer
5209                   interfaceExclude:
5210                     description: 'InterfaceExclude is a comma-separated list of interfaces
5211                       that Felix should exclude when monitoring for host endpoints. The
5212                       default value ensures that Felix ignores Kubernetes'' IPVS dummy
5213                       interface, which is used internally by kube-proxy. If you want to
5214                       exclude multiple interface names using a single value, the list
5215                       supports regular expressions. For regular expressions you must wrap
5216                       the value with ''/''. For example having values ''/^kube/,veth1''
5217                       will exclude all interfaces that begin with ''kube'' and also the
5218                       interface ''veth1''. [Default: kube-ipvs0]'
5219                     type: string
5220                   interfacePrefix:
5221                     description: 'InterfacePrefix is the interface name prefix that identifies
5222                       workload endpoints and so distinguishes them from host endpoint
5223                       interfaces. Note: in environments other than bare metal, the orchestrators
5224                       configure this appropriately. For example our Kubernetes and Docker
5225                       integrations set the ''cali'' value, and our OpenStack integration
5226                       sets the ''tap'' value. [Default: cali]'
5227                     type: string
5228                   interfaceRefreshInterval:
5229                     description: InterfaceRefreshInterval is the period at which Felix
5230                       rescans local interfaces to verify their state. The rescan can be
5231                       disabled by setting the interval to 0.
5232                     type: string
5233                   ipipEnabled:
5234                     type: boolean
5235                   ipipMTU:
5236                     description: 'IPIPMTU is the MTU to set on the tunnel device. See
5237                       Configuring MTU [Default: 1440]'
5238                     type: integer
5239                   ipsetsRefreshInterval:
5240                     description: 'IpsetsRefreshInterval is the period at which Felix re-checks
5241                       all iptables state to ensure that no other process has accidentally
5242                       broken Calico''s rules. Set to 0 to disable iptables refresh. [Default:
5243                       90s]'
5244                     type: string
5245                   iptablesBackend:
5246                     description: IptablesBackend specifies which backend of iptables will
5247                       be used. The default is legacy.
5248                     type: string
5249                   iptablesFilterAllowAction:
5250                     type: string
5251                   iptablesLockFilePath:
5252                     description: 'IptablesLockFilePath is the location of the iptables
5253                       lock file. You may need to change this if the lock file is not in
5254                       its standard location (for example if you have mapped it into Felix''s
5255                       container at a different path). [Default: /run/xtables.lock]'
5256                     type: string
5257                   iptablesLockProbeInterval:
5258                     description: 'IptablesLockProbeInterval is the time that Felix will
5259                       wait between attempts to acquire the iptables lock if it is not
5260                       available. Lower values make Felix more responsive when the lock
5261                       is contended, but use more CPU. [Default: 50ms]'
5262                     type: string
5263                   iptablesLockTimeout:
5264                     description: 'IptablesLockTimeout is the time that Felix will wait
5265                       for the iptables lock, or 0, to disable. To use this feature, Felix
5266                       must share the iptables lock file with all other processes that
5267                       also take the lock. When running Felix inside a container, this
5268                       requires the /run directory of the host to be mounted into the calico/node
5269                       or calico/felix container. [Default: 0s disabled]'
5270                     type: string
5271                   iptablesMangleAllowAction:
5272                     type: string
5273                   iptablesMarkMask:
5274                     description: 'IptablesMarkMask is the mask that Felix selects its
5275                       IPTables Mark bits from. Should be a 32 bit hexadecimal number with
5276                       at least 8 bits set, none of which clash with any other mark bits
5277                       in use on the system. [Default: 0xff000000]'
5278                     format: int32
5279                     type: integer
5280                   iptablesNATOutgoingInterfaceFilter:
5281                     type: string
5282                   iptablesPostWriteCheckInterval:
5283                     description: 'IptablesPostWriteCheckInterval is the period after Felix
5284                       has done a write to the dataplane that it schedules an extra read
5285                       back in order to check the write was not clobbered by another process.
5286                       This should only occur if another application on the system doesn''t
5287                       respect the iptables lock. [Default: 1s]'
5288                     type: string
5289                   iptablesRefreshInterval:
5290                     description: 'IptablesRefreshInterval is the period at which Felix
5291                       re-checks the IP sets in the dataplane to ensure that no other process
5292                       has accidentally broken Calico''s rules. Set to 0 to disable IP
5293                       sets refresh. Note: the default for this value is lower than the
5294                       other refresh intervals as a workaround for a Linux kernel bug that
5295                       was fixed in kernel version 4.11. If you are using v4.11 or greater
5296                       you may want to set this to, a higher value to reduce Felix CPU
5297                       usage. [Default: 10s]'
5298                     type: string
5299                   ipv6Support:
5300                     type: boolean
5301                   kubeNodePortRanges:
5302                     description: 'KubeNodePortRanges holds list of port ranges used for
5303                       service node ports. Only used if felix detects kube-proxy running
5304                       in ipvs mode. Felix uses these ranges to separate host and workload
5305                       traffic. [Default: 30000:32767].'
5306                     items:
5307                       anyOf:
5308                       - type: integer
5309                       - type: string
5310                       pattern: ^.*
5311                       x-kubernetes-int-or-string: true
5312                     type: array
5313                   logFilePath:
5314                     description: 'LogFilePath is the full path to the Felix log. Set to
5315                       none to disable file logging. [Default: /var/log/calico/felix.log]'
5316                     type: string
5317                   logPrefix:
5318                     description: 'LogPrefix is the log prefix that Felix uses when rendering
5319                       LOG rules. [Default: calico-packet]'
5320                     type: string
5321                   logSeverityFile:
5322                     description: 'LogSeverityFile is the log severity above which logs
5323                       are sent to the log file. [Default: Info]'
5324                     type: string
5325                   logSeverityScreen:
5326                     description: 'LogSeverityScreen is the log severity above which logs
5327                       are sent to the stdout. [Default: Info]'
5328                     type: string
5329                   logSeveritySys:
5330                     description: 'LogSeveritySys is the log severity above which logs
5331                       are sent to the syslog. Set to None for no logging to syslog. [Default:
5332                       Info]'
5333                     type: string
5334                   maxIpsetSize:
5335                     type: integer
5336                   metadataAddr:
5337                     description: 'MetadataAddr is the IP address or domain name of the
5338                       server that can answer VM queries for cloud-init metadata. In OpenStack,
5339                       this corresponds to the machine running nova-api (or in Ubuntu,
5340                       nova-api-metadata). A value of none (case insensitive) means that
5341                       Felix should not set up any NAT rule for the metadata path. [Default:
5342                       127.0.0.1]'
5343                     type: string
5344                   metadataPort:
5345                     description: 'MetadataPort is the port of the metadata server. This,
5346                       combined with global.MetadataAddr (if not ''None''), is used to
5347                       set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
5348                       In most cases this should not need to be changed [Default: 8775].'
5349                     type: integer
5350                   mtuIfacePattern:
5351                     description: MTUIfacePattern is a regular expression that controls
5352                       which interfaces Felix should scan in order to calculate the host's
5353                       MTU. This should not match workload interfaces (usually named cali...).
5354                     type: string
5355                   natOutgoingAddress:
5356                     description: NATOutgoingAddress specifies an address to use when performing
5357                       source NAT for traffic in a natOutgoing pool that is leaving the
5358                       network. By default the address used is an address on the interface
5359                       the traffic is leaving on (ie it uses the iptables MASQUERADE target)
5360                     type: string
5361                   natPortRange:
5362                     anyOf:
5363                     - type: integer
5364                     - type: string
5365                     description: NATPortRange specifies the range of ports that is used
5366                       for port mapping when doing outgoing NAT. When unset the default
5367                       behavior of the network stack is used.
5368                     pattern: ^.*
5369                     x-kubernetes-int-or-string: true
5370                   netlinkTimeout:
5371                     type: string
5372                   openstackRegion:
5373                     description: 'OpenstackRegion is the name of the region that a particular
5374                       Felix belongs to. In a multi-region Calico/OpenStack deployment,
5375                       this must be configured somehow for each Felix (here in the datamodel,
5376                       or in felix.cfg or the environment on each compute node), and must
5377                       match the [calico] openstack_region value configured in neutron.conf
5378                       on each node. [Default: Empty]'
5379                     type: string
5380                   policySyncPathPrefix:
5381                     description: 'PolicySyncPathPrefix is used to by Felix to communicate
5382                       policy changes to external services, like Application layer policy.
5383                       [Default: Empty]'
5384                     type: string
5385                   prometheusGoMetricsEnabled:
5386                     description: 'PrometheusGoMetricsEnabled disables Go runtime metrics
5387                       collection, which the Prometheus client does by default, when set
5388                       to false. This reduces the number of metrics reported, reducing
5389                       Prometheus load. [Default: true]'
5390                     type: boolean
5391                   prometheusMetricsEnabled:
5392                     description: 'PrometheusMetricsEnabled enables the Prometheus metrics
5393                       server in Felix if set to true. [Default: false]'
5394                     type: boolean
5395                   prometheusMetricsHost:
5396                     description: 'PrometheusMetricsHost is the host that the Prometheus
5397                       metrics server should bind to. [Default: empty]'
5398                     type: string
5399                   prometheusMetricsPort:
5400                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
5401                       metrics server should bind to. [Default: 9091]'
5402                     type: integer
5403                   prometheusProcessMetricsEnabled:
5404                     description: 'PrometheusProcessMetricsEnabled disables process metrics
5405                       collection, which the Prometheus client does by default, when set
5406                       to false. This reduces the number of metrics reported, reducing
5407                       Prometheus load. [Default: true]'
5408                     type: boolean
5409                   prometheusWireGuardMetricsEnabled:
5410                     description: 'PrometheusWireGuardMetricsEnabled disables wireguard
5411                       metrics collection, which the Prometheus client does by default,
5412                       when set to false. This reduces the number of metrics reported,
5413                       reducing Prometheus load. [Default: true]'
5414                     type: boolean
5415                   removeExternalRoutes:
5416                     description: Whether or not to remove device routes that have not
5417                       been programmed by Felix. Disabling this will allow external applications
5418                       to also add device routes. This is enabled by default which means
5419                       we will remove externally added routes.
5420                     type: boolean
5421                   reportingInterval:
5422                     description: 'ReportingInterval is the interval at which Felix reports
5423                       its status into the datastore or 0 to disable. Must be non-zero
5424                       in OpenStack deployments. [Default: 30s]'
5425                     type: string
5426                   reportingTTL:
5427                     description: 'ReportingTTL is the time-to-live setting for process-wide
5428                       status reports. [Default: 90s]'
5429                     type: string
5430                   routeRefreshInterval:
5431                     description: 'RouteRefreshInterval is the period at which Felix re-checks
5432                       the routes in the dataplane to ensure that no other process has
5433                       accidentally broken Calico''s rules. Set to 0 to disable route refresh.
5434                       [Default: 90s]'
5435                     type: string
5436                   routeSource:
5437                     description: 'RouteSource configures where Felix gets its routing
5438                       information. - WorkloadIPs: use workload endpoints to construct
5439                       routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
5440                     type: string
5441                   routeTableRange:
5442                     description: Calico programs additional Linux route tables for various
5443                       purposes.  RouteTableRange specifies the indices of the route tables
5444                       that Calico should use.
5445                     properties:
5446                       max:
5447                         type: integer
5448                       min:
5449                         type: integer
5450                     required:
5451                     - max
5452                     - min
5453                     type: object
5454                   serviceLoopPrevention:
5455                     description: 'When service IP advertisement is enabled, prevent routing
5456                       loops to service IPs that are not in use, by dropping or rejecting
5457                       packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled",
5458                       in which case such routing loops continue to be allowed. [Default:
5459                       Drop]'
5460                     type: string
5461                   sidecarAccelerationEnabled:
5462                     description: 'SidecarAccelerationEnabled enables experimental sidecar
5463                       acceleration [Default: false]'
5464                     type: boolean
5465                   usageReportingEnabled:
5466                     description: 'UsageReportingEnabled reports anonymous Calico version
5467                       number and cluster size to projectcalico.org. Logs warnings returned
5468                       by the usage server. For example, if a significant security vulnerability
5469                       has been discovered in the version of Calico being used. [Default:
5470                       true]'
5471                     type: boolean
5472                   usageReportingInitialDelay:
5473                     description: 'UsageReportingInitialDelay controls the minimum delay
5474                       before Felix makes a report. [Default: 300s]'
5475                     type: string
5476                   usageReportingInterval:
5477                     description: 'UsageReportingInterval controls the interval at which
5478                       Felix makes reports. [Default: 86400s]'
5479                     type: string
5480                   useInternalDataplaneDriver:
5481                     type: boolean
5482                   vxlanEnabled:
5483                     type: boolean
5484                   vxlanMTU:
5485                     description: 'VXLANMTU is the MTU to set on the tunnel device. See
5486                       Configuring MTU [Default: 1440]'
5487                     type: integer
5488                   vxlanPort:
5489                     type: integer
5490                   vxlanVNI:
5491                     type: integer
5492                   wireguardEnabled:
5493                     description: 'WireguardEnabled controls whether Wireguard is enabled.
5494                       [Default: false]'
5495                     type: boolean
5496                   wireguardHostEncryptionEnabled:
5497                     description: 'WireguardHostEncryptionEnabled controls whether Wireguard
5498                       host-to-host encryption is enabled. [Default: false]'
5499                     type: boolean
5500                   wireguardInterfaceName:
5501                     description: 'WireguardInterfaceName specifies the name to use for
5502                       the Wireguard interface. [Default: wg.calico]'
5503                     type: string
5504                   wireguardListeningPort:
5505                     description: 'WireguardListeningPort controls the listening port used
5506                       by Wireguard. [Default: 51820]'
5507                     type: integer
5508                   wireguardMTU:
5509                     description: 'WireguardMTU controls the MTU on the Wireguard interface.
5510                       See Configuring MTU [Default: 1420]'
5511                     type: integer
5512                   wireguardRoutingRulePriority:
5513                     description: 'WireguardRoutingRulePriority controls the priority value
5514                       to use for the Wireguard routing rule. [Default: 99]'
5515                     type: integer
5516                   xdpEnabled:
5517                     description: 'XDPEnabled enables XDP acceleration for suitable untracked
5518                       incoming deny rules. [Default: true]'
5519                     type: boolean
5520                   xdpRefreshInterval:
5521                     description: 'XDPRefreshInterval is the period at which Felix re-checks
5522                       all XDP state to ensure that no other process has accidentally broken
5523                       Calico''s BPF maps or attached programs. Set to 0 to disable XDP
5524                       refresh. [Default: 90s]'
5525                     type: string
5526                 type: object
5527             type: object
5528         served: true
5529         storage: true
5530     status:
5531       acceptedNames:
5532         kind: ""
5533         plural: ""
5534       conditions: []
5535       storedVersions: []
5536     ---
5537     apiVersion: apiextensions.k8s.io/v1
5538     kind: CustomResourceDefinition
5539     metadata:
5540       name: globalnetworkpolicies.crd.projectcalico.org
5541     spec:
5542       group: crd.projectcalico.org
5543       names:
5544         kind: GlobalNetworkPolicy
5545         listKind: GlobalNetworkPolicyList
5546         plural: globalnetworkpolicies
5547         singular: globalnetworkpolicy
5548       scope: Cluster
5549       versions:
5550       - name: v1
5551         schema:
5552           openAPIV3Schema:
5553             properties:
5554               apiVersion:
5555                 description: 'APIVersion defines the versioned schema of this representation
5556                   of an object. Servers should convert recognized schemas to the latest
5557                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
5558                 type: string
5559               kind:
5560                 description: 'Kind is a string value representing the REST resource this
5561                   object represents. Servers may infer this from the endpoint the client
5562                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
5563                 type: string
5564               metadata:
5565                 type: object
5566               spec:
5567                 properties:
5568                   applyOnForward:
5569                     description: ApplyOnForward indicates to apply the rules in this policy
5570                       on forward traffic.
5571                     type: boolean
5572                   doNotTrack:
5573                     description: DoNotTrack indicates whether packets matched by the rules
5574                       in this policy should go through the data plane's connection tracking,
5575                       such as Linux conntrack.  If True, the rules in this policy are
5576                       applied before any data plane connection tracking, and packets allowed
5577                       by this policy are marked as not to be tracked.
5578                     type: boolean
5579                   egress:
5580                     description: The ordered set of egress rules.  Each rule contains
5581                       a set of packet match criteria and a corresponding action to apply.
5582                     items:
5583                       description: "A Rule encapsulates a set of match criteria and an
5584                         action.  Both selector-based security Policy and security Profiles
5585                         reference rules - separated out as a list of rules for both ingress
5586                         and egress packet matching. \n Each positive match criteria has
5587                         a negated version, prefixed with \"Not\". All the match criteria
5588                         within a rule must be satisfied for a packet to match. A single
5589                         rule can contain the positive and negative version of a match
5590                         and both must be satisfied for the rule to match."
5591                       properties:
5592                         action:
5593                           type: string
5594                         destination:
5595                           description: Destination contains the match criteria that apply
5596                             to destination entity.
5597                           properties:
5598                             namespaceSelector:
5599                               description: "NamespaceSelector is an optional field that
5600                                 contains a selector expression. Only traffic that originates
5601                                 from (or terminates at) endpoints within the selected
5602                                 namespaces will be matched. When both NamespaceSelector
5603                                 and another selector are defined on the same rule, then
5604                                 only workload endpoints that are matched by both selectors
5605                                 will be selected by the rule. \n For NetworkPolicy, an
5606                                 empty NamespaceSelector implies that the Selector is limited
5607                                 to selecting only workload endpoints in the same namespace
5608                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
5609                                 NamespaceSelector implies that the Selector is limited
5610                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
5611                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
5612                                 the Selector applies to workload endpoints across all
5613                                 namespaces."
5614                               type: string
5615                             nets:
5616                               description: Nets is an optional field that restricts the
5617                                 rule to only apply to traffic that originates from (or
5618                                 terminates at) IP addresses in any of the given subnets.
5619                               items:
5620                                 type: string
5621                               type: array
5622                             notNets:
5623                               description: NotNets is the negated version of the Nets
5624                                 field.
5625                               items:
5626                                 type: string
5627                               type: array
5628                             notPorts:
5629                               description: NotPorts is the negated version of the Ports
5630                                 field. Since only some protocols have ports, if any ports
5631                                 are specified it requires the Protocol match in the Rule
5632                                 to be set to "TCP" or "UDP".
5633                               items:
5634                                 anyOf:
5635                                 - type: integer
5636                                 - type: string
5637                                 pattern: ^.*
5638                                 x-kubernetes-int-or-string: true
5639                               type: array
5640                             notSelector:
5641                               description: NotSelector is the negated version of the Selector
5642                                 field.  See Selector field for subtleties with negated
5643                                 selectors.
5644                               type: string
5645                             ports:
5646                               description: "Ports is an optional field that restricts
5647                                 the rule to only apply to traffic that has a source (destination)
5648                                 port that matches one of these ranges/values. This value
5649                                 is a list of integers or strings that represent ranges
5650                                 of ports. \n Since only some protocols have ports, if
5651                                 any ports are specified it requires the Protocol match
5652                                 in the Rule to be set to \"TCP\" or \"UDP\"."
5653                               items:
5654                                 anyOf:
5655                                 - type: integer
5656                                 - type: string
5657                                 pattern: ^.*
5658                                 x-kubernetes-int-or-string: true
5659                               type: array
5660                             selector:
5661                               description: "Selector is an optional field that contains
5662                                 a selector expression (see Policy for sample syntax).
5663                                 \ Only traffic that originates from (terminates at) endpoints
5664                                 matching the selector will be matched. \n Note that: in
5665                                 addition to the negated version of the Selector (see NotSelector
5666                                 below), the selector expression syntax itself supports
5667                                 negation.  The two types of negation are subtly different.
5668                                 One negates the set of matched endpoints, the other negates
5669                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
5670                                 packets that are from other Calico-controlled \tendpoints
5671                                 that do not have the label \"my_label\". \n \tNotSelector
5672                                 = \"has(my_label)\" matches packets that are not from
5673                                 Calico-controlled \tendpoints that do have the label \"my_label\".
5674                                 \n The effect is that the latter will accept packets from
5675                                 non-Calico sources whereas the former is limited to packets
5676                                 from Calico-controlled endpoints."
5677                               type: string
5678                             serviceAccounts:
5679                               description: ServiceAccounts is an optional field that restricts
5680                                 the rule to only apply to traffic that originates from
5681                                 (or terminates at) a pod running as a matching service
5682                                 account.
5683                               properties:
5684                                 names:
5685                                   description: Names is an optional field that restricts
5686                                     the rule to only apply to traffic that originates
5687                                     from (or terminates at) a pod running as a service
5688                                     account whose name is in the list.
5689                                   items:
5690                                     type: string
5691                                   type: array
5692                                 selector:
5693                                   description: Selector is an optional field that restricts
5694                                     the rule to only apply to traffic that originates
5695                                     from (or terminates at) a pod running as a service
5696                                     account that matches the given label selector. If
5697                                     both Names and Selector are specified then they are
5698                                     AND'ed.
5699                                   type: string
5700                               type: object
5701                             services:
5702                               description: "Services is an optional field that contains
5703                                 options for matching Kubernetes Services. If specified,
5704                                 only traffic that originates from or terminates at endpoints
5705                                 within the selected service(s) will be matched, and only
5706                                 to/from each endpoint's port. \n Services cannot be specified
5707                                 on the same rule as Selector, NotSelector, NamespaceSelector,
5708                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
5709                                 can only be specified with Services on ingress rules."
5710                               properties:
5711                                 name:
5712                                   description: Name specifies the name of a Kubernetes
5713                                     Service to match.
5714                                   type: string
5715                                 namespace:
5716                                   description: Namespace specifies the namespace of the
5717                                     given Service. If left empty, the rule will match
5718                                     within this policy's namespace.
5719                                   type: string
5720                               type: object
5721                           type: object
5722                         http:
5723                           description: HTTP contains match criteria that apply to HTTP
5724                             requests.
5725                           properties:
5726                             methods:
5727                               description: Methods is an optional field that restricts
5728                                 the rule to apply only to HTTP requests that use one of
5729                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
5730                                 methods are OR'd together.
5731                               items:
5732                                 type: string
5733                               type: array
5734                             paths:
5735                               description: 'Paths is an optional field that restricts
5736                                 the rule to apply to HTTP requests that use one of the
5737                                 listed HTTP Paths. Multiple paths are OR''d together.
5738                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
5739                                 ONLY specify either a `exact` or a `prefix` match. The
5740                                 validator will check for it.'
5741                               items:
5742                                 description: 'HTTPPath specifies an HTTP path to match.
5743                                   It may be either of the form: exact: <path>: which matches
5744                                   the path exactly or prefix: <path-prefix>: which matches
5745                                   the path prefix'
5746                                 properties:
5747                                   exact:
5748                                     type: string
5749                                   prefix:
5750                                     type: string
5751                                 type: object
5752                               type: array
5753                           type: object
5754                         icmp:
5755                           description: ICMP is an optional field that restricts the rule
5756                             to apply to a specific type and code of ICMP traffic.  This
5757                             should only be specified if the Protocol field is set to "ICMP"
5758                             or "ICMPv6".
5759                           properties:
5760                             code:
5761                               description: Match on a specific ICMP code.  If specified,
5762                                 the Type value must also be specified. This is a technical
5763                                 limitation imposed by the kernel's iptables firewall,
5764                                 which Calico uses to enforce the rule.
5765                               type: integer
5766                             type:
5767                               description: Match on a specific ICMP type.  For example
5768                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
5769                               type: integer
5770                           type: object
5771                         ipVersion:
5772                           description: IPVersion is an optional field that restricts the
5773                             rule to only match a specific IP version.
5774                           type: integer
5775                         metadata:
5776                           description: Metadata contains additional information for this
5777                             rule
5778                           properties:
5779                             annotations:
5780                               additionalProperties:
5781                                 type: string
5782                               description: Annotations is a set of key value pairs that
5783                                 give extra information about the rule
5784                               type: object
5785                           type: object
5786                         notICMP:
5787                           description: NotICMP is the negated version of the ICMP field.
5788                           properties:
5789                             code:
5790                               description: Match on a specific ICMP code.  If specified,
5791                                 the Type value must also be specified. This is a technical
5792                                 limitation imposed by the kernel's iptables firewall,
5793                                 which Calico uses to enforce the rule.
5794                               type: integer
5795                             type:
5796                               description: Match on a specific ICMP type.  For example
5797                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
5798                               type: integer
5799                           type: object
5800                         notProtocol:
5801                           anyOf:
5802                           - type: integer
5803                           - type: string
5804                           description: NotProtocol is the negated version of the Protocol
5805                             field.
5806                           pattern: ^.*
5807                           x-kubernetes-int-or-string: true
5808                         protocol:
5809                           anyOf:
5810                           - type: integer
5811                           - type: string
5812                           description: "Protocol is an optional field that restricts the
5813                             rule to only apply to traffic of a specific IP protocol. Required
5814                             if any of the EntityRules contain Ports (because ports only
5815                             apply to certain protocols). \n Must be one of these string
5816                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
5817                             \"UDPLite\" or an integer in the range 1-255."
5818                           pattern: ^.*
5819                           x-kubernetes-int-or-string: true
5820                         source:
5821                           description: Source contains the match criteria that apply to
5822                             source entity.
5823                           properties:
5824                             namespaceSelector:
5825                               description: "NamespaceSelector is an optional field that
5826                                 contains a selector expression. Only traffic that originates
5827                                 from (or terminates at) endpoints within the selected
5828                                 namespaces will be matched. When both NamespaceSelector
5829                                 and another selector are defined on the same rule, then
5830                                 only workload endpoints that are matched by both selectors
5831                                 will be selected by the rule. \n For NetworkPolicy, an
5832                                 empty NamespaceSelector implies that the Selector is limited
5833                                 to selecting only workload endpoints in the same namespace
5834                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
5835                                 NamespaceSelector implies that the Selector is limited
5836                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
5837                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
5838                                 the Selector applies to workload endpoints across all
5839                                 namespaces."
5840                               type: string
5841                             nets:
5842                               description: Nets is an optional field that restricts the
5843                                 rule to only apply to traffic that originates from (or
5844                                 terminates at) IP addresses in any of the given subnets.
5845                               items:
5846                                 type: string
5847                               type: array
5848                             notNets:
5849                               description: NotNets is the negated version of the Nets
5850                                 field.
5851                               items:
5852                                 type: string
5853                               type: array
5854                             notPorts:
5855                               description: NotPorts is the negated version of the Ports
5856                                 field. Since only some protocols have ports, if any ports
5857                                 are specified it requires the Protocol match in the Rule
5858                                 to be set to "TCP" or "UDP".
5859                               items:
5860                                 anyOf:
5861                                 - type: integer
5862                                 - type: string
5863                                 pattern: ^.*
5864                                 x-kubernetes-int-or-string: true
5865                               type: array
5866                             notSelector:
5867                               description: NotSelector is the negated version of the Selector
5868                                 field.  See Selector field for subtleties with negated
5869                                 selectors.
5870                               type: string
5871                             ports:
5872                               description: "Ports is an optional field that restricts
5873                                 the rule to only apply to traffic that has a source (destination)
5874                                 port that matches one of these ranges/values. This value
5875                                 is a list of integers or strings that represent ranges
5876                                 of ports. \n Since only some protocols have ports, if
5877                                 any ports are specified it requires the Protocol match
5878                                 in the Rule to be set to \"TCP\" or \"UDP\"."
5879                               items:
5880                                 anyOf:
5881                                 - type: integer
5882                                 - type: string
5883                                 pattern: ^.*
5884                                 x-kubernetes-int-or-string: true
5885                               type: array
5886                             selector:
5887                               description: "Selector is an optional field that contains
5888                                 a selector expression (see Policy for sample syntax).
5889                                 \ Only traffic that originates from (terminates at) endpoints
5890                                 matching the selector will be matched. \n Note that: in
5891                                 addition to the negated version of the Selector (see NotSelector
5892                                 below), the selector expression syntax itself supports
5893                                 negation.  The two types of negation are subtly different.
5894                                 One negates the set of matched endpoints, the other negates
5895                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
5896                                 packets that are from other Calico-controlled \tendpoints
5897                                 that do not have the label \"my_label\". \n \tNotSelector
5898                                 = \"has(my_label)\" matches packets that are not from
5899                                 Calico-controlled \tendpoints that do have the label \"my_label\".
5900                                 \n The effect is that the latter will accept packets from
5901                                 non-Calico sources whereas the former is limited to packets
5902                                 from Calico-controlled endpoints."
5903                               type: string
5904                             serviceAccounts:
5905                               description: ServiceAccounts is an optional field that restricts
5906                                 the rule to only apply to traffic that originates from
5907                                 (or terminates at) a pod running as a matching service
5908                                 account.
5909                               properties:
5910                                 names:
5911                                   description: Names is an optional field that restricts
5912                                     the rule to only apply to traffic that originates
5913                                     from (or terminates at) a pod running as a service
5914                                     account whose name is in the list.
5915                                   items:
5916                                     type: string
5917                                   type: array
5918                                 selector:
5919                                   description: Selector is an optional field that restricts
5920                                     the rule to only apply to traffic that originates
5921                                     from (or terminates at) a pod running as a service
5922                                     account that matches the given label selector. If
5923                                     both Names and Selector are specified then they are
5924                                     AND'ed.
5925                                   type: string
5926                               type: object
5927                             services:
5928                               description: "Services is an optional field that contains
5929                                 options for matching Kubernetes Services. If specified,
5930                                 only traffic that originates from or terminates at endpoints
5931                                 within the selected service(s) will be matched, and only
5932                                 to/from each endpoint's port. \n Services cannot be specified
5933                                 on the same rule as Selector, NotSelector, NamespaceSelector,
5934                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
5935                                 can only be specified with Services on ingress rules."
5936                               properties:
5937                                 name:
5938                                   description: Name specifies the name of a Kubernetes
5939                                     Service to match.
5940                                   type: string
5941                                 namespace:
5942                                   description: Namespace specifies the namespace of the
5943                                     given Service. If left empty, the rule will match
5944                                     within this policy's namespace.
5945                                   type: string
5946                               type: object
5947                           type: object
5948                       required:
5949                       - action
5950                       type: object
5951                     type: array
5952                   ingress:
5953                     description: The ordered set of ingress rules.  Each rule contains
5954                       a set of packet match criteria and a corresponding action to apply.
5955                     items:
5956                       description: "A Rule encapsulates a set of match criteria and an
5957                         action.  Both selector-based security Policy and security Profiles
5958                         reference rules - separated out as a list of rules for both ingress
5959                         and egress packet matching. \n Each positive match criteria has
5960                         a negated version, prefixed with \"Not\". All the match criteria
5961                         within a rule must be satisfied for a packet to match. A single
5962                         rule can contain the positive and negative version of a match
5963                         and both must be satisfied for the rule to match."
5964                       properties:
5965                         action:
5966                           type: string
5967                         destination:
5968                           description: Destination contains the match criteria that apply
5969                             to destination entity.
5970                           properties:
5971                             namespaceSelector:
5972                               description: "NamespaceSelector is an optional field that
5973                                 contains a selector expression. Only traffic that originates
5974                                 from (or terminates at) endpoints within the selected
5975                                 namespaces will be matched. When both NamespaceSelector
5976                                 and another selector are defined on the same rule, then
5977                                 only workload endpoints that are matched by both selectors
5978                                 will be selected by the rule. \n For NetworkPolicy, an
5979                                 empty NamespaceSelector implies that the Selector is limited
5980                                 to selecting only workload endpoints in the same namespace
5981                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
5982                                 NamespaceSelector implies that the Selector is limited
5983                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
5984                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
5985                                 the Selector applies to workload endpoints across all
5986                                 namespaces."
5987                               type: string
5988                             nets:
5989                               description: Nets is an optional field that restricts the
5990                                 rule to only apply to traffic that originates from (or
5991                                 terminates at) IP addresses in any of the given subnets.
5992                               items:
5993                                 type: string
5994                               type: array
5995                             notNets:
5996                               description: NotNets is the negated version of the Nets
5997                                 field.
5998                               items:
5999                                 type: string
6000                               type: array
6001                             notPorts:
6002                               description: NotPorts is the negated version of the Ports
6003                                 field. Since only some protocols have ports, if any ports
6004                                 are specified it requires the Protocol match in the Rule
6005                                 to be set to "TCP" or "UDP".
6006                               items:
6007                                 anyOf:
6008                                 - type: integer
6009                                 - type: string
6010                                 pattern: ^.*
6011                                 x-kubernetes-int-or-string: true
6012                               type: array
6013                             notSelector:
6014                               description: NotSelector is the negated version of the Selector
6015                                 field.  See Selector field for subtleties with negated
6016                                 selectors.
6017                               type: string
6018                             ports:
6019                               description: "Ports is an optional field that restricts
6020                                 the rule to only apply to traffic that has a source (destination)
6021                                 port that matches one of these ranges/values. This value
6022                                 is a list of integers or strings that represent ranges
6023                                 of ports. \n Since only some protocols have ports, if
6024                                 any ports are specified it requires the Protocol match
6025                                 in the Rule to be set to \"TCP\" or \"UDP\"."
6026                               items:
6027                                 anyOf:
6028                                 - type: integer
6029                                 - type: string
6030                                 pattern: ^.*
6031                                 x-kubernetes-int-or-string: true
6032                               type: array
6033                             selector:
6034                               description: "Selector is an optional field that contains
6035                                 a selector expression (see Policy for sample syntax).
6036                                 \ Only traffic that originates from (terminates at) endpoints
6037                                 matching the selector will be matched. \n Note that: in
6038                                 addition to the negated version of the Selector (see NotSelector
6039                                 below), the selector expression syntax itself supports
6040                                 negation.  The two types of negation are subtly different.
6041                                 One negates the set of matched endpoints, the other negates
6042                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
6043                                 packets that are from other Calico-controlled \tendpoints
6044                                 that do not have the label \"my_label\". \n \tNotSelector
6045                                 = \"has(my_label)\" matches packets that are not from
6046                                 Calico-controlled \tendpoints that do have the label \"my_label\".
6047                                 \n The effect is that the latter will accept packets from
6048                                 non-Calico sources whereas the former is limited to packets
6049                                 from Calico-controlled endpoints."
6050                               type: string
6051                             serviceAccounts:
6052                               description: ServiceAccounts is an optional field that restricts
6053                                 the rule to only apply to traffic that originates from
6054                                 (or terminates at) a pod running as a matching service
6055                                 account.
6056                               properties:
6057                                 names:
6058                                   description: Names is an optional field that restricts
6059                                     the rule to only apply to traffic that originates
6060                                     from (or terminates at) a pod running as a service
6061                                     account whose name is in the list.
6062                                   items:
6063                                     type: string
6064                                   type: array
6065                                 selector:
6066                                   description: Selector is an optional field that restricts
6067                                     the rule to only apply to traffic that originates
6068                                     from (or terminates at) a pod running as a service
6069                                     account that matches the given label selector. If
6070                                     both Names and Selector are specified then they are
6071                                     AND'ed.
6072                                   type: string
6073                               type: object
6074                             services:
6075                               description: "Services is an optional field that contains
6076                                 options for matching Kubernetes Services. If specified,
6077                                 only traffic that originates from or terminates at endpoints
6078                                 within the selected service(s) will be matched, and only
6079                                 to/from each endpoint's port. \n Services cannot be specified
6080                                 on the same rule as Selector, NotSelector, NamespaceSelector,
6081                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
6082                                 can only be specified with Services on ingress rules."
6083                               properties:
6084                                 name:
6085                                   description: Name specifies the name of a Kubernetes
6086                                     Service to match.
6087                                   type: string
6088                                 namespace:
6089                                   description: Namespace specifies the namespace of the
6090                                     given Service. If left empty, the rule will match
6091                                     within this policy's namespace.
6092                                   type: string
6093                               type: object
6094                           type: object
6095                         http:
6096                           description: HTTP contains match criteria that apply to HTTP
6097                             requests.
6098                           properties:
6099                             methods:
6100                               description: Methods is an optional field that restricts
6101                                 the rule to apply only to HTTP requests that use one of
6102                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
6103                                 methods are OR'd together.
6104                               items:
6105                                 type: string
6106                               type: array
6107                             paths:
6108                               description: 'Paths is an optional field that restricts
6109                                 the rule to apply to HTTP requests that use one of the
6110                                 listed HTTP Paths. Multiple paths are OR''d together.
6111                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
6112                                 ONLY specify either a `exact` or a `prefix` match. The
6113                                 validator will check for it.'
6114                               items:
6115                                 description: 'HTTPPath specifies an HTTP path to match.
6116                                   It may be either of the form: exact: <path>: which matches
6117                                   the path exactly or prefix: <path-prefix>: which matches
6118                                   the path prefix'
6119                                 properties:
6120                                   exact:
6121                                     type: string
6122                                   prefix:
6123                                     type: string
6124                                 type: object
6125                               type: array
6126                           type: object
6127                         icmp:
6128                           description: ICMP is an optional field that restricts the rule
6129                             to apply to a specific type and code of ICMP traffic.  This
6130                             should only be specified if the Protocol field is set to "ICMP"
6131                             or "ICMPv6".
6132                           properties:
6133                             code:
6134                               description: Match on a specific ICMP code.  If specified,
6135                                 the Type value must also be specified. This is a technical
6136                                 limitation imposed by the kernel's iptables firewall,
6137                                 which Calico uses to enforce the rule.
6138                               type: integer
6139                             type:
6140                               description: Match on a specific ICMP type.  For example
6141                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
6142                               type: integer
6143                           type: object
6144                         ipVersion:
6145                           description: IPVersion is an optional field that restricts the
6146                             rule to only match a specific IP version.
6147                           type: integer
6148                         metadata:
6149                           description: Metadata contains additional information for this
6150                             rule
6151                           properties:
6152                             annotations:
6153                               additionalProperties:
6154                                 type: string
6155                               description: Annotations is a set of key value pairs that
6156                                 give extra information about the rule
6157                               type: object
6158                           type: object
6159                         notICMP:
6160                           description: NotICMP is the negated version of the ICMP field.
6161                           properties:
6162                             code:
6163                               description: Match on a specific ICMP code.  If specified,
6164                                 the Type value must also be specified. This is a technical
6165                                 limitation imposed by the kernel's iptables firewall,
6166                                 which Calico uses to enforce the rule.
6167                               type: integer
6168                             type:
6169                               description: Match on a specific ICMP type.  For example
6170                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
6171                               type: integer
6172                           type: object
6173                         notProtocol:
6174                           anyOf:
6175                           - type: integer
6176                           - type: string
6177                           description: NotProtocol is the negated version of the Protocol
6178                             field.
6179                           pattern: ^.*
6180                           x-kubernetes-int-or-string: true
6181                         protocol:
6182                           anyOf:
6183                           - type: integer
6184                           - type: string
6185                           description: "Protocol is an optional field that restricts the
6186                             rule to only apply to traffic of a specific IP protocol. Required
6187                             if any of the EntityRules contain Ports (because ports only
6188                             apply to certain protocols). \n Must be one of these string
6189                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
6190                             \"UDPLite\" or an integer in the range 1-255."
6191                           pattern: ^.*
6192                           x-kubernetes-int-or-string: true
6193                         source:
6194                           description: Source contains the match criteria that apply to
6195                             source entity.
6196                           properties:
6197                             namespaceSelector:
6198                               description: "NamespaceSelector is an optional field that
6199                                 contains a selector expression. Only traffic that originates
6200                                 from (or terminates at) endpoints within the selected
6201                                 namespaces will be matched. When both NamespaceSelector
6202                                 and another selector are defined on the same rule, then
6203                                 only workload endpoints that are matched by both selectors
6204                                 will be selected by the rule. \n For NetworkPolicy, an
6205                                 empty NamespaceSelector implies that the Selector is limited
6206                                 to selecting only workload endpoints in the same namespace
6207                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
6208                                 NamespaceSelector implies that the Selector is limited
6209                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
6210                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
6211                                 the Selector applies to workload endpoints across all
6212                                 namespaces."
6213                               type: string
6214                             nets:
6215                               description: Nets is an optional field that restricts the
6216                                 rule to only apply to traffic that originates from (or
6217                                 terminates at) IP addresses in any of the given subnets.
6218                               items:
6219                                 type: string
6220                               type: array
6221                             notNets:
6222                               description: NotNets is the negated version of the Nets
6223                                 field.
6224                               items:
6225                                 type: string
6226                               type: array
6227                             notPorts:
6228                               description: NotPorts is the negated version of the Ports
6229                                 field. Since only some protocols have ports, if any ports
6230                                 are specified it requires the Protocol match in the Rule
6231                                 to be set to "TCP" or "UDP".
6232                               items:
6233                                 anyOf:
6234                                 - type: integer
6235                                 - type: string
6236                                 pattern: ^.*
6237                                 x-kubernetes-int-or-string: true
6238                               type: array
6239                             notSelector:
6240                               description: NotSelector is the negated version of the Selector
6241                                 field.  See Selector field for subtleties with negated
6242                                 selectors.
6243                               type: string
6244                             ports:
6245                               description: "Ports is an optional field that restricts
6246                                 the rule to only apply to traffic that has a source (destination)
6247                                 port that matches one of these ranges/values. This value
6248                                 is a list of integers or strings that represent ranges
6249                                 of ports. \n Since only some protocols have ports, if
6250                                 any ports are specified it requires the Protocol match
6251                                 in the Rule to be set to \"TCP\" or \"UDP\"."
6252                               items:
6253                                 anyOf:
6254                                 - type: integer
6255                                 - type: string
6256                                 pattern: ^.*
6257                                 x-kubernetes-int-or-string: true
6258                               type: array
6259                             selector:
6260                               description: "Selector is an optional field that contains
6261                                 a selector expression (see Policy for sample syntax).
6262                                 \ Only traffic that originates from (terminates at) endpoints
6263                                 matching the selector will be matched. \n Note that: in
6264                                 addition to the negated version of the Selector (see NotSelector
6265                                 below), the selector expression syntax itself supports
6266                                 negation.  The two types of negation are subtly different.
6267                                 One negates the set of matched endpoints, the other negates
6268                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
6269                                 packets that are from other Calico-controlled \tendpoints
6270                                 that do not have the label \"my_label\". \n \tNotSelector
6271                                 = \"has(my_label)\" matches packets that are not from
6272                                 Calico-controlled \tendpoints that do have the label \"my_label\".
6273                                 \n The effect is that the latter will accept packets from
6274                                 non-Calico sources whereas the former is limited to packets
6275                                 from Calico-controlled endpoints."
6276                               type: string
6277                             serviceAccounts:
6278                               description: ServiceAccounts is an optional field that restricts
6279                                 the rule to only apply to traffic that originates from
6280                                 (or terminates at) a pod running as a matching service
6281                                 account.
6282                               properties:
6283                                 names:
6284                                   description: Names is an optional field that restricts
6285                                     the rule to only apply to traffic that originates
6286                                     from (or terminates at) a pod running as a service
6287                                     account whose name is in the list.
6288                                   items:
6289                                     type: string
6290                                   type: array
6291                                 selector:
6292                                   description: Selector is an optional field that restricts
6293                                     the rule to only apply to traffic that originates
6294                                     from (or terminates at) a pod running as a service
6295                                     account that matches the given label selector. If
6296                                     both Names and Selector are specified then they are
6297                                     AND'ed.
6298                                   type: string
6299                               type: object
6300                             services:
6301                               description: "Services is an optional field that contains
6302                                 options for matching Kubernetes Services. If specified,
6303                                 only traffic that originates from or terminates at endpoints
6304                                 within the selected service(s) will be matched, and only
6305                                 to/from each endpoint's port. \n Services cannot be specified
6306                                 on the same rule as Selector, NotSelector, NamespaceSelector,
6307                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
6308                                 can only be specified with Services on ingress rules."
6309                               properties:
6310                                 name:
6311                                   description: Name specifies the name of a Kubernetes
6312                                     Service to match.
6313                                   type: string
6314                                 namespace:
6315                                   description: Namespace specifies the namespace of the
6316                                     given Service. If left empty, the rule will match
6317                                     within this policy's namespace.
6318                                   type: string
6319                               type: object
6320                           type: object
6321                       required:
6322                       - action
6323                       type: object
6324                     type: array
6325                   namespaceSelector:
6326                     description: NamespaceSelector is an optional field for an expression
6327                       used to select a pod based on namespaces.
6328                     type: string
6329                   order:
6330                     description: Order is an optional field that specifies the order in
6331                       which the policy is applied. Policies with higher "order" are applied
6332                       after those with lower order.  If the order is omitted, it may be
6333                       considered to be "infinite" - i.e. the policy will be applied last.  Policies
6334                       with identical order will be applied in alphanumerical order based
6335                       on the Policy "Name".
6336                     type: number
6337                   preDNAT:
6338                     description: PreDNAT indicates to apply the rules in this policy before
6339                       any DNAT.
6340                     type: boolean
6341                   selector:
6342                     description: "The selector is an expression used to pick pick out
6343                       the endpoints that the policy should be applied to. \n Selector
6344                       expressions follow this syntax: \n \tlabel == \"string_literal\"
6345                       \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
6346                       \  ->  not equal; also matches if label is not present \tlabel in
6347                       { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
6348                       one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
6349                       ... }  ->  true if the value of label X is not one of \"a\", \"b\",
6350                       \"c\" \thas(label_name)  -> True if that label is present \t! expr
6351                       -> negation of expr \texpr && expr  -> Short-circuit and \texpr
6352                       || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
6353                       or the empty selector -> matches all endpoints. \n Label names are
6354                       allowed to contain alphanumerics, -, _ and /. String literals are
6355                       more permissive but they do not support escape characters. \n Examples
6356                       (with made-up labels): \n \ttype == \"webserver\" && deployment
6357                       == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
6358                       \"dev\" \t! has(label_name)"
6359                     type: string
6360                   serviceAccountSelector:
6361                     description: ServiceAccountSelector is an optional field for an expression
6362                       used to select a pod based on service accounts.
6363                     type: string
6364                   types:
6365                     description: "Types indicates whether this policy applies to ingress,
6366                       or to egress, or to both.  When not explicitly specified (and so
6367                       the value on creation is empty or nil), Calico defaults Types according
6368                       to what Ingress and Egress rules are present in the policy.  The
6369                       default is: \n - [ PolicyTypeIngress ], if there are no Egress rules
6370                       (including the case where there are   also no Ingress rules) \n
6371                       - [ PolicyTypeEgress ], if there are Egress rules but no Ingress
6372                       rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are
6373                       both Ingress and Egress rules. \n When the policy is read back again,
6374                       Types will always be one of these values, never empty or nil."
6375                     items:
6376                       description: PolicyType enumerates the possible values of the PolicySpec
6377                         Types field.
6378                       type: string
6379                     type: array
6380                 type: object
6381             type: object
6382         served: true
6383         storage: true
6384     status:
6385       acceptedNames:
6386         kind: ""
6387         plural: ""
6388       conditions: []
6389       storedVersions: []
6390     ---
6391     apiVersion: apiextensions.k8s.io/v1
6392     kind: CustomResourceDefinition
6393     metadata:
6394       name: globalnetworksets.crd.projectcalico.org
6395     spec:
6396       group: crd.projectcalico.org
6397       names:
6398         kind: GlobalNetworkSet
6399         listKind: GlobalNetworkSetList
6400         plural: globalnetworksets
6401         singular: globalnetworkset
6402       scope: Cluster
6403       versions:
6404       - name: v1
6405         schema:
6406           openAPIV3Schema:
6407             description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
6408               that share labels to allow rules to refer to them via selectors.  The labels
6409               of GlobalNetworkSet are not namespaced.
6410             properties:
6411               apiVersion:
6412                 description: 'APIVersion defines the versioned schema of this representation
6413                   of an object. Servers should convert recognized schemas to the latest
6414                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
6415                 type: string
6416               kind:
6417                 description: 'Kind is a string value representing the REST resource this
6418                   object represents. Servers may infer this from the endpoint the client
6419                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
6420                 type: string
6421               metadata:
6422                 type: object
6423               spec:
6424                 description: GlobalNetworkSetSpec contains the specification for a NetworkSet
6425                   resource.
6426                 properties:
6427                   nets:
6428                     description: The list of IP networks that belong to this set.
6429                     items:
6430                       type: string
6431                     type: array
6432                 type: object
6433             type: object
6434         served: true
6435         storage: true
6436     status:
6437       acceptedNames:
6438         kind: ""
6439         plural: ""
6440       conditions: []
6441       storedVersions: []
6442     ---
6443     apiVersion: apiextensions.k8s.io/v1
6444     kind: CustomResourceDefinition
6445     metadata:
6446       name: hostendpoints.crd.projectcalico.org
6447     spec:
6448       group: crd.projectcalico.org
6449       names:
6450         kind: HostEndpoint
6451         listKind: HostEndpointList
6452         plural: hostendpoints
6453         singular: hostendpoint
6454       scope: Cluster
6455       versions:
6456       - name: v1
6457         schema:
6458           openAPIV3Schema:
6459             properties:
6460               apiVersion:
6461                 description: 'APIVersion defines the versioned schema of this representation
6462                   of an object. Servers should convert recognized schemas to the latest
6463                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
6464                 type: string
6465               kind:
6466                 description: 'Kind is a string value representing the REST resource this
6467                   object represents. Servers may infer this from the endpoint the client
6468                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
6469                 type: string
6470               metadata:
6471                 type: object
6472               spec:
6473                 description: HostEndpointSpec contains the specification for a HostEndpoint
6474                   resource.
6475                 properties:
6476                   expectedIPs:
6477                     description: "The expected IP addresses (IPv4 and IPv6) of the endpoint.
6478                       If \"InterfaceName\" is not present, Calico will look for an interface
6479                       matching any of the IPs in the list and apply policy to that. Note:
6480                       \tWhen using the selector match criteria in an ingress or egress
6481                       security Policy \tor Profile, Calico converts the selector into
6482                       a set of IP addresses. For host \tendpoints, the ExpectedIPs field
6483                       is used for that purpose. (If only the interface \tname is specified,
6484                       Calico does not learn the IPs of the interface for use in match
6485                       \tcriteria.)"
6486                     items:
6487                       type: string
6488                     type: array
6489                   interfaceName:
6490                     description: "Either \"*\", or the name of a specific Linux interface
6491                       to apply policy to; or empty.  \"*\" indicates that this HostEndpoint
6492                       governs all traffic to, from or through the default network namespace
6493                       of the host named by the \"Node\" field; entering and leaving that
6494                       namespace via any interface, including those from/to non-host-networked
6495                       local workloads. \n If InterfaceName is not \"*\", this HostEndpoint
6496                       only governs traffic that enters or leaves the host through the
6497                       specific interface named by InterfaceName, or - when InterfaceName
6498                       is empty - through the specific interface that has one of the IPs
6499                       in ExpectedIPs. Therefore, when InterfaceName is empty, at least
6500                       one expected IP must be specified.  Only external interfaces (such
6501                       as \"eth0\") are supported here; it isn't possible for a HostEndpoint
6502                       to protect traffic through a specific local workload interface.
6503                       \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
6504                       initially just pre-DNAT policy.  Please check Calico documentation
6505                       for the latest position."
6506                     type: string
6507                   node:
6508                     description: The node name identifying the Calico node instance.
6509                     type: string
6510                   ports:
6511                     description: Ports contains the endpoint's named ports, which may
6512                       be referenced in security policy rules.
6513                     items:
6514                       properties:
6515                         name:
6516                           type: string
6517                         port:
6518                           type: integer
6519                         protocol:
6520                           anyOf:
6521                           - type: integer
6522                           - type: string
6523                           pattern: ^.*
6524                           x-kubernetes-int-or-string: true
6525                       required:
6526                       - name
6527                       - port
6528                       - protocol
6529                       type: object
6530                     type: array
6531                   profiles:
6532                     description: A list of identifiers of security Profile objects that
6533                       apply to this endpoint. Each profile is applied in the order that
6534                       they appear in this list.  Profile rules are applied after the selector-based
6535                       security policy.
6536                     items:
6537                       type: string
6538                     type: array
6539                 type: object
6540             type: object
6541         served: true
6542         storage: true
6543     status:
6544       acceptedNames:
6545         kind: ""
6546         plural: ""
6547       conditions: []
6548       storedVersions: []
6549     ---
6550     apiVersion: apiextensions.k8s.io/v1
6551     kind: CustomResourceDefinition
6552     metadata:
6553       name: ipamblocks.crd.projectcalico.org
6554     spec:
6555       group: crd.projectcalico.org
6556       names:
6557         kind: IPAMBlock
6558         listKind: IPAMBlockList
6559         plural: ipamblocks
6560         singular: ipamblock
6561       scope: Cluster
6562       versions:
6563       - name: v1
6564         schema:
6565           openAPIV3Schema:
6566             properties:
6567               apiVersion:
6568                 description: 'APIVersion defines the versioned schema of this representation
6569                   of an object. Servers should convert recognized schemas to the latest
6570                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
6571                 type: string
6572               kind:
6573                 description: 'Kind is a string value representing the REST resource this
6574                   object represents. Servers may infer this from the endpoint the client
6575                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
6576                 type: string
6577               metadata:
6578                 type: object
6579               spec:
6580                 description: IPAMBlockSpec contains the specification for an IPAMBlock
6581                   resource.
6582                 properties:
6583                   affinity:
6584                     type: string
6585                   allocations:
6586                     items:
6587                       nullable: true
6588                       type: integer
6589                     type: array
6590                   attributes:
6591                     items:
6592                       properties:
6593                         handle_id:
6594                           type: string
6595                         secondary:
6596                           additionalProperties:
6597                             type: string
6598                           type: object
6599                       type: object
6600                     type: array
6601                   cidr:
6602                     type: string
6603                   deleted:
6604                     type: boolean
6605                   strictAffinity:
6606                     type: boolean
6607                   unallocated:
6608                     items:
6609                       type: integer
6610                     type: array
6611                 required:
6612                 - allocations
6613                 - attributes
6614                 - cidr
6615                 - strictAffinity
6616                 - unallocated
6617                 type: object
6618             type: object
6619         served: true
6620         storage: true
6621     status:
6622       acceptedNames:
6623         kind: ""
6624         plural: ""
6625       conditions: []
6626       storedVersions: []
6627     ---
6628     apiVersion: apiextensions.k8s.io/v1
6629     kind: CustomResourceDefinition
6630     metadata:
6631       name: ipamconfigs.crd.projectcalico.org
6632     spec:
6633       group: crd.projectcalico.org
6634       names:
6635         kind: IPAMConfig
6636         listKind: IPAMConfigList
6637         plural: ipamconfigs
6638         singular: ipamconfig
6639       scope: Cluster
6640       versions:
6641       - name: v1
6642         schema:
6643           openAPIV3Schema:
6644             properties:
6645               apiVersion:
6646                 description: 'APIVersion defines the versioned schema of this representation
6647                   of an object. Servers should convert recognized schemas to the latest
6648                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
6649                 type: string
6650               kind:
6651                 description: 'Kind is a string value representing the REST resource this
6652                   object represents. Servers may infer this from the endpoint the client
6653                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
6654                 type: string
6655               metadata:
6656                 type: object
6657               spec:
6658                 description: IPAMConfigSpec contains the specification for an IPAMConfig
6659                   resource.
6660                 properties:
6661                   autoAllocateBlocks:
6662                     type: boolean
6663                   maxBlocksPerHost:
6664                     description: MaxBlocksPerHost, if non-zero, is the max number of blocks
6665                       that can be affine to each host.
6666                     type: integer
6667                   strictAffinity:
6668                     type: boolean
6669                 required:
6670                 - autoAllocateBlocks
6671                 - strictAffinity
6672                 type: object
6673             type: object
6674         served: true
6675         storage: true
6676     status:
6677       acceptedNames:
6678         kind: ""
6679         plural: ""
6680       conditions: []
6681       storedVersions: []
6682     ---
6683     apiVersion: apiextensions.k8s.io/v1
6684     kind: CustomResourceDefinition
6685     metadata:
6686       name: ipamhandles.crd.projectcalico.org
6687     spec:
6688       group: crd.projectcalico.org
6689       names:
6690         kind: IPAMHandle
6691         listKind: IPAMHandleList
6692         plural: ipamhandles
6693         singular: ipamhandle
6694       scope: Cluster
6695       versions:
6696       - name: v1
6697         schema:
6698           openAPIV3Schema:
6699             properties:
6700               apiVersion:
6701                 description: 'APIVersion defines the versioned schema of this representation
6702                   of an object. Servers should convert recognized schemas to the latest
6703                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
6704                 type: string
6705               kind:
6706                 description: 'Kind is a string value representing the REST resource this
6707                   object represents. Servers may infer this from the endpoint the client
6708                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
6709                 type: string
6710               metadata:
6711                 type: object
6712               spec:
6713                 description: IPAMHandleSpec contains the specification for an IPAMHandle
6714                   resource.
6715                 properties:
6716                   block:
6717                     additionalProperties:
6718                       type: integer
6719                     type: object
6720                   deleted:
6721                     type: boolean
6722                   handleID:
6723                     type: string
6724                 required:
6725                 - block
6726                 - handleID
6727                 type: object
6728             type: object
6729         served: true
6730         storage: true
6731     status:
6732       acceptedNames:
6733         kind: ""
6734         plural: ""
6735       conditions: []
6736       storedVersions: []
6737     ---
6738     apiVersion: apiextensions.k8s.io/v1
6739     kind: CustomResourceDefinition
6740     metadata:
6741       name: ippools.crd.projectcalico.org
6742     spec:
6743       group: crd.projectcalico.org
6744       names:
6745         kind: IPPool
6746         listKind: IPPoolList
6747         plural: ippools
6748         singular: ippool
6749       scope: Cluster
6750       versions:
6751       - name: v1
6752         schema:
6753           openAPIV3Schema:
6754             properties:
6755               apiVersion:
6756                 description: 'APIVersion defines the versioned schema of this representation
6757                   of an object. Servers should convert recognized schemas to the latest
6758                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
6759                 type: string
6760               kind:
6761                 description: 'Kind is a string value representing the REST resource this
6762                   object represents. Servers may infer this from the endpoint the client
6763                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
6764                 type: string
6765               metadata:
6766                 type: object
6767               spec:
6768                 description: IPPoolSpec contains the specification for an IPPool resource.
6769                 properties:
6770                   allowedUses:
6771                     description: AllowedUse controls what the IP pool will be used for.  If
6772                       not specified or empty, defaults to ["Tunnel", "Workload"] for back-compatibility
6773                     items:
6774                       type: string
6775                     type: array
6776                   blockSize:
6777                     description: The block size to use for IP address assignments from
6778                       this pool. Defaults to 26 for IPv4 and 112 for IPv6.
6779                     type: integer
6780                   cidr:
6781                     description: The pool CIDR.
6782                     type: string
6783                   disableBGPExport:
6784                     description: 'Disable exporting routes from this IP Pool''s CIDR over
6785                       BGP. [Default: false]'
6786                     type: boolean
6787                   disabled:
6788                     description: When disabled is true, Calico IPAM will not assign addresses
6789                       from this pool.
6790                     type: boolean
6791                   ipip:
6792                     description: 'Deprecated: this field is only used for APIv1 backwards
6793                       compatibility. Setting this field is not allowed, this field is
6794                       for internal use only.'
6795                     properties:
6796                       enabled:
6797                         description: When enabled is true, ipip tunneling will be used
6798                           to deliver packets to destinations within this pool.
6799                         type: boolean
6800                       mode:
6801                         description: The IPIP mode.  This can be one of "always" or "cross-subnet".  A
6802                           mode of "always" will also use IPIP tunneling for routing to
6803                           destination IP addresses within this pool.  A mode of "cross-subnet"
6804                           will only use IPIP tunneling when the destination node is on
6805                           a different subnet to the originating node.  The default value
6806                           (if not specified) is "always".
6807                         type: string
6808                     type: object
6809                   ipipMode:
6810                     description: Contains configuration for IPIP tunneling for this pool.
6811                       If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling
6812                       is disabled).
6813                     type: string
6814                   nat-outgoing:
6815                     description: 'Deprecated: this field is only used for APIv1 backwards
6816                       compatibility. Setting this field is not allowed, this field is
6817                       for internal use only.'
6818                     type: boolean
6819                   natOutgoing:
6820                     description: When nat-outgoing is true, packets sent from Calico networked
6821                       containers in this pool to destinations outside of this pool will
6822                       be masqueraded.
6823                     type: boolean
6824                   nodeSelector:
6825                     description: Allows IPPool to allocate for a specific node by label
6826                       selector.
6827                     type: string
6828                   vxlanMode:
6829                     description: Contains configuration for VXLAN tunneling for this pool.
6830                       If not specified, then this is defaulted to "Never" (i.e. VXLAN
6831                       tunneling is disabled).
6832                     type: string
6833                 required:
6834                 - cidr
6835                 type: object
6836             type: object
6837         served: true
6838         storage: true
6839     status:
6840       acceptedNames:
6841         kind: ""
6842         plural: ""
6843       conditions: []
6844       storedVersions: []
6845     ---
6846     apiVersion: apiextensions.k8s.io/v1
6847     kind: CustomResourceDefinition
6848     metadata:
6849       name: ipreservations.crd.projectcalico.org
6850     spec:
6851       group: crd.projectcalico.org
6852       names:
6853         kind: IPReservation
6854         listKind: IPReservationList
6855         plural: ipreservations
6856         singular: ipreservation
6857       scope: Cluster
6858       versions:
6859       - name: v1
6860         schema:
6861           openAPIV3Schema:
6862             properties:
6863               apiVersion:
6864                 description: 'APIVersion defines the versioned schema of this representation
6865                   of an object. Servers should convert recognized schemas to the latest
6866                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
6867                 type: string
6868               kind:
6869                 description: 'Kind is a string value representing the REST resource this
6870                   object represents. Servers may infer this from the endpoint the client
6871                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
6872                 type: string
6873               metadata:
6874                 type: object
6875               spec:
6876                 description: IPReservationSpec contains the specification for an IPReservation
6877                   resource.
6878                 properties:
6879                   reservedCIDRs:
6880                     description: ReservedCIDRs is a list of CIDRs and/or IP addresses
6881                       that Calico IPAM will exclude from new allocations.
6882                     items:
6883                       type: string
6884                     type: array
6885                 type: object
6886             type: object
6887         served: true
6888         storage: true
6889     status:
6890       acceptedNames:
6891         kind: ""
6892         plural: ""
6893       conditions: []
6894       storedVersions: []
6895     ---
6896     apiVersion: apiextensions.k8s.io/v1
6897     kind: CustomResourceDefinition
6898     metadata:
6899       name: kubecontrollersconfigurations.crd.projectcalico.org
6900     spec:
6901       group: crd.projectcalico.org
6902       names:
6903         kind: KubeControllersConfiguration
6904         listKind: KubeControllersConfigurationList
6905         plural: kubecontrollersconfigurations
6906         singular: kubecontrollersconfiguration
6907       scope: Cluster
6908       versions:
6909       - name: v1
6910         schema:
6911           openAPIV3Schema:
6912             properties:
6913               apiVersion:
6914                 description: 'APIVersion defines the versioned schema of this representation
6915                   of an object. Servers should convert recognized schemas to the latest
6916                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
6917                 type: string
6918               kind:
6919                 description: 'Kind is a string value representing the REST resource this
6920                   object represents. Servers may infer this from the endpoint the client
6921                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
6922                 type: string
6923               metadata:
6924                 type: object
6925               spec:
6926                 description: KubeControllersConfigurationSpec contains the values of the
6927                   Kubernetes controllers configuration.
6928                 properties:
6929                   controllers:
6930                     description: Controllers enables and configures individual Kubernetes
6931                       controllers
6932                     properties:
6933                       namespace:
6934                         description: Namespace enables and configures the namespace controller.
6935                           Enabled by default, set to nil to disable.
6936                         properties:
6937                           reconcilerPeriod:
6938                             description: 'ReconcilerPeriod is the period to perform reconciliation
6939                               with the Calico datastore. [Default: 5m]'
6940                             type: string
6941                         type: object
6942                       node:
6943                         description: Node enables and configures the node controller.
6944                           Enabled by default, set to nil to disable.
6945                         properties:
6946                           hostEndpoint:
6947                             description: HostEndpoint controls syncing nodes to host endpoints.
6948                               Disabled by default, set to nil to disable.
6949                             properties:
6950                               autoCreate:
6951                                 description: 'AutoCreate enables automatic creation of
6952                                   host endpoints for every node. [Default: Disabled]'
6953                                 type: string
6954                             type: object
6955                           leakGracePeriod:
6956                             description: 'LeakGracePeriod is the period used by the controller
6957                               to determine if an IP address has been leaked. Set to 0
6958                               to disable IP garbage collection. [Default: 15m]'
6959                             type: string
6960                           reconcilerPeriod:
6961                             description: 'ReconcilerPeriod is the period to perform reconciliation
6962                               with the Calico datastore. [Default: 5m]'
6963                             type: string
6964                           syncLabels:
6965                             description: 'SyncLabels controls whether to copy Kubernetes
6966                               node labels to Calico nodes. [Default: Enabled]'
6967                             type: string
6968                         type: object
6969                       policy:
6970                         description: Policy enables and configures the policy controller.
6971                           Enabled by default, set to nil to disable.
6972                         properties:
6973                           reconcilerPeriod:
6974                             description: 'ReconcilerPeriod is the period to perform reconciliation
6975                               with the Calico datastore. [Default: 5m]'
6976                             type: string
6977                         type: object
6978                       serviceAccount:
6979                         description: ServiceAccount enables and configures the service
6980                           account controller. Enabled by default, set to nil to disable.
6981                         properties:
6982                           reconcilerPeriod:
6983                             description: 'ReconcilerPeriod is the period to perform reconciliation
6984                               with the Calico datastore. [Default: 5m]'
6985                             type: string
6986                         type: object
6987                       workloadEndpoint:
6988                         description: WorkloadEndpoint enables and configures the workload
6989                           endpoint controller. Enabled by default, set to nil to disable.
6990                         properties:
6991                           reconcilerPeriod:
6992                             description: 'ReconcilerPeriod is the period to perform reconciliation
6993                               with the Calico datastore. [Default: 5m]'
6994                             type: string
6995                         type: object
6996                     type: object
6997                   etcdV3CompactionPeriod:
6998                     description: 'EtcdV3CompactionPeriod is the period between etcdv3
6999                       compaction requests. Set to 0 to disable. [Default: 10m]'
7000                     type: string
7001                   healthChecks:
7002                     description: 'HealthChecks enables or disables support for health
7003                       checks [Default: Enabled]'
7004                     type: string
7005                   logSeverityScreen:
7006                     description: 'LogSeverityScreen is the log severity above which logs
7007                       are sent to the stdout. [Default: Info]'
7008                     type: string
7009                   prometheusMetricsPort:
7010                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
7011                       metrics server should bind to. Set to 0 to disable. [Default: 9094]'
7012                     type: integer
7013                 required:
7014                 - controllers
7015                 type: object
7016               status:
7017                 description: KubeControllersConfigurationStatus represents the status
7018                   of the configuration. It's useful for admins to be able to see the actual
7019                   config that was applied, which can be modified by environment variables
7020                   on the kube-controllers process.
7021                 properties:
7022                   environmentVars:
7023                     additionalProperties:
7024                       type: string
7025                     description: EnvironmentVars contains the environment variables on
7026                       the kube-controllers that influenced the RunningConfig.
7027                     type: object
7028                   runningConfig:
7029                     description: RunningConfig contains the effective config that is running
7030                       in the kube-controllers pod, after merging the API resource with
7031                       any environment variables.
7032                     properties:
7033                       controllers:
7034                         description: Controllers enables and configures individual Kubernetes
7035                           controllers
7036                         properties:
7037                           namespace:
7038                             description: Namespace enables and configures the namespace
7039                               controller. Enabled by default, set to nil to disable.
7040                             properties:
7041                               reconcilerPeriod:
7042                                 description: 'ReconcilerPeriod is the period to perform
7043                                   reconciliation with the Calico datastore. [Default:
7044                                   5m]'
7045                                 type: string
7046                             type: object
7047                           node:
7048                             description: Node enables and configures the node controller.
7049                               Enabled by default, set to nil to disable.
7050                             properties:
7051                               hostEndpoint:
7052                                 description: HostEndpoint controls syncing nodes to host
7053                                   endpoints. Disabled by default, set to nil to disable.
7054                                 properties:
7055                                   autoCreate:
7056                                     description: 'AutoCreate enables automatic creation
7057                                       of host endpoints for every node. [Default: Disabled]'
7058                                     type: string
7059                                 type: object
7060                               leakGracePeriod:
7061                                 description: 'LeakGracePeriod is the period used by the
7062                                   controller to determine if an IP address has been leaked.
7063                                   Set to 0 to disable IP garbage collection. [Default:
7064                                   15m]'
7065                                 type: string
7066                               reconcilerPeriod:
7067                                 description: 'ReconcilerPeriod is the period to perform
7068                                   reconciliation with the Calico datastore. [Default:
7069                                   5m]'
7070                                 type: string
7071                               syncLabels:
7072                                 description: 'SyncLabels controls whether to copy Kubernetes
7073                                   node labels to Calico nodes. [Default: Enabled]'
7074                                 type: string
7075                             type: object
7076                           policy:
7077                             description: Policy enables and configures the policy controller.
7078                               Enabled by default, set to nil to disable.
7079                             properties:
7080                               reconcilerPeriod:
7081                                 description: 'ReconcilerPeriod is the period to perform
7082                                   reconciliation with the Calico datastore. [Default:
7083                                   5m]'
7084                                 type: string
7085                             type: object
7086                           serviceAccount:
7087                             description: ServiceAccount enables and configures the service
7088                               account controller. Enabled by default, set to nil to disable.
7089                             properties:
7090                               reconcilerPeriod:
7091                                 description: 'ReconcilerPeriod is the period to perform
7092                                   reconciliation with the Calico datastore. [Default:
7093                                   5m]'
7094                                 type: string
7095                             type: object
7096                           workloadEndpoint:
7097                             description: WorkloadEndpoint enables and configures the workload
7098                               endpoint controller. Enabled by default, set to nil to disable.
7099                             properties:
7100                               reconcilerPeriod:
7101                                 description: 'ReconcilerPeriod is the period to perform
7102                                   reconciliation with the Calico datastore. [Default:
7103                                   5m]'
7104                                 type: string
7105                             type: object
7106                         type: object
7107                       etcdV3CompactionPeriod:
7108                         description: 'EtcdV3CompactionPeriod is the period between etcdv3
7109                           compaction requests. Set to 0 to disable. [Default: 10m]'
7110                         type: string
7111                       healthChecks:
7112                         description: 'HealthChecks enables or disables support for health
7113                           checks [Default: Enabled]'
7114                         type: string
7115                       logSeverityScreen:
7116                         description: 'LogSeverityScreen is the log severity above which
7117                           logs are sent to the stdout. [Default: Info]'
7118                         type: string
7119                       prometheusMetricsPort:
7120                         description: 'PrometheusMetricsPort is the TCP port that the Prometheus
7121                           metrics server should bind to. Set to 0 to disable. [Default:
7122                           9094]'
7123                         type: integer
7124                     required:
7125                     - controllers
7126                     type: object
7127                 type: object
7128             type: object
7129         served: true
7130         storage: true
7131     status:
7132       acceptedNames:
7133         kind: ""
7134         plural: ""
7135       conditions: []
7136       storedVersions: []
7137     ---
7138     apiVersion: apiextensions.k8s.io/v1
7139     kind: CustomResourceDefinition
7140     metadata:
7141       name: networkpolicies.crd.projectcalico.org
7142     spec:
7143       group: crd.projectcalico.org
7144       names:
7145         kind: NetworkPolicy
7146         listKind: NetworkPolicyList
7147         plural: networkpolicies
7148         singular: networkpolicy
7149       scope: Namespaced
7150       versions:
7151       - name: v1
7152         schema:
7153           openAPIV3Schema:
7154             properties:
7155               apiVersion:
7156                 description: 'APIVersion defines the versioned schema of this representation
7157                   of an object. Servers should convert recognized schemas to the latest
7158                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
7159                 type: string
7160               kind:
7161                 description: 'Kind is a string value representing the REST resource this
7162                   object represents. Servers may infer this from the endpoint the client
7163                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
7164                 type: string
7165               metadata:
7166                 type: object
7167               spec:
7168                 properties:
7169                   egress:
7170                     description: The ordered set of egress rules.  Each rule contains
7171                       a set of packet match criteria and a corresponding action to apply.
7172                     items:
7173                       description: "A Rule encapsulates a set of match criteria and an
7174                         action.  Both selector-based security Policy and security Profiles
7175                         reference rules - separated out as a list of rules for both ingress
7176                         and egress packet matching. \n Each positive match criteria has
7177                         a negated version, prefixed with \"Not\". All the match criteria
7178                         within a rule must be satisfied for a packet to match. A single
7179                         rule can contain the positive and negative version of a match
7180                         and both must be satisfied for the rule to match."
7181                       properties:
7182                         action:
7183                           type: string
7184                         destination:
7185                           description: Destination contains the match criteria that apply
7186                             to destination entity.
7187                           properties:
7188                             namespaceSelector:
7189                               description: "NamespaceSelector is an optional field that
7190                                 contains a selector expression. Only traffic that originates
7191                                 from (or terminates at) endpoints within the selected
7192                                 namespaces will be matched. When both NamespaceSelector
7193                                 and another selector are defined on the same rule, then
7194                                 only workload endpoints that are matched by both selectors
7195                                 will be selected by the rule. \n For NetworkPolicy, an
7196                                 empty NamespaceSelector implies that the Selector is limited
7197                                 to selecting only workload endpoints in the same namespace
7198                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
7199                                 NamespaceSelector implies that the Selector is limited
7200                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
7201                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
7202                                 the Selector applies to workload endpoints across all
7203                                 namespaces."
7204                               type: string
7205                             nets:
7206                               description: Nets is an optional field that restricts the
7207                                 rule to only apply to traffic that originates from (or
7208                                 terminates at) IP addresses in any of the given subnets.
7209                               items:
7210                                 type: string
7211                               type: array
7212                             notNets:
7213                               description: NotNets is the negated version of the Nets
7214                                 field.
7215                               items:
7216                                 type: string
7217                               type: array
7218                             notPorts:
7219                               description: NotPorts is the negated version of the Ports
7220                                 field. Since only some protocols have ports, if any ports
7221                                 are specified it requires the Protocol match in the Rule
7222                                 to be set to "TCP" or "UDP".
7223                               items:
7224                                 anyOf:
7225                                 - type: integer
7226                                 - type: string
7227                                 pattern: ^.*
7228                                 x-kubernetes-int-or-string: true
7229                               type: array
7230                             notSelector:
7231                               description: NotSelector is the negated version of the Selector
7232                                 field.  See Selector field for subtleties with negated
7233                                 selectors.
7234                               type: string
7235                             ports:
7236                               description: "Ports is an optional field that restricts
7237                                 the rule to only apply to traffic that has a source (destination)
7238                                 port that matches one of these ranges/values. This value
7239                                 is a list of integers or strings that represent ranges
7240                                 of ports. \n Since only some protocols have ports, if
7241                                 any ports are specified it requires the Protocol match
7242                                 in the Rule to be set to \"TCP\" or \"UDP\"."
7243                               items:
7244                                 anyOf:
7245                                 - type: integer
7246                                 - type: string
7247                                 pattern: ^.*
7248                                 x-kubernetes-int-or-string: true
7249                               type: array
7250                             selector:
7251                               description: "Selector is an optional field that contains
7252                                 a selector expression (see Policy for sample syntax).
7253                                 \ Only traffic that originates from (terminates at) endpoints
7254                                 matching the selector will be matched. \n Note that: in
7255                                 addition to the negated version of the Selector (see NotSelector
7256                                 below), the selector expression syntax itself supports
7257                                 negation.  The two types of negation are subtly different.
7258                                 One negates the set of matched endpoints, the other negates
7259                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
7260                                 packets that are from other Calico-controlled \tendpoints
7261                                 that do not have the label \"my_label\". \n \tNotSelector
7262                                 = \"has(my_label)\" matches packets that are not from
7263                                 Calico-controlled \tendpoints that do have the label \"my_label\".
7264                                 \n The effect is that the latter will accept packets from
7265                                 non-Calico sources whereas the former is limited to packets
7266                                 from Calico-controlled endpoints."
7267                               type: string
7268                             serviceAccounts:
7269                               description: ServiceAccounts is an optional field that restricts
7270                                 the rule to only apply to traffic that originates from
7271                                 (or terminates at) a pod running as a matching service
7272                                 account.
7273                               properties:
7274                                 names:
7275                                   description: Names is an optional field that restricts
7276                                     the rule to only apply to traffic that originates
7277                                     from (or terminates at) a pod running as a service
7278                                     account whose name is in the list.
7279                                   items:
7280                                     type: string
7281                                   type: array
7282                                 selector:
7283                                   description: Selector is an optional field that restricts
7284                                     the rule to only apply to traffic that originates
7285                                     from (or terminates at) a pod running as a service
7286                                     account that matches the given label selector. If
7287                                     both Names and Selector are specified then they are
7288                                     AND'ed.
7289                                   type: string
7290                               type: object
7291                             services:
7292                               description: "Services is an optional field that contains
7293                                 options for matching Kubernetes Services. If specified,
7294                                 only traffic that originates from or terminates at endpoints
7295                                 within the selected service(s) will be matched, and only
7296                                 to/from each endpoint's port. \n Services cannot be specified
7297                                 on the same rule as Selector, NotSelector, NamespaceSelector,
7298                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
7299                                 can only be specified with Services on ingress rules."
7300                               properties:
7301                                 name:
7302                                   description: Name specifies the name of a Kubernetes
7303                                     Service to match.
7304                                   type: string
7305                                 namespace:
7306                                   description: Namespace specifies the namespace of the
7307                                     given Service. If left empty, the rule will match
7308                                     within this policy's namespace.
7309                                   type: string
7310                               type: object
7311                           type: object
7312                         http:
7313                           description: HTTP contains match criteria that apply to HTTP
7314                             requests.
7315                           properties:
7316                             methods:
7317                               description: Methods is an optional field that restricts
7318                                 the rule to apply only to HTTP requests that use one of
7319                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
7320                                 methods are OR'd together.
7321                               items:
7322                                 type: string
7323                               type: array
7324                             paths:
7325                               description: 'Paths is an optional field that restricts
7326                                 the rule to apply to HTTP requests that use one of the
7327                                 listed HTTP Paths. Multiple paths are OR''d together.
7328                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
7329                                 ONLY specify either a `exact` or a `prefix` match. The
7330                                 validator will check for it.'
7331                               items:
7332                                 description: 'HTTPPath specifies an HTTP path to match.
7333                                   It may be either of the form: exact: <path>: which matches
7334                                   the path exactly or prefix: <path-prefix>: which matches
7335                                   the path prefix'
7336                                 properties:
7337                                   exact:
7338                                     type: string
7339                                   prefix:
7340                                     type: string
7341                                 type: object
7342                               type: array
7343                           type: object
7344                         icmp:
7345                           description: ICMP is an optional field that restricts the rule
7346                             to apply to a specific type and code of ICMP traffic.  This
7347                             should only be specified if the Protocol field is set to "ICMP"
7348                             or "ICMPv6".
7349                           properties:
7350                             code:
7351                               description: Match on a specific ICMP code.  If specified,
7352                                 the Type value must also be specified. This is a technical
7353                                 limitation imposed by the kernel's iptables firewall,
7354                                 which Calico uses to enforce the rule.
7355                               type: integer
7356                             type:
7357                               description: Match on a specific ICMP type.  For example
7358                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
7359                               type: integer
7360                           type: object
7361                         ipVersion:
7362                           description: IPVersion is an optional field that restricts the
7363                             rule to only match a specific IP version.
7364                           type: integer
7365                         metadata:
7366                           description: Metadata contains additional information for this
7367                             rule
7368                           properties:
7369                             annotations:
7370                               additionalProperties:
7371                                 type: string
7372                               description: Annotations is a set of key value pairs that
7373                                 give extra information about the rule
7374                               type: object
7375                           type: object
7376                         notICMP:
7377                           description: NotICMP is the negated version of the ICMP field.
7378                           properties:
7379                             code:
7380                               description: Match on a specific ICMP code.  If specified,
7381                                 the Type value must also be specified. This is a technical
7382                                 limitation imposed by the kernel's iptables firewall,
7383                                 which Calico uses to enforce the rule.
7384                               type: integer
7385                             type:
7386                               description: Match on a specific ICMP type.  For example
7387                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
7388                               type: integer
7389                           type: object
7390                         notProtocol:
7391                           anyOf:
7392                           - type: integer
7393                           - type: string
7394                           description: NotProtocol is the negated version of the Protocol
7395                             field.
7396                           pattern: ^.*
7397                           x-kubernetes-int-or-string: true
7398                         protocol:
7399                           anyOf:
7400                           - type: integer
7401                           - type: string
7402                           description: "Protocol is an optional field that restricts the
7403                             rule to only apply to traffic of a specific IP protocol. Required
7404                             if any of the EntityRules contain Ports (because ports only
7405                             apply to certain protocols). \n Must be one of these string
7406                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
7407                             \"UDPLite\" or an integer in the range 1-255."
7408                           pattern: ^.*
7409                           x-kubernetes-int-or-string: true
7410                         source:
7411                           description: Source contains the match criteria that apply to
7412                             source entity.
7413                           properties:
7414                             namespaceSelector:
7415                               description: "NamespaceSelector is an optional field that
7416                                 contains a selector expression. Only traffic that originates
7417                                 from (or terminates at) endpoints within the selected
7418                                 namespaces will be matched. When both NamespaceSelector
7419                                 and another selector are defined on the same rule, then
7420                                 only workload endpoints that are matched by both selectors
7421                                 will be selected by the rule. \n For NetworkPolicy, an
7422                                 empty NamespaceSelector implies that the Selector is limited
7423                                 to selecting only workload endpoints in the same namespace
7424                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
7425                                 NamespaceSelector implies that the Selector is limited
7426                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
7427                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
7428                                 the Selector applies to workload endpoints across all
7429                                 namespaces."
7430                               type: string
7431                             nets:
7432                               description: Nets is an optional field that restricts the
7433                                 rule to only apply to traffic that originates from (or
7434                                 terminates at) IP addresses in any of the given subnets.
7435                               items:
7436                                 type: string
7437                               type: array
7438                             notNets:
7439                               description: NotNets is the negated version of the Nets
7440                                 field.
7441                               items:
7442                                 type: string
7443                               type: array
7444                             notPorts:
7445                               description: NotPorts is the negated version of the Ports
7446                                 field. Since only some protocols have ports, if any ports
7447                                 are specified it requires the Protocol match in the Rule
7448                                 to be set to "TCP" or "UDP".
7449                               items:
7450                                 anyOf:
7451                                 - type: integer
7452                                 - type: string
7453                                 pattern: ^.*
7454                                 x-kubernetes-int-or-string: true
7455                               type: array
7456                             notSelector:
7457                               description: NotSelector is the negated version of the Selector
7458                                 field.  See Selector field for subtleties with negated
7459                                 selectors.
7460                               type: string
7461                             ports:
7462                               description: "Ports is an optional field that restricts
7463                                 the rule to only apply to traffic that has a source (destination)
7464                                 port that matches one of these ranges/values. This value
7465                                 is a list of integers or strings that represent ranges
7466                                 of ports. \n Since only some protocols have ports, if
7467                                 any ports are specified it requires the Protocol match
7468                                 in the Rule to be set to \"TCP\" or \"UDP\"."
7469                               items:
7470                                 anyOf:
7471                                 - type: integer
7472                                 - type: string
7473                                 pattern: ^.*
7474                                 x-kubernetes-int-or-string: true
7475                               type: array
7476                             selector:
7477                               description: "Selector is an optional field that contains
7478                                 a selector expression (see Policy for sample syntax).
7479                                 \ Only traffic that originates from (terminates at) endpoints
7480                                 matching the selector will be matched. \n Note that: in
7481                                 addition to the negated version of the Selector (see NotSelector
7482                                 below), the selector expression syntax itself supports
7483                                 negation.  The two types of negation are subtly different.
7484                                 One negates the set of matched endpoints, the other negates
7485                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
7486                                 packets that are from other Calico-controlled \tendpoints
7487                                 that do not have the label \"my_label\". \n \tNotSelector
7488                                 = \"has(my_label)\" matches packets that are not from
7489                                 Calico-controlled \tendpoints that do have the label \"my_label\".
7490                                 \n The effect is that the latter will accept packets from
7491                                 non-Calico sources whereas the former is limited to packets
7492                                 from Calico-controlled endpoints."
7493                               type: string
7494                             serviceAccounts:
7495                               description: ServiceAccounts is an optional field that restricts
7496                                 the rule to only apply to traffic that originates from
7497                                 (or terminates at) a pod running as a matching service
7498                                 account.
7499                               properties:
7500                                 names:
7501                                   description: Names is an optional field that restricts
7502                                     the rule to only apply to traffic that originates
7503                                     from (or terminates at) a pod running as a service
7504                                     account whose name is in the list.
7505                                   items:
7506                                     type: string
7507                                   type: array
7508                                 selector:
7509                                   description: Selector is an optional field that restricts
7510                                     the rule to only apply to traffic that originates
7511                                     from (or terminates at) a pod running as a service
7512                                     account that matches the given label selector. If
7513                                     both Names and Selector are specified then they are
7514                                     AND'ed.
7515                                   type: string
7516                               type: object
7517                             services:
7518                               description: "Services is an optional field that contains
7519                                 options for matching Kubernetes Services. If specified,
7520                                 only traffic that originates from or terminates at endpoints
7521                                 within the selected service(s) will be matched, and only
7522                                 to/from each endpoint's port. \n Services cannot be specified
7523                                 on the same rule as Selector, NotSelector, NamespaceSelector,
7524                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
7525                                 can only be specified with Services on ingress rules."
7526                               properties:
7527                                 name:
7528                                   description: Name specifies the name of a Kubernetes
7529                                     Service to match.
7530                                   type: string
7531                                 namespace:
7532                                   description: Namespace specifies the namespace of the
7533                                     given Service. If left empty, the rule will match
7534                                     within this policy's namespace.
7535                                   type: string
7536                               type: object
7537                           type: object
7538                       required:
7539                       - action
7540                       type: object
7541                     type: array
7542                   ingress:
7543                     description: The ordered set of ingress rules.  Each rule contains
7544                       a set of packet match criteria and a corresponding action to apply.
7545                     items:
7546                       description: "A Rule encapsulates a set of match criteria and an
7547                         action.  Both selector-based security Policy and security Profiles
7548                         reference rules - separated out as a list of rules for both ingress
7549                         and egress packet matching. \n Each positive match criteria has
7550                         a negated version, prefixed with \"Not\". All the match criteria
7551                         within a rule must be satisfied for a packet to match. A single
7552                         rule can contain the positive and negative version of a match
7553                         and both must be satisfied for the rule to match."
7554                       properties:
7555                         action:
7556                           type: string
7557                         destination:
7558                           description: Destination contains the match criteria that apply
7559                             to destination entity.
7560                           properties:
7561                             namespaceSelector:
7562                               description: "NamespaceSelector is an optional field that
7563                                 contains a selector expression. Only traffic that originates
7564                                 from (or terminates at) endpoints within the selected
7565                                 namespaces will be matched. When both NamespaceSelector
7566                                 and another selector are defined on the same rule, then
7567                                 only workload endpoints that are matched by both selectors
7568                                 will be selected by the rule. \n For NetworkPolicy, an
7569                                 empty NamespaceSelector implies that the Selector is limited
7570                                 to selecting only workload endpoints in the same namespace
7571                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
7572                                 NamespaceSelector implies that the Selector is limited
7573                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
7574                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
7575                                 the Selector applies to workload endpoints across all
7576                                 namespaces."
7577                               type: string
7578                             nets:
7579                               description: Nets is an optional field that restricts the
7580                                 rule to only apply to traffic that originates from (or
7581                                 terminates at) IP addresses in any of the given subnets.
7582                               items:
7583                                 type: string
7584                               type: array
7585                             notNets:
7586                               description: NotNets is the negated version of the Nets
7587                                 field.
7588                               items:
7589                                 type: string
7590                               type: array
7591                             notPorts:
7592                               description: NotPorts is the negated version of the Ports
7593                                 field. Since only some protocols have ports, if any ports
7594                                 are specified it requires the Protocol match in the Rule
7595                                 to be set to "TCP" or "UDP".
7596                               items:
7597                                 anyOf:
7598                                 - type: integer
7599                                 - type: string
7600                                 pattern: ^.*
7601                                 x-kubernetes-int-or-string: true
7602                               type: array
7603                             notSelector:
7604                               description: NotSelector is the negated version of the Selector
7605                                 field.  See Selector field for subtleties with negated
7606                                 selectors.
7607                               type: string
7608                             ports:
7609                               description: "Ports is an optional field that restricts
7610                                 the rule to only apply to traffic that has a source (destination)
7611                                 port that matches one of these ranges/values. This value
7612                                 is a list of integers or strings that represent ranges
7613                                 of ports. \n Since only some protocols have ports, if
7614                                 any ports are specified it requires the Protocol match
7615                                 in the Rule to be set to \"TCP\" or \"UDP\"."
7616                               items:
7617                                 anyOf:
7618                                 - type: integer
7619                                 - type: string
7620                                 pattern: ^.*
7621                                 x-kubernetes-int-or-string: true
7622                               type: array
7623                             selector:
7624                               description: "Selector is an optional field that contains
7625                                 a selector expression (see Policy for sample syntax).
7626                                 \ Only traffic that originates from (terminates at) endpoints
7627                                 matching the selector will be matched. \n Note that: in
7628                                 addition to the negated version of the Selector (see NotSelector
7629                                 below), the selector expression syntax itself supports
7630                                 negation.  The two types of negation are subtly different.
7631                                 One negates the set of matched endpoints, the other negates
7632                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
7633                                 packets that are from other Calico-controlled \tendpoints
7634                                 that do not have the label \"my_label\". \n \tNotSelector
7635                                 = \"has(my_label)\" matches packets that are not from
7636                                 Calico-controlled \tendpoints that do have the label \"my_label\".
7637                                 \n The effect is that the latter will accept packets from
7638                                 non-Calico sources whereas the former is limited to packets
7639                                 from Calico-controlled endpoints."
7640                               type: string
7641                             serviceAccounts:
7642                               description: ServiceAccounts is an optional field that restricts
7643                                 the rule to only apply to traffic that originates from
7644                                 (or terminates at) a pod running as a matching service
7645                                 account.
7646                               properties:
7647                                 names:
7648                                   description: Names is an optional field that restricts
7649                                     the rule to only apply to traffic that originates
7650                                     from (or terminates at) a pod running as a service
7651                                     account whose name is in the list.
7652                                   items:
7653                                     type: string
7654                                   type: array
7655                                 selector:
7656                                   description: Selector is an optional field that restricts
7657                                     the rule to only apply to traffic that originates
7658                                     from (or terminates at) a pod running as a service
7659                                     account that matches the given label selector. If
7660                                     both Names and Selector are specified then they are
7661                                     AND'ed.
7662                                   type: string
7663                               type: object
7664                             services:
7665                               description: "Services is an optional field that contains
7666                                 options for matching Kubernetes Services. If specified,
7667                                 only traffic that originates from or terminates at endpoints
7668                                 within the selected service(s) will be matched, and only
7669                                 to/from each endpoint's port. \n Services cannot be specified
7670                                 on the same rule as Selector, NotSelector, NamespaceSelector,
7671                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
7672                                 can only be specified with Services on ingress rules."
7673                               properties:
7674                                 name:
7675                                   description: Name specifies the name of a Kubernetes
7676                                     Service to match.
7677                                   type: string
7678                                 namespace:
7679                                   description: Namespace specifies the namespace of the
7680                                     given Service. If left empty, the rule will match
7681                                     within this policy's namespace.
7682                                   type: string
7683                               type: object
7684                           type: object
7685                         http:
7686                           description: HTTP contains match criteria that apply to HTTP
7687                             requests.
7688                           properties:
7689                             methods:
7690                               description: Methods is an optional field that restricts
7691                                 the rule to apply only to HTTP requests that use one of
7692                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
7693                                 methods are OR'd together.
7694                               items:
7695                                 type: string
7696                               type: array
7697                             paths:
7698                               description: 'Paths is an optional field that restricts
7699                                 the rule to apply to HTTP requests that use one of the
7700                                 listed HTTP Paths. Multiple paths are OR''d together.
7701                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
7702                                 ONLY specify either a `exact` or a `prefix` match. The
7703                                 validator will check for it.'
7704                               items:
7705                                 description: 'HTTPPath specifies an HTTP path to match.
7706                                   It may be either of the form: exact: <path>: which matches
7707                                   the path exactly or prefix: <path-prefix>: which matches
7708                                   the path prefix'
7709                                 properties:
7710                                   exact:
7711                                     type: string
7712                                   prefix:
7713                                     type: string
7714                                 type: object
7715                               type: array
7716                           type: object
7717                         icmp:
7718                           description: ICMP is an optional field that restricts the rule
7719                             to apply to a specific type and code of ICMP traffic.  This
7720                             should only be specified if the Protocol field is set to "ICMP"
7721                             or "ICMPv6".
7722                           properties:
7723                             code:
7724                               description: Match on a specific ICMP code.  If specified,
7725                                 the Type value must also be specified. This is a technical
7726                                 limitation imposed by the kernel's iptables firewall,
7727                                 which Calico uses to enforce the rule.
7728                               type: integer
7729                             type:
7730                               description: Match on a specific ICMP type.  For example
7731                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
7732                               type: integer
7733                           type: object
7734                         ipVersion:
7735                           description: IPVersion is an optional field that restricts the
7736                             rule to only match a specific IP version.
7737                           type: integer
7738                         metadata:
7739                           description: Metadata contains additional information for this
7740                             rule
7741                           properties:
7742                             annotations:
7743                               additionalProperties:
7744                                 type: string
7745                               description: Annotations is a set of key value pairs that
7746                                 give extra information about the rule
7747                               type: object
7748                           type: object
7749                         notICMP:
7750                           description: NotICMP is the negated version of the ICMP field.
7751                           properties:
7752                             code:
7753                               description: Match on a specific ICMP code.  If specified,
7754                                 the Type value must also be specified. This is a technical
7755                                 limitation imposed by the kernel's iptables firewall,
7756                                 which Calico uses to enforce the rule.
7757                               type: integer
7758                             type:
7759                               description: Match on a specific ICMP type.  For example
7760                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
7761                               type: integer
7762                           type: object
7763                         notProtocol:
7764                           anyOf:
7765                           - type: integer
7766                           - type: string
7767                           description: NotProtocol is the negated version of the Protocol
7768                             field.
7769                           pattern: ^.*
7770                           x-kubernetes-int-or-string: true
7771                         protocol:
7772                           anyOf:
7773                           - type: integer
7774                           - type: string
7775                           description: "Protocol is an optional field that restricts the
7776                             rule to only apply to traffic of a specific IP protocol. Required
7777                             if any of the EntityRules contain Ports (because ports only
7778                             apply to certain protocols). \n Must be one of these string
7779                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
7780                             \"UDPLite\" or an integer in the range 1-255."
7781                           pattern: ^.*
7782                           x-kubernetes-int-or-string: true
7783                         source:
7784                           description: Source contains the match criteria that apply to
7785                             source entity.
7786                           properties:
7787                             namespaceSelector:
7788                               description: "NamespaceSelector is an optional field that
7789                                 contains a selector expression. Only traffic that originates
7790                                 from (or terminates at) endpoints within the selected
7791                                 namespaces will be matched. When both NamespaceSelector
7792                                 and another selector are defined on the same rule, then
7793                                 only workload endpoints that are matched by both selectors
7794                                 will be selected by the rule. \n For NetworkPolicy, an
7795                                 empty NamespaceSelector implies that the Selector is limited
7796                                 to selecting only workload endpoints in the same namespace
7797                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
7798                                 NamespaceSelector implies that the Selector is limited
7799                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
7800                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
7801                                 the Selector applies to workload endpoints across all
7802                                 namespaces."
7803                               type: string
7804                             nets:
7805                               description: Nets is an optional field that restricts the
7806                                 rule to only apply to traffic that originates from (or
7807                                 terminates at) IP addresses in any of the given subnets.
7808                               items:
7809                                 type: string
7810                               type: array
7811                             notNets:
7812                               description: NotNets is the negated version of the Nets
7813                                 field.
7814                               items:
7815                                 type: string
7816                               type: array
7817                             notPorts:
7818                               description: NotPorts is the negated version of the Ports
7819                                 field. Since only some protocols have ports, if any ports
7820                                 are specified it requires the Protocol match in the Rule
7821                                 to be set to "TCP" or "UDP".
7822                               items:
7823                                 anyOf:
7824                                 - type: integer
7825                                 - type: string
7826                                 pattern: ^.*
7827                                 x-kubernetes-int-or-string: true
7828                               type: array
7829                             notSelector:
7830                               description: NotSelector is the negated version of the Selector
7831                                 field.  See Selector field for subtleties with negated
7832                                 selectors.
7833                               type: string
7834                             ports:
7835                               description: "Ports is an optional field that restricts
7836                                 the rule to only apply to traffic that has a source (destination)
7837                                 port that matches one of these ranges/values. This value
7838                                 is a list of integers or strings that represent ranges
7839                                 of ports. \n Since only some protocols have ports, if
7840                                 any ports are specified it requires the Protocol match
7841                                 in the Rule to be set to \"TCP\" or \"UDP\"."
7842                               items:
7843                                 anyOf:
7844                                 - type: integer
7845                                 - type: string
7846                                 pattern: ^.*
7847                                 x-kubernetes-int-or-string: true
7848                               type: array
7849                             selector:
7850                               description: "Selector is an optional field that contains
7851                                 a selector expression (see Policy for sample syntax).
7852                                 \ Only traffic that originates from (terminates at) endpoints
7853                                 matching the selector will be matched. \n Note that: in
7854                                 addition to the negated version of the Selector (see NotSelector
7855                                 below), the selector expression syntax itself supports
7856                                 negation.  The two types of negation are subtly different.
7857                                 One negates the set of matched endpoints, the other negates
7858                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
7859                                 packets that are from other Calico-controlled \tendpoints
7860                                 that do not have the label \"my_label\". \n \tNotSelector
7861                                 = \"has(my_label)\" matches packets that are not from
7862                                 Calico-controlled \tendpoints that do have the label \"my_label\".
7863                                 \n The effect is that the latter will accept packets from
7864                                 non-Calico sources whereas the former is limited to packets
7865                                 from Calico-controlled endpoints."
7866                               type: string
7867                             serviceAccounts:
7868                               description: ServiceAccounts is an optional field that restricts
7869                                 the rule to only apply to traffic that originates from
7870                                 (or terminates at) a pod running as a matching service
7871                                 account.
7872                               properties:
7873                                 names:
7874                                   description: Names is an optional field that restricts
7875                                     the rule to only apply to traffic that originates
7876                                     from (or terminates at) a pod running as a service
7877                                     account whose name is in the list.
7878                                   items:
7879                                     type: string
7880                                   type: array
7881                                 selector:
7882                                   description: Selector is an optional field that restricts
7883                                     the rule to only apply to traffic that originates
7884                                     from (or terminates at) a pod running as a service
7885                                     account that matches the given label selector. If
7886                                     both Names and Selector are specified then they are
7887                                     AND'ed.
7888                                   type: string
7889                               type: object
7890                             services:
7891                               description: "Services is an optional field that contains
7892                                 options for matching Kubernetes Services. If specified,
7893                                 only traffic that originates from or terminates at endpoints
7894                                 within the selected service(s) will be matched, and only
7895                                 to/from each endpoint's port. \n Services cannot be specified
7896                                 on the same rule as Selector, NotSelector, NamespaceSelector,
7897                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
7898                                 can only be specified with Services on ingress rules."
7899                               properties:
7900                                 name:
7901                                   description: Name specifies the name of a Kubernetes
7902                                     Service to match.
7903                                   type: string
7904                                 namespace:
7905                                   description: Namespace specifies the namespace of the
7906                                     given Service. If left empty, the rule will match
7907                                     within this policy's namespace.
7908                                   type: string
7909                               type: object
7910                           type: object
7911                       required:
7912                       - action
7913                       type: object
7914                     type: array
7915                   order:
7916                     description: Order is an optional field that specifies the order in
7917                       which the policy is applied. Policies with higher "order" are applied
7918                       after those with lower order.  If the order is omitted, it may be
7919                       considered to be "infinite" - i.e. the policy will be applied last.  Policies
7920                       with identical order will be applied in alphanumerical order based
7921                       on the Policy "Name".
7922                     type: number
7923                   selector:
7924                     description: "The selector is an expression used to pick pick out
7925                       the endpoints that the policy should be applied to. \n Selector
7926                       expressions follow this syntax: \n \tlabel == \"string_literal\"
7927                       \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
7928                       \  ->  not equal; also matches if label is not present \tlabel in
7929                       { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
7930                       one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
7931                       ... }  ->  true if the value of label X is not one of \"a\", \"b\",
7932                       \"c\" \thas(label_name)  -> True if that label is present \t! expr
7933                       -> negation of expr \texpr && expr  -> Short-circuit and \texpr
7934                       || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
7935                       or the empty selector -> matches all endpoints. \n Label names are
7936                       allowed to contain alphanumerics, -, _ and /. String literals are
7937                       more permissive but they do not support escape characters. \n Examples
7938                       (with made-up labels): \n \ttype == \"webserver\" && deployment
7939                       == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
7940                       \"dev\" \t! has(label_name)"
7941                     type: string
7942                   serviceAccountSelector:
7943                     description: ServiceAccountSelector is an optional field for an expression
7944                       used to select a pod based on service accounts.
7945                     type: string
7946                   types:
7947                     description: "Types indicates whether this policy applies to ingress,
7948                       or to egress, or to both.  When not explicitly specified (and so
7949                       the value on creation is empty or nil), Calico defaults Types according
7950                       to what Ingress and Egress are present in the policy.  The default
7951                       is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
7952                       the case where there are   also no Ingress rules) \n - [ PolicyTypeEgress
7953                       ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
7954                       PolicyTypeEgress ], if there are both Ingress and Egress rules.
7955                       \n When the policy is read back again, Types will always be one
7956                       of these values, never empty or nil."
7957                     items:
7958                       description: PolicyType enumerates the possible values of the PolicySpec
7959                         Types field.
7960                       type: string
7961                     type: array
7962                 type: object
7963             type: object
7964         served: true
7965         storage: true
7966     status:
7967       acceptedNames:
7968         kind: ""
7969         plural: ""
7970       conditions: []
7971       storedVersions: []
7972     ---
7973     apiVersion: apiextensions.k8s.io/v1
7974     kind: CustomResourceDefinition
7975     metadata:
7976       name: networksets.crd.projectcalico.org
7977     spec:
7978       group: crd.projectcalico.org
7979       names:
7980         kind: NetworkSet
7981         listKind: NetworkSetList
7982         plural: networksets
7983         singular: networkset
7984       scope: Namespaced
7985       versions:
7986       - name: v1
7987         schema:
7988           openAPIV3Schema:
7989             description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet.
7990             properties:
7991               apiVersion:
7992                 description: 'APIVersion defines the versioned schema of this representation
7993                   of an object. Servers should convert recognized schemas to the latest
7994                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
7995                 type: string
7996               kind:
7997                 description: 'Kind is a string value representing the REST resource this
7998                   object represents. Servers may infer this from the endpoint the client
7999                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
8000                 type: string
8001               metadata:
8002                 type: object
8003               spec:
8004                 description: NetworkSetSpec contains the specification for a NetworkSet
8005                   resource.
8006                 properties:
8007                   nets:
8008                     description: The list of IP networks that belong to this set.
8009                     items:
8010                       type: string
8011                     type: array
8012                 type: object
8013             type: object
8014         served: true
8015         storage: true
8016     status:
8017       acceptedNames:
8018         kind: ""
8019         plural: ""
8020       conditions: []
8021       storedVersions: []
8022     ---
8023     apiVersion: v1
8024     kind: ServiceAccount
8025     metadata:
8026       name: calico-kube-controllers
8027       namespace: kube-system
8028     ---
8029     apiVersion: v1
8030     kind: ServiceAccount
8031     metadata:
8032       name: calico-node
8033       namespace: kube-system
8034     ---
8035     apiVersion: rbac.authorization.k8s.io/v1
8036     kind: ClusterRole
8037     metadata:
8038       name: calico-kube-controllers
8039     rules:
8040     - apiGroups:
8041       - ""
8042       resources:
8043       - nodes
8044       verbs:
8045       - watch
8046       - list
8047       - get
8048     - apiGroups:
8049       - ""
8050       resources:
8051       - pods
8052       verbs:
8053       - get
8054       - list
8055       - watch
8056     - apiGroups:
8057       - crd.projectcalico.org
8058       resources:
8059       - ippools
8060       - ipreservations
8061       verbs:
8062       - list
8063     - apiGroups:
8064       - crd.projectcalico.org
8065       resources:
8066       - blockaffinities
8067       - ipamblocks
8068       - ipamhandles
8069       verbs:
8070       - get
8071       - list
8072       - create
8073       - update
8074       - delete
8075       - watch
8076     - apiGroups:
8077       - crd.projectcalico.org
8078       resources:
8079       - hostendpoints
8080       verbs:
8081       - get
8082       - list
8083       - create
8084       - update
8085       - delete
8086     - apiGroups:
8087       - crd.projectcalico.org
8088       resources:
8089       - clusterinformations
8090       verbs:
8091       - get
8092       - create
8093       - update
8094     - apiGroups:
8095       - crd.projectcalico.org
8096       resources:
8097       - kubecontrollersconfigurations
8098       verbs:
8099       - get
8100       - create
8101       - update
8102       - watch
8103     ---
8104     apiVersion: rbac.authorization.k8s.io/v1
8105     kind: ClusterRole
8106     metadata:
8107       name: calico-node
8108     rules:
8109     - apiGroups:
8110       - ""
8111       resources:
8112       - pods
8113       - nodes
8114       - namespaces
8115       verbs:
8116       - get
8117     - apiGroups:
8118       - discovery.k8s.io
8119       resources:
8120       - endpointslices
8121       verbs:
8122       - watch
8123       - list
8124     - apiGroups:
8125       - ""
8126       resources:
8127       - endpoints
8128       - services
8129       verbs:
8130       - watch
8131       - list
8132       - get
8133     - apiGroups:
8134       - ""
8135       resources:
8136       - configmaps
8137       verbs:
8138       - get
8139     - apiGroups:
8140       - ""
8141       resources:
8142       - nodes/status
8143       verbs:
8144       - patch
8145       - update
8146     - apiGroups:
8147       - networking.k8s.io
8148       resources:
8149       - networkpolicies
8150       verbs:
8151       - watch
8152       - list
8153     - apiGroups:
8154       - ""
8155       resources:
8156       - pods
8157       - namespaces
8158       - serviceaccounts
8159       verbs:
8160       - list
8161       - watch
8162     - apiGroups:
8163       - ""
8164       resources:
8165       - pods/status
8166       verbs:
8167       - patch
8168     - apiGroups:
8169       - crd.projectcalico.org
8170       resources:
8171       - globalfelixconfigs
8172       - felixconfigurations
8173       - bgppeers
8174       - globalbgpconfigs
8175       - bgpconfigurations
8176       - ippools
8177       - ipreservations
8178       - ipamblocks
8179       - globalnetworkpolicies
8180       - globalnetworksets
8181       - networkpolicies
8182       - networksets
8183       - clusterinformations
8184       - hostendpoints
8185       - blockaffinities
8186       - caliconodestatuses
8187       verbs:
8188       - get
8189       - list
8190       - watch
8191     - apiGroups:
8192       - crd.projectcalico.org
8193       resources:
8194       - ippools
8195       - felixconfigurations
8196       - clusterinformations
8197       verbs:
8198       - create
8199       - update
8200     - apiGroups:
8201       - crd.projectcalico.org
8202       resources:
8203       - caliconodestatuses
8204       verbs:
8205       - update
8206     - apiGroups:
8207       - ""
8208       resources:
8209       - nodes
8210       verbs:
8211       - get
8212       - list
8213       - watch
8214     - apiGroups:
8215       - crd.projectcalico.org
8216       resources:
8217       - bgpconfigurations
8218       - bgppeers
8219       verbs:
8220       - create
8221       - update
8222     - apiGroups:
8223       - crd.projectcalico.org
8224       resources:
8225       - blockaffinities
8226       - ipamblocks
8227       - ipamhandles
8228       verbs:
8229       - get
8230       - list
8231       - create
8232       - update
8233       - delete
8234     - apiGroups:
8235       - crd.projectcalico.org
8236       resources:
8237       - ipamconfigs
8238       verbs:
8239       - get
8240     - apiGroups:
8241       - crd.projectcalico.org
8242       resources:
8243       - blockaffinities
8244       verbs:
8245       - watch
8246     - apiGroups:
8247       - apps
8248       resources:
8249       - daemonsets
8250       verbs:
8251       - get
8252     ---
8253     apiVersion: rbac.authorization.k8s.io/v1
8254     kind: ClusterRoleBinding
8255     metadata:
8256       name: calico-kube-controllers
8257     roleRef:
8258       apiGroup: rbac.authorization.k8s.io
8259       kind: ClusterRole
8260       name: calico-kube-controllers
8261     subjects:
8262     - kind: ServiceAccount
8263       name: calico-kube-controllers
8264       namespace: kube-system
8265     ---
8266     apiVersion: rbac.authorization.k8s.io/v1
8267     kind: ClusterRoleBinding
8268     metadata:
8269       name: calico-node
8270     roleRef:
8271       apiGroup: rbac.authorization.k8s.io
8272       kind: ClusterRole
8273       name: calico-node
8274     subjects:
8275     - kind: ServiceAccount
8276       name: calico-node
8277       namespace: kube-system
8278     ---
8279     apiVersion: v1
8280     data:
8281       calico_backend: bird
8282       cni_network_config: |-
8283         {
8284           "name": "k8s-pod-network",
8285           "cniVersion": "0.3.1",
8286           "plugins": [
8287             {
8288               "type": "calico",
8289               "log_level": "info",
8290               "log_file_path": "/var/log/calico/cni/cni.log",
8291               "datastore_type": "kubernetes",
8292               "nodename": "__KUBERNETES_NODE_NAME__",
8293               "mtu": __CNI_MTU__,
8294               "ipam": {
8295                   "type": "calico-ipam",
8296                   "assign_ipv4": "true",
8297                   "assign_ipv6": "true"
8298               },
8299               "policy": {
8300                   "type": "k8s"
8301               },
8302               "kubernetes": {
8303                   "kubeconfig": "__KUBECONFIG_FILEPATH__"
8304               }
8305             },
8306             {
8307               "type": "portmap",
8308               "snat": true,
8309               "capabilities": {"portMappings": true}
8310             },
8311             {
8312               "type": "bandwidth",
8313               "capabilities": {"bandwidth": true}
8314             }
8315           ]
8316         }
8317       typha_service_name: none
8318       veth_mtu: "0"
8319     kind: ConfigMap
8320     metadata:
8321       name: calico-config
8322       namespace: kube-system
8323     ---
8324     apiVersion: apps/v1
8325     kind: Deployment
8326     metadata:
8327       labels:
8328         k8s-app: calico-kube-controllers
8329       name: calico-kube-controllers
8330       namespace: kube-system
8331     spec:
8332       replicas: 1
8333       selector:
8334         matchLabels:
8335           k8s-app: calico-kube-controllers
8336       strategy:
8337         type: Recreate
8338       template:
8339         metadata:
8340           labels:
8341             k8s-app: calico-kube-controllers
8342           name: calico-kube-controllers
8343           namespace: kube-system
8344         spec:
8345           containers:
8346           - env:
8347             - name: ENABLED_CONTROLLERS
8348               value: node
8349             - name: DATASTORE_TYPE
8350               value: kubernetes
8351             image: docker.io/calico/kube-controllers:v3.22.1
8352             livenessProbe:
8353               exec:
8354                 command:
8355                 - /usr/bin/check-status
8356                 - -l
8357               failureThreshold: 6
8358               initialDelaySeconds: 10
8359               periodSeconds: 10
8360               timeoutSeconds: 10
8361             name: calico-kube-controllers
8362             readinessProbe:
8363               exec:
8364                 command:
8365                 - /usr/bin/check-status
8366                 - -r
8367               periodSeconds: 10
8368           nodeSelector:
8369             kubernetes.io/os: linux
8370           priorityClassName: system-cluster-critical
8371           serviceAccountName: calico-kube-controllers
8372           tolerations:
8373           - key: CriticalAddonsOnly
8374             operator: Exists
8375           - effect: NoSchedule
8376             key: node-role.kubernetes.io/master
8377     ---
8378     apiVersion: policy/v1beta1
8379     kind: PodDisruptionBudget
8380     metadata:
8381       labels:
8382         k8s-app: calico-kube-controllers
8383       name: calico-kube-controllers
8384       namespace: kube-system
8385     spec:
8386       maxUnavailable: 1
8387       selector:
8388         matchLabels:
8389           k8s-app: calico-kube-controllers
8390     ---
8391     apiVersion: apps/v1
8392     kind: DaemonSet
8393     metadata:
8394       labels:
8395         k8s-app: calico-node
8396       name: calico-node
8397       namespace: kube-system
8398     spec:
8399       selector:
8400         matchLabels:
8401           k8s-app: calico-node
8402       template:
8403         metadata:
8404           labels:
8405             k8s-app: calico-node
8406         spec:
8407           containers:
8408           - env:
8409             - name: IP_AUTODETECTION_METHOD
8410               value: can-reach=www.google.com
8411             - name: IP6_AUTODETECTION_METHOD
8412               value: can-reach=www.google.com
8413             - name: IP6
8414               value: autodetect
8415             - name: FELIX_IPV6SUPPORT
8416               value: "true"
8417             - name: DATASTORE_TYPE
8418               value: kubernetes
8419             - name: WAIT_FOR_DATASTORE
8420               value: "true"
8421             - name: NODENAME
8422               valueFrom:
8423                 fieldRef:
8424                   fieldPath: spec.nodeName
8425             - name: CALICO_NETWORKING_BACKEND
8426               valueFrom:
8427                 configMapKeyRef:
8428                   key: calico_backend
8429                   name: calico-config
8430             - name: CLUSTER_TYPE
8431               value: k8s,bgp
8432             - name: IP
8433               value: autodetect
8434             - name: CALICO_IPV4POOL_IPIP
8435               value: Always
8436             - name: CALICO_IPV4POOL_VXLAN
8437               value: Never
8438             - name: FELIX_IPINIPMTU
8439               valueFrom:
8440                 configMapKeyRef:
8441                   key: veth_mtu
8442                   name: calico-config
8443             - name: FELIX_VXLANMTU
8444               valueFrom:
8445                 configMapKeyRef:
8446                   key: veth_mtu
8447                   name: calico-config
8448             - name: FELIX_WIREGUARDMTU
8449               valueFrom:
8450                 configMapKeyRef:
8451                   key: veth_mtu
8452                   name: calico-config
8453             - name: CALICO_DISABLE_FILE_LOGGING
8454               value: "true"
8455             - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
8456               value: ACCEPT
8457             - name: FELIX_HEALTHENABLED
8458               value: "true"
8459             envFrom:
8460             - configMapRef:
8461                 name: kubernetes-services-endpoint
8462                 optional: true
8463             image: docker.io/calico/node:v3.22.1
8464             lifecycle:
8465               preStop:
8466                 exec:
8467                   command:
8468                   - /bin/calico-node
8469                   - -shutdown
8470             livenessProbe:
8471               exec:
8472                 command:
8473                 - /bin/calico-node
8474                 - -felix-live
8475                 - -bird-live
8476               failureThreshold: 6
8477               initialDelaySeconds: 10
8478               periodSeconds: 10
8479               timeoutSeconds: 10
8480             name: calico-node
8481             readinessProbe:
8482               exec:
8483                 command:
8484                 - /bin/calico-node
8485                 - -felix-ready
8486                 - -bird-ready
8487               periodSeconds: 10
8488               timeoutSeconds: 10
8489             resources:
8490               requests:
8491                 cpu: 250m
8492             securityContext:
8493               privileged: true
8494             volumeMounts:
8495             - mountPath: /host/etc/cni/net.d
8496               name: cni-net-dir
8497               readOnly: false
8498             - mountPath: /lib/modules
8499               name: lib-modules
8500               readOnly: true
8501             - mountPath: /run/xtables.lock
8502               name: xtables-lock
8503               readOnly: false
8504             - mountPath: /var/run/calico
8505               name: var-run-calico
8506               readOnly: false
8507             - mountPath: /var/lib/calico
8508               name: var-lib-calico
8509               readOnly: false
8510             - mountPath: /var/run/nodeagent
8511               name: policysync
8512             - mountPath: /sys/fs/
8513               mountPropagation: Bidirectional
8514               name: sysfs
8515             - mountPath: /var/log/calico/cni
8516               name: cni-log-dir
8517               readOnly: true
8518           hostNetwork: true
8519           initContainers:
8520           - command:
8521             - /opt/cni/bin/calico-ipam
8522             - -upgrade
8523             env:
8524             - name: KUBERNETES_NODE_NAME
8525               valueFrom:
8526                 fieldRef:
8527                   fieldPath: spec.nodeName
8528             - name: CALICO_NETWORKING_BACKEND
8529               valueFrom:
8530                 configMapKeyRef:
8531                   key: calico_backend
8532                   name: calico-config
8533             envFrom:
8534             - configMapRef:
8535                 name: kubernetes-services-endpoint
8536                 optional: true
8537             image: docker.io/calico/cni:v3.22.1
8538             name: upgrade-ipam
8539             securityContext:
8540               privileged: true
8541             volumeMounts:
8542             - mountPath: /var/lib/cni/networks
8543               name: host-local-net-dir
8544             - mountPath: /host/opt/cni/bin
8545               name: cni-bin-dir
8546           - command:
8547             - /opt/cni/bin/install
8548             env:
8549             - name: CNI_CONF_NAME
8550               value: 10-calico.conflist
8551             - name: CNI_NETWORK_CONFIG
8552               valueFrom:
8553                 configMapKeyRef:
8554                   key: cni_network_config
8555                   name: calico-config
8556             - name: KUBERNETES_NODE_NAME
8557               valueFrom:
8558                 fieldRef:
8559                   fieldPath: spec.nodeName
8560             - name: CNI_MTU
8561               valueFrom:
8562                 configMapKeyRef:
8563                   key: veth_mtu
8564                   name: calico-config
8565             - name: SLEEP
8566               value: "false"
8567             envFrom:
8568             - configMapRef:
8569                 name: kubernetes-services-endpoint
8570                 optional: true
8571             image: docker.io/calico/cni:v3.22.1
8572             name: install-cni
8573             securityContext:
8574               privileged: true
8575             volumeMounts:
8576             - mountPath: /host/opt/cni/bin
8577               name: cni-bin-dir
8578             - mountPath: /host/etc/cni/net.d
8579               name: cni-net-dir
8580           - image: docker.io/calico/pod2daemon-flexvol:v3.22.1
8581             name: flexvol-driver
8582             securityContext:
8583               privileged: true
8584             volumeMounts:
8585             - mountPath: /host/driver
8586               name: flexvol-driver-host
8587           nodeSelector:
8588             kubernetes.io/os: linux
8589           priorityClassName: system-node-critical
8590           serviceAccountName: calico-node
8591           terminationGracePeriodSeconds: 0
8592           tolerations:
8593           - effect: NoSchedule
8594             operator: Exists
8595           - key: CriticalAddonsOnly
8596             operator: Exists
8597           - effect: NoExecute
8598             operator: Exists
8599           volumes:
8600           - hostPath:
8601               path: /lib/modules
8602             name: lib-modules
8603           - hostPath:
8604               path: /var/run/calico
8605             name: var-run-calico
8606           - hostPath:
8607               path: /var/lib/calico
8608             name: var-lib-calico
8609           - hostPath:
8610               path: /run/xtables.lock
8611               type: FileOrCreate
8612             name: xtables-lock
8613           - hostPath:
8614               path: /sys/fs/
8615               type: DirectoryOrCreate
8616             name: sysfs
8617           - hostPath:
8618               path: /opt/cni/bin
8619             name: cni-bin-dir
8620           - hostPath:
8621               path: /etc/cni/net.d
8622             name: cni-net-dir
8623           - hostPath:
8624               path: /var/log/calico/cni
8625             name: cni-log-dir
8626           - hostPath:
8627               path: /var/lib/cni/networks
8628             name: host-local-net-dir
8629           - hostPath:
8630               path: /var/run/nodeagent
8631               type: DirectoryOrCreate
8632             name: policysync
8633           - hostPath:
8634               path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
8635               type: DirectoryOrCreate
8636             name: flexvol-driver-host
8637       updateStrategy:
8638         rollingUpdate:
8639           maxUnavailable: 1
8640         type: RollingUpdate
8641 kind: ConfigMap
8642 metadata:
8643   creationTimestamp: null
8644   name: {{ .Values.clusterName }}-calico-addon
8645 {{- end }}
8646 {{- if eq .Values.ipam "ipv6" }}
8647 ---
8648 apiVersion: v1
8649 data:
8650   calico.yaml: |
8651     apiVersion: apiextensions.k8s.io/v1
8652     kind: CustomResourceDefinition
8653     metadata:
8654       name: bgpconfigurations.crd.projectcalico.org
8655     spec:
8656       group: crd.projectcalico.org
8657       names:
8658         kind: BGPConfiguration
8659         listKind: BGPConfigurationList
8660         plural: bgpconfigurations
8661         singular: bgpconfiguration
8662       scope: Cluster
8663       versions:
8664       - name: v1
8665         schema:
8666           openAPIV3Schema:
8667             description: BGPConfiguration contains the configuration for any BGP routing.
8668             properties:
8669               apiVersion:
8670                 description: 'APIVersion defines the versioned schema of this representation
8671                   of an object. Servers should convert recognized schemas to the latest
8672                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
8673                 type: string
8674               kind:
8675                 description: 'Kind is a string value representing the REST resource this
8676                   object represents. Servers may infer this from the endpoint the client
8677                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
8678                 type: string
8679               metadata:
8680                 type: object
8681               spec:
8682                 description: BGPConfigurationSpec contains the values of the BGP configuration.
8683                 properties:
8684                   asNumber:
8685                     description: 'ASNumber is the default AS number used by a node. [Default:
8686                       64512]'
8687                     format: int32
8688                     type: integer
8689                   communities:
8690                     description: Communities is a list of BGP community values and their
8691                       arbitrary names for tagging routes.
8692                     items:
8693                       description: Community contains standard or large community value
8694                         and its name.
8695                       properties:
8696                         name:
8697                           description: Name given to community value.
8698                           type: string
8699                         value:
8700                           description: Value must be of format `aa:nn` or `aa:nn:mm`.
8701                             For standard community use `aa:nn` format, where `aa` and
8702                             `nn` are 16 bit number. For large community use `aa:nn:mm`
8703                             format, where `aa`, `nn` and `mm` are 32 bit number. Where,
8704                             `aa` is an AS Number, `nn` and `mm` are per-AS identifier.
8705                           pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$
8706                           type: string
8707                       type: object
8708                     type: array
8709                   listenPort:
8710                     description: ListenPort is the port where BGP protocol should listen.
8711                       Defaults to 179
8712                     maximum: 65535
8713                     minimum: 1
8714                     type: integer
8715                   logSeverityScreen:
8716                     description: 'LogSeverityScreen is the log severity above which logs
8717                       are sent to the stdout. [Default: INFO]'
8718                     type: string
8719                   nodeToNodeMeshEnabled:
8720                     description: 'NodeToNodeMeshEnabled sets whether full node to node
8721                       BGP mesh is enabled. [Default: true]'
8722                     type: boolean
8723                   prefixAdvertisements:
8724                     description: PrefixAdvertisements contains per-prefix advertisement
8725                       configuration.
8726                     items:
8727                       description: PrefixAdvertisement configures advertisement properties
8728                         for the specified CIDR.
8729                       properties:
8730                         cidr:
8731                           description: CIDR for which properties should be advertised.
8732                           type: string
8733                         communities:
8734                           description: Communities can be list of either community names
8735                             already defined in `Specs.Communities` or community value
8736                             of format `aa:nn` or `aa:nn:mm`. For standard community use
8737                             `aa:nn` format, where `aa` and `nn` are 16 bit number. For
8738                             large community use `aa:nn:mm` format, where `aa`, `nn` and
8739                             `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and
8740                             `mm` are per-AS identifier.
8741                           items:
8742                             type: string
8743                           type: array
8744                       type: object
8745                     type: array
8746                   serviceClusterIPs:
8747                     description: ServiceClusterIPs are the CIDR blocks from which service
8748                       cluster IPs are allocated. If specified, Calico will advertise these
8749                       blocks, as well as any cluster IPs within them.
8750                     items:
8751                       description: ServiceClusterIPBlock represents a single allowed ClusterIP
8752                         CIDR block.
8753                       properties:
8754                         cidr:
8755                           type: string
8756                       type: object
8757                     type: array
8758                   serviceExternalIPs:
8759                     description: ServiceExternalIPs are the CIDR blocks for Kubernetes
8760                       Service External IPs. Kubernetes Service ExternalIPs will only be
8761                       advertised if they are within one of these blocks.
8762                     items:
8763                       description: ServiceExternalIPBlock represents a single allowed
8764                         External IP CIDR block.
8765                       properties:
8766                         cidr:
8767                           type: string
8768                       type: object
8769                     type: array
8770                   serviceLoadBalancerIPs:
8771                     description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes
8772                       Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress
8773                       IPs will only be advertised if they are within one of these blocks.
8774                     items:
8775                       description: ServiceLoadBalancerIPBlock represents a single allowed
8776                         LoadBalancer IP CIDR block.
8777                       properties:
8778                         cidr:
8779                           type: string
8780                       type: object
8781                     type: array
8782                 type: object
8783             type: object
8784         served: true
8785         storage: true
8786     status:
8787       acceptedNames:
8788         kind: ""
8789         plural: ""
8790       conditions: []
8791       storedVersions: []
8792     ---
8793     apiVersion: apiextensions.k8s.io/v1
8794     kind: CustomResourceDefinition
8795     metadata:
8796       name: bgppeers.crd.projectcalico.org
8797     spec:
8798       group: crd.projectcalico.org
8799       names:
8800         kind: BGPPeer
8801         listKind: BGPPeerList
8802         plural: bgppeers
8803         singular: bgppeer
8804       scope: Cluster
8805       versions:
8806       - name: v1
8807         schema:
8808           openAPIV3Schema:
8809             properties:
8810               apiVersion:
8811                 description: 'APIVersion defines the versioned schema of this representation
8812                   of an object. Servers should convert recognized schemas to the latest
8813                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
8814                 type: string
8815               kind:
8816                 description: 'Kind is a string value representing the REST resource this
8817                   object represents. Servers may infer this from the endpoint the client
8818                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
8819                 type: string
8820               metadata:
8821                 type: object
8822               spec:
8823                 description: BGPPeerSpec contains the specification for a BGPPeer resource.
8824                 properties:
8825                   asNumber:
8826                     description: The AS Number of the peer.
8827                     format: int32
8828                     type: integer
8829                   keepOriginalNextHop:
8830                     description: Option to keep the original nexthop field when routes
8831                       are sent to a BGP Peer. Setting "true" configures the selected BGP
8832                       Peers node to use the "next hop keep;" instead of "next hop self;"(default)
8833                       in the specific branch of the Node on "bird.cfg".
8834                     type: boolean
8835                   maxRestartTime:
8836                     description: Time to allow for software restart.  When specified,
8837                       this is configured as the graceful restart timeout.  When not specified,
8838                       the BIRD default of 120s is used.
8839                     type: string
8840                   node:
8841                     description: The node name identifying the Calico node instance that
8842                       is targeted by this peer. If this is not set, and no nodeSelector
8843                       is specified, then this BGP peer selects all nodes in the cluster.
8844                     type: string
8845                   nodeSelector:
8846                     description: Selector for the nodes that should have this peering.  When
8847                       this is set, the Node field must be empty.
8848                     type: string
8849                   password:
8850                     description: Optional BGP password for the peerings generated by this
8851                       BGPPeer resource.
8852                     properties:
8853                       secretKeyRef:
8854                         description: Selects a key of a secret in the node pod's namespace.
8855                         properties:
8856                           key:
8857                             description: The key of the secret to select from.  Must be
8858                               a valid secret key.
8859                             type: string
8860                           name:
8861                             description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
8862                               TODO: Add other useful fields. apiVersion, kind, uid?'
8863                             type: string
8864                           optional:
8865                             description: Specify whether the Secret or its key must be
8866                               defined
8867                             type: boolean
8868                         required:
8869                         - key
8870                         type: object
8871                     type: object
8872                   peerIP:
8873                     description: The IP address of the peer followed by an optional port
8874                       number to peer with. If port number is given, format should be `[<IPv6>]:port`
8875                       or `<IPv4>:<port>` for IPv4. If optional port number is not set,
8876                       and this peer IP and ASNumber belongs to a calico/node with ListenPort
8877                       set in BGPConfiguration, then we use that port to peer.
8878                     type: string
8879                   peerSelector:
8880                     description: Selector for the remote nodes to peer with.  When this
8881                       is set, the PeerIP and ASNumber fields must be empty.  For each
8882                       peering between the local node and selected remote nodes, we configure
8883                       an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified,
8884                       and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified.  The
8885                       remote AS number comes from the remote node's NodeBGPSpec.ASNumber,
8886                       or the global default if that is not set.
8887                     type: string
8888                   sourceAddress:
8889                     description: Specifies whether and how to configure a source address
8890                       for the peerings generated by this BGPPeer resource.  Default value
8891                       "UseNodeIP" means to configure the node IP as the source address.  "None"
8892                       means not to configure a source address.
8893                     type: string
8894                 type: object
8895             type: object
8896         served: true
8897         storage: true
8898     status:
8899       acceptedNames:
8900         kind: ""
8901         plural: ""
8902       conditions: []
8903       storedVersions: []
8904     ---
8905     apiVersion: apiextensions.k8s.io/v1
8906     kind: CustomResourceDefinition
8907     metadata:
8908       name: blockaffinities.crd.projectcalico.org
8909     spec:
8910       group: crd.projectcalico.org
8911       names:
8912         kind: BlockAffinity
8913         listKind: BlockAffinityList
8914         plural: blockaffinities
8915         singular: blockaffinity
8916       scope: Cluster
8917       versions:
8918       - name: v1
8919         schema:
8920           openAPIV3Schema:
8921             properties:
8922               apiVersion:
8923                 description: 'APIVersion defines the versioned schema of this representation
8924                   of an object. Servers should convert recognized schemas to the latest
8925                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
8926                 type: string
8927               kind:
8928                 description: 'Kind is a string value representing the REST resource this
8929                   object represents. Servers may infer this from the endpoint the client
8930                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
8931                 type: string
8932               metadata:
8933                 type: object
8934               spec:
8935                 description: BlockAffinitySpec contains the specification for a BlockAffinity
8936                   resource.
8937                 properties:
8938                   cidr:
8939                     type: string
8940                   deleted:
8941                     description: Deleted indicates that this block affinity is being deleted.
8942                       This field is a string for compatibility with older releases that
8943                       mistakenly treat this field as a string.
8944                     type: string
8945                   node:
8946                     type: string
8947                   state:
8948                     type: string
8949                 required:
8950                 - cidr
8951                 - deleted
8952                 - node
8953                 - state
8954                 type: object
8955             type: object
8956         served: true
8957         storage: true
8958     status:
8959       acceptedNames:
8960         kind: ""
8961         plural: ""
8962       conditions: []
8963       storedVersions: []
8964     ---
8965     apiVersion: apiextensions.k8s.io/v1
8966     kind: CustomResourceDefinition
8967     metadata:
8968       annotations:
8969         controller-gen.kubebuilder.io/version: (devel)
8970       creationTimestamp: null
8971       name: caliconodestatuses.crd.projectcalico.org
8972     spec:
8973       group: crd.projectcalico.org
8974       names:
8975         kind: CalicoNodeStatus
8976         listKind: CalicoNodeStatusList
8977         plural: caliconodestatuses
8978         singular: caliconodestatus
8979       scope: Cluster
8980       versions:
8981       - name: v1
8982         schema:
8983           openAPIV3Schema:
8984             properties:
8985               apiVersion:
8986                 description: 'APIVersion defines the versioned schema of this representation
8987                   of an object. Servers should convert recognized schemas to the latest
8988                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
8989                 type: string
8990               kind:
8991                 description: 'Kind is a string value representing the REST resource this
8992                   object represents. Servers may infer this from the endpoint the client
8993                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
8994                 type: string
8995               metadata:
8996                 type: object
8997               spec:
8998                 description: CalicoNodeStatusSpec contains the specification for a CalicoNodeStatus
8999                   resource.
9000                 properties:
9001                   classes:
9002                     description: Classes declares the types of information to monitor
9003                       for this calico/node, and allows for selective status reporting
9004                       about certain subsets of information.
9005                     items:
9006                       type: string
9007                     type: array
9008                   node:
9009                     description: The node name identifies the Calico node instance for
9010                       node status.
9011                     type: string
9012                   updatePeriodSeconds:
9013                     description: UpdatePeriodSeconds is the period at which CalicoNodeStatus
9014                       should be updated. Set to 0 to disable CalicoNodeStatus refresh.
9015                       Maximum update period is one day.
9016                     format: int32
9017                     type: integer
9018                 type: object
9019               status:
9020                 description: CalicoNodeStatusStatus defines the observed state of CalicoNodeStatus.
9021                   No validation needed for status since it is updated by Calico.
9022                 properties:
9023                   agent:
9024                     description: Agent holds agent status on the node.
9025                     properties:
9026                       birdV4:
9027                         description: BIRDV4 represents the latest observed status of bird4.
9028                         properties:
9029                           lastBootTime:
9030                             description: LastBootTime holds the value of lastBootTime
9031                               from bird.ctl output.
9032                             type: string
9033                           lastReconfigurationTime:
9034                             description: LastReconfigurationTime holds the value of lastReconfigTime
9035                               from bird.ctl output.
9036                             type: string
9037                           routerID:
9038                             description: Router ID used by bird.
9039                             type: string
9040                           state:
9041                             description: The state of the BGP Daemon.
9042                             type: string
9043                           version:
9044                             description: Version of the BGP daemon
9045                             type: string
9046                         type: object
9047                       birdV6:
9048                         description: BIRDV6 represents the latest observed status of bird6.
9049                         properties:
9050                           lastBootTime:
9051                             description: LastBootTime holds the value of lastBootTime
9052                               from bird.ctl output.
9053                             type: string
9054                           lastReconfigurationTime:
9055                             description: LastReconfigurationTime holds the value of lastReconfigTime
9056                               from bird.ctl output.
9057                             type: string
9058                           routerID:
9059                             description: Router ID used by bird.
9060                             type: string
9061                           state:
9062                             description: The state of the BGP Daemon.
9063                             type: string
9064                           version:
9065                             description: Version of the BGP daemon
9066                             type: string
9067                         type: object
9068                     type: object
9069                   bgp:
9070                     description: BGP holds node BGP status.
9071                     properties:
9072                       numberEstablishedV4:
9073                         description: The total number of IPv4 established bgp sessions.
9074                         type: integer
9075                       numberEstablishedV6:
9076                         description: The total number of IPv6 established bgp sessions.
9077                         type: integer
9078                       numberNotEstablishedV4:
9079                         description: The total number of IPv4 non-established bgp sessions.
9080                         type: integer
9081                       numberNotEstablishedV6:
9082                         description: The total number of IPv6 non-established bgp sessions.
9083                         type: integer
9084                       peersV4:
9085                         description: PeersV4 represents IPv4 BGP peers status on the node.
9086                         items:
9087                           description: CalicoNodePeer contains the status of BGP peers
9088                             on the node.
9089                           properties:
9090                             peerIP:
9091                               description: IP address of the peer whose condition we are
9092                                 reporting.
9093                               type: string
9094                             since:
9095                               description: Since the state or reason last changed.
9096                               type: string
9097                             state:
9098                               description: State is the BGP session state.
9099                               type: string
9100                             type:
9101                               description: Type indicates whether this peer is configured
9102                                 via the node-to-node mesh, or via en explicit global or
9103                                 per-node BGPPeer object.
9104                               type: string
9105                           type: object
9106                         type: array
9107                       peersV6:
9108                         description: PeersV6 represents IPv6 BGP peers status on the node.
9109                         items:
9110                           description: CalicoNodePeer contains the status of BGP peers
9111                             on the node.
9112                           properties:
9113                             peerIP:
9114                               description: IP address of the peer whose condition we are
9115                                 reporting.
9116                               type: string
9117                             since:
9118                               description: Since the state or reason last changed.
9119                               type: string
9120                             state:
9121                               description: State is the BGP session state.
9122                               type: string
9123                             type:
9124                               description: Type indicates whether this peer is configured
9125                                 via the node-to-node mesh, or via en explicit global or
9126                                 per-node BGPPeer object.
9127                               type: string
9128                           type: object
9129                         type: array
9130                     required:
9131                     - numberEstablishedV4
9132                     - numberEstablishedV6
9133                     - numberNotEstablishedV4
9134                     - numberNotEstablishedV6
9135                     type: object
9136                   lastUpdated:
9137                     description: LastUpdated is a timestamp representing the server time
9138                       when CalicoNodeStatus object last updated. It is represented in
9139                       RFC3339 form and is in UTC.
9140                     format: date-time
9141                     nullable: true
9142                     type: string
9143                   routes:
9144                     description: Routes reports routes known to the Calico BGP daemon
9145                       on the node.
9146                     properties:
9147                       routesV4:
9148                         description: RoutesV4 represents IPv4 routes on the node.
9149                         items:
9150                           description: CalicoNodeRoute contains the status of BGP routes
9151                             on the node.
9152                           properties:
9153                             destination:
9154                               description: Destination of the route.
9155                               type: string
9156                             gateway:
9157                               description: Gateway for the destination.
9158                               type: string
9159                             interface:
9160                               description: Interface for the destination
9161                               type: string
9162                             learnedFrom:
9163                               description: LearnedFrom contains information regarding
9164                                 where this route originated.
9165                               properties:
9166                                 peerIP:
9167                                   description: If sourceType is NodeMesh or BGPPeer, IP
9168                                     address of the router that sent us this route.
9169                                   type: string
9170                                 sourceType:
9171                                   description: Type of the source where a route is learned
9172                                     from.
9173                                   type: string
9174                               type: object
9175                             type:
9176                               description: Type indicates if the route is being used for
9177                                 forwarding or not.
9178                               type: string
9179                           type: object
9180                         type: array
9181                       routesV6:
9182                         description: RoutesV6 represents IPv6 routes on the node.
9183                         items:
9184                           description: CalicoNodeRoute contains the status of BGP routes
9185                             on the node.
9186                           properties:
9187                             destination:
9188                               description: Destination of the route.
9189                               type: string
9190                             gateway:
9191                               description: Gateway for the destination.
9192                               type: string
9193                             interface:
9194                               description: Interface for the destination
9195                               type: string
9196                             learnedFrom:
9197                               description: LearnedFrom contains information regarding
9198                                 where this route originated.
9199                               properties:
9200                                 peerIP:
9201                                   description: If sourceType is NodeMesh or BGPPeer, IP
9202                                     address of the router that sent us this route.
9203                                   type: string
9204                                 sourceType:
9205                                   description: Type of the source where a route is learned
9206                                     from.
9207                                   type: string
9208                               type: object
9209                             type:
9210                               description: Type indicates if the route is being used for
9211                                 forwarding or not.
9212                               type: string
9213                           type: object
9214                         type: array
9215                     type: object
9216                 type: object
9217             type: object
9218         served: true
9219         storage: true
9220     status:
9221       acceptedNames:
9222         kind: ""
9223         plural: ""
9224       conditions: []
9225       storedVersions: []
9226     ---
9227     apiVersion: apiextensions.k8s.io/v1
9228     kind: CustomResourceDefinition
9229     metadata:
9230       name: clusterinformations.crd.projectcalico.org
9231     spec:
9232       group: crd.projectcalico.org
9233       names:
9234         kind: ClusterInformation
9235         listKind: ClusterInformationList
9236         plural: clusterinformations
9237         singular: clusterinformation
9238       scope: Cluster
9239       versions:
9240       - name: v1
9241         schema:
9242           openAPIV3Schema:
9243             description: ClusterInformation contains the cluster specific information.
9244             properties:
9245               apiVersion:
9246                 description: 'APIVersion defines the versioned schema of this representation
9247                   of an object. Servers should convert recognized schemas to the latest
9248                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
9249                 type: string
9250               kind:
9251                 description: 'Kind is a string value representing the REST resource this
9252                   object represents. Servers may infer this from the endpoint the client
9253                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
9254                 type: string
9255               metadata:
9256                 type: object
9257               spec:
9258                 description: ClusterInformationSpec contains the values of describing
9259                   the cluster.
9260                 properties:
9261                   calicoVersion:
9262                     description: CalicoVersion is the version of Calico that the cluster
9263                       is running
9264                     type: string
9265                   clusterGUID:
9266                     description: ClusterGUID is the GUID of the cluster
9267                     type: string
9268                   clusterType:
9269                     description: ClusterType describes the type of the cluster
9270                     type: string
9271                   datastoreReady:
9272                     description: DatastoreReady is used during significant datastore migrations
9273                       to signal to components such as Felix that it should wait before
9274                       accessing the datastore.
9275                     type: boolean
9276                   variant:
9277                     description: Variant declares which variant of Calico should be active.
9278                     type: string
9279                 type: object
9280             type: object
9281         served: true
9282         storage: true
9283     status:
9284       acceptedNames:
9285         kind: ""
9286         plural: ""
9287       conditions: []
9288       storedVersions: []
9289     ---
9290     apiVersion: apiextensions.k8s.io/v1
9291     kind: CustomResourceDefinition
9292     metadata:
9293       name: felixconfigurations.crd.projectcalico.org
9294     spec:
9295       group: crd.projectcalico.org
9296       names:
9297         kind: FelixConfiguration
9298         listKind: FelixConfigurationList
9299         plural: felixconfigurations
9300         singular: felixconfiguration
9301       scope: Cluster
9302       versions:
9303       - name: v1
9304         schema:
9305           openAPIV3Schema:
9306             description: Felix Configuration contains the configuration for Felix.
9307             properties:
9308               apiVersion:
9309                 description: 'APIVersion defines the versioned schema of this representation
9310                   of an object. Servers should convert recognized schemas to the latest
9311                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
9312                 type: string
9313               kind:
9314                 description: 'Kind is a string value representing the REST resource this
9315                   object represents. Servers may infer this from the endpoint the client
9316                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
9317                 type: string
9318               metadata:
9319                 type: object
9320               spec:
9321                 description: FelixConfigurationSpec contains the values of the Felix configuration.
9322                 properties:
9323                   allowIPIPPacketsFromWorkloads:
9324                     description: 'AllowIPIPPacketsFromWorkloads controls whether Felix
9325                       will add a rule to drop IPIP encapsulated traffic from workloads
9326                       [Default: false]'
9327                     type: boolean
9328                   allowVXLANPacketsFromWorkloads:
9329                     description: 'AllowVXLANPacketsFromWorkloads controls whether Felix
9330                       will add a rule to drop VXLAN encapsulated traffic from workloads
9331                       [Default: false]'
9332                     type: boolean
9333                   awsSrcDstCheck:
9334                     description: 'Set source-destination-check on AWS EC2 instances. Accepted
9335                       value must be one of "DoNothing", "Enable" or "Disable". [Default:
9336                       DoNothing]'
9337                     enum:
9338                     - DoNothing
9339                     - Enable
9340                     - Disable
9341                     type: string
9342                   bpfConnectTimeLoadBalancingEnabled:
9343                     description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode,
9344                       controls whether Felix installs the connection-time load balancer.  The
9345                       connect-time load balancer is required for the host to be able to
9346                       reach Kubernetes services and it improves the performance of pod-to-service
9347                       connections.  The only reason to disable it is for debugging purposes.  [Default:
9348                       true]'
9349                     type: boolean
9350                   bpfDataIfacePattern:
9351                     description: BPFDataIfacePattern is a regular expression that controls
9352                       which interfaces Felix should attach BPF programs to in order to
9353                       catch traffic to/from the network.  This needs to match the interfaces
9354                       that Calico workload traffic flows over as well as any interfaces
9355                       that handle incoming traffic to nodeports and services from outside
9356                       the cluster.  It should not match the workload interfaces (usually
9357                       named cali...).
9358                     type: string
9359                   bpfDisableUnprivileged:
9360                     description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled
9361                       sysctl to disable unprivileged use of BPF.  This ensures that unprivileged
9362                       users cannot access Calico''s BPF maps and cannot insert their own
9363                       BPF programs to interfere with Calico''s. [Default: true]'
9364                     type: boolean
9365                   bpfEnabled:
9366                     description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
9367                       [Default: false]'
9368                     type: boolean
9369                   bpfExtToServiceConnmark:
9370                     description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit
9371                       mark that is set on connections from an external client to a local
9372                       service. This mark allows us to control how packets of that connection
9373                       are routed within the host and how is routing intepreted by RPF
9374                       check. [Default: 0]'
9375                     type: integer
9376                   bpfExternalServiceMode:
9377                     description: 'BPFExternalServiceMode in BPF mode, controls how connections
9378                       from outside the cluster to services (node ports and cluster IPs)
9379                       are forwarded to remote workloads.  If set to "Tunnel" then both
9380                       request and response traffic is tunneled to the remote node.  If
9381                       set to "DSR", the request traffic is tunneled but the response traffic
9382                       is sent directly from the remote node.  In "DSR" mode, the remote
9383                       node appears to use the IP of the ingress node; this requires a
9384                       permissive L2 network.  [Default: Tunnel]'
9385                     type: string
9386                   bpfKubeProxyEndpointSlicesEnabled:
9387                     description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
9388                       whether Felix's embedded kube-proxy accepts EndpointSlices or not.
9389                     type: boolean
9390                   bpfKubeProxyIptablesCleanupEnabled:
9391                     description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF
9392                       mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s
9393                       iptables chains.  Should only be enabled if kube-proxy is not running.  [Default:
9394                       true]'
9395                     type: boolean
9396                   bpfKubeProxyMinSyncPeriod:
9397                     description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the
9398                       minimum time between updates to the dataplane for Felix''s embedded
9399                       kube-proxy.  Lower values give reduced set-up latency.  Higher values
9400                       reduce Felix CPU usage by batching up more work.  [Default: 1s]'
9401                     type: string
9402                   bpfLogLevel:
9403                     description: 'BPFLogLevel controls the log level of the BPF programs
9404                       when in BPF dataplane mode.  One of "Off", "Info", or "Debug".  The
9405                       logs are emitted to the BPF trace pipe, accessible with the command
9406                       `tc exec bpf debug`. [Default: Off].'
9407                     type: string
9408                   chainInsertMode:
9409                     description: 'ChainInsertMode controls whether Felix hooks the kernel''s
9410                       top-level iptables chains by inserting a rule at the top of the
9411                       chain or by appending a rule at the bottom. insert is the safe default
9412                       since it prevents Calico''s rules from being bypassed. If you switch
9413                       to append mode, be sure that the other rules in the chains signal
9414                       acceptance by falling through to the Calico rules, otherwise the
9415                       Calico policy will be bypassed. [Default: insert]'
9416                     type: string
9417                   dataplaneDriver:
9418                     type: string
9419                   debugDisableLogDropping:
9420                     type: boolean
9421                   debugMemoryProfilePath:
9422                     type: string
9423                   debugSimulateCalcGraphHangAfter:
9424                     type: string
9425                   debugSimulateDataplaneHangAfter:
9426                     type: string
9427                   defaultEndpointToHostAction:
9428                     description: 'DefaultEndpointToHostAction controls what happens to
9429                       traffic that goes from a workload endpoint to the host itself (after
9430                       the traffic hits the endpoint egress policy). By default Calico
9431                       blocks traffic from workload endpoints to the host itself with an
9432                       iptables "DROP" action. If you want to allow some or all traffic
9433                       from endpoint to host, set this parameter to RETURN or ACCEPT. Use
9434                       RETURN if you have your own rules in the iptables "INPUT" chain;
9435                       Calico will insert its rules at the top of that chain, then "RETURN"
9436                       packets to the "INPUT" chain once it has completed processing workload
9437                       endpoint egress policy. Use ACCEPT to unconditionally accept packets
9438                       from workloads after processing workload endpoint egress policy.
9439                       [Default: Drop]'
9440                     type: string
9441                   deviceRouteProtocol:
9442                     description: This defines the route protocol added to programmed device
9443                       routes, by default this will be RTPROT_BOOT when left blank.
9444                     type: integer
9445                   deviceRouteSourceAddress:
9446                     description: This is the source address to use on programmed device
9447                       routes. By default the source address is left blank, leaving the
9448                       kernel to choose the source address used.
9449                     type: string
9450                   disableConntrackInvalidCheck:
9451                     type: boolean
9452                   endpointReportingDelay:
9453                     type: string
9454                   endpointReportingEnabled:
9455                     type: boolean
9456                   externalNodesList:
9457                     description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes
9458                       which may source tunnel traffic and have the tunneled traffic be
9459                       accepted at calico nodes.
9460                     items:
9461                       type: string
9462                     type: array
9463                   failsafeInboundHostPorts:
9464                     description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports
9465                       and CIDRs that Felix will allow incoming traffic to host endpoints
9466                       on irrespective of the security policy. This is useful to avoid
9467                       accidentally cutting off a host with incorrect configuration. For
9468                       back-compatibility, if the protocol is not specified, it defaults
9469                       to "tcp". If a CIDR is not specified, it will allow traffic from
9470                       all addresses. To disable all inbound host ports, use the value
9471                       none. The default value allows ssh access and DHCP. [Default: tcp:22,
9472                       udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
9473                     items:
9474                       description: ProtoPort is combination of protocol, port, and CIDR.
9475                         Protocol and port must be specified.
9476                       properties:
9477                         net:
9478                           type: string
9479                         port:
9480                           type: integer
9481                         protocol:
9482                           type: string
9483                       required:
9484                       - port
9485                       - protocol
9486                       type: object
9487                     type: array
9488                   failsafeOutboundHostPorts:
9489                     description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports
9490                       and CIDRs that Felix will allow outgoing traffic from host endpoints
9491                       to irrespective of the security policy. This is useful to avoid
9492                       accidentally cutting off a host with incorrect configuration. For
9493                       back-compatibility, if the protocol is not specified, it defaults
9494                       to "tcp". If a CIDR is not specified, it will allow traffic from
9495                       all addresses. To disable all outbound host ports, use the value
9496                       none. The default value opens etcd''s standard ports to ensure that
9497                       Felix does not get cut off from etcd as well as allowing DHCP and
9498                       DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666,
9499                       tcp:6667, udp:53, udp:67]'
9500                     items:
9501                       description: ProtoPort is combination of protocol, port, and CIDR.
9502                         Protocol and port must be specified.
9503                       properties:
9504                         net:
9505                           type: string
9506                         port:
9507                           type: integer
9508                         protocol:
9509                           type: string
9510                       required:
9511                       - port
9512                       - protocol
9513                       type: object
9514                     type: array
9515                   featureDetectOverride:
9516                     description: FeatureDetectOverride is used to override the feature
9517                       detection. Values are specified in a comma separated list with no
9518                       spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=".
9519                       "true" or "false" will force the feature, empty or omitted values
9520                       are auto-detected.
9521                     type: string
9522                   genericXDPEnabled:
9523                     description: 'GenericXDPEnabled enables Generic XDP so network cards
9524                       that don''t support XDP offload or driver modes can use XDP. This
9525                       is not recommended since it doesn''t provide better performance
9526                       than iptables. [Default: false]'
9527                     type: boolean
9528                   healthEnabled:
9529                     type: boolean
9530                   healthHost:
9531                     type: string
9532                   healthPort:
9533                     type: integer
9534                   interfaceExclude:
9535                     description: 'InterfaceExclude is a comma-separated list of interfaces
9536                       that Felix should exclude when monitoring for host endpoints. The
9537                       default value ensures that Felix ignores Kubernetes'' IPVS dummy
9538                       interface, which is used internally by kube-proxy. If you want to
9539                       exclude multiple interface names using a single value, the list
9540                       supports regular expressions. For regular expressions you must wrap
9541                       the value with ''/''. For example having values ''/^kube/,veth1''
9542                       will exclude all interfaces that begin with ''kube'' and also the
9543                       interface ''veth1''. [Default: kube-ipvs0]'
9544                     type: string
9545                   interfacePrefix:
9546                     description: 'InterfacePrefix is the interface name prefix that identifies
9547                       workload endpoints and so distinguishes them from host endpoint
9548                       interfaces. Note: in environments other than bare metal, the orchestrators
9549                       configure this appropriately. For example our Kubernetes and Docker
9550                       integrations set the ''cali'' value, and our OpenStack integration
9551                       sets the ''tap'' value. [Default: cali]'
9552                     type: string
9553                   interfaceRefreshInterval:
9554                     description: InterfaceRefreshInterval is the period at which Felix
9555                       rescans local interfaces to verify their state. The rescan can be
9556                       disabled by setting the interval to 0.
9557                     type: string
9558                   ipipEnabled:
9559                     type: boolean
9560                   ipipMTU:
9561                     description: 'IPIPMTU is the MTU to set on the tunnel device. See
9562                       Configuring MTU [Default: 1440]'
9563                     type: integer
9564                   ipsetsRefreshInterval:
9565                     description: 'IpsetsRefreshInterval is the period at which Felix re-checks
9566                       all iptables state to ensure that no other process has accidentally
9567                       broken Calico''s rules. Set to 0 to disable iptables refresh. [Default:
9568                       90s]'
9569                     type: string
9570                   iptablesBackend:
9571                     description: IptablesBackend specifies which backend of iptables will
9572                       be used. The default is legacy.
9573                     type: string
9574                   iptablesFilterAllowAction:
9575                     type: string
9576                   iptablesLockFilePath:
9577                     description: 'IptablesLockFilePath is the location of the iptables
9578                       lock file. You may need to change this if the lock file is not in
9579                       its standard location (for example if you have mapped it into Felix''s
9580                       container at a different path). [Default: /run/xtables.lock]'
9581                     type: string
9582                   iptablesLockProbeInterval:
9583                     description: 'IptablesLockProbeInterval is the time that Felix will
9584                       wait between attempts to acquire the iptables lock if it is not
9585                       available. Lower values make Felix more responsive when the lock
9586                       is contended, but use more CPU. [Default: 50ms]'
9587                     type: string
9588                   iptablesLockTimeout:
9589                     description: 'IptablesLockTimeout is the time that Felix will wait
9590                       for the iptables lock, or 0, to disable. To use this feature, Felix
9591                       must share the iptables lock file with all other processes that
9592                       also take the lock. When running Felix inside a container, this
9593                       requires the /run directory of the host to be mounted into the calico/node
9594                       or calico/felix container. [Default: 0s disabled]'
9595                     type: string
9596                   iptablesMangleAllowAction:
9597                     type: string
9598                   iptablesMarkMask:
9599                     description: 'IptablesMarkMask is the mask that Felix selects its
9600                       IPTables Mark bits from. Should be a 32 bit hexadecimal number with
9601                       at least 8 bits set, none of which clash with any other mark bits
9602                       in use on the system. [Default: 0xff000000]'
9603                     format: int32
9604                     type: integer
9605                   iptablesNATOutgoingInterfaceFilter:
9606                     type: string
9607                   iptablesPostWriteCheckInterval:
9608                     description: 'IptablesPostWriteCheckInterval is the period after Felix
9609                       has done a write to the dataplane that it schedules an extra read
9610                       back in order to check the write was not clobbered by another process.
9611                       This should only occur if another application on the system doesn''t
9612                       respect the iptables lock. [Default: 1s]'
9613                     type: string
9614                   iptablesRefreshInterval:
9615                     description: 'IptablesRefreshInterval is the period at which Felix
9616                       re-checks the IP sets in the dataplane to ensure that no other process
9617                       has accidentally broken Calico''s rules. Set to 0 to disable IP
9618                       sets refresh. Note: the default for this value is lower than the
9619                       other refresh intervals as a workaround for a Linux kernel bug that
9620                       was fixed in kernel version 4.11. If you are using v4.11 or greater
9621                       you may want to set this to, a higher value to reduce Felix CPU
9622                       usage. [Default: 10s]'
9623                     type: string
9624                   ipv6Support:
9625                     type: boolean
9626                   kubeNodePortRanges:
9627                     description: 'KubeNodePortRanges holds list of port ranges used for
9628                       service node ports. Only used if felix detects kube-proxy running
9629                       in ipvs mode. Felix uses these ranges to separate host and workload
9630                       traffic. [Default: 30000:32767].'
9631                     items:
9632                       anyOf:
9633                       - type: integer
9634                       - type: string
9635                       pattern: ^.*
9636                       x-kubernetes-int-or-string: true
9637                     type: array
9638                   logFilePath:
9639                     description: 'LogFilePath is the full path to the Felix log. Set to
9640                       none to disable file logging. [Default: /var/log/calico/felix.log]'
9641                     type: string
9642                   logPrefix:
9643                     description: 'LogPrefix is the log prefix that Felix uses when rendering
9644                       LOG rules. [Default: calico-packet]'
9645                     type: string
9646                   logSeverityFile:
9647                     description: 'LogSeverityFile is the log severity above which logs
9648                       are sent to the log file. [Default: Info]'
9649                     type: string
9650                   logSeverityScreen:
9651                     description: 'LogSeverityScreen is the log severity above which logs
9652                       are sent to the stdout. [Default: Info]'
9653                     type: string
9654                   logSeveritySys:
9655                     description: 'LogSeveritySys is the log severity above which logs
9656                       are sent to the syslog. Set to None for no logging to syslog. [Default:
9657                       Info]'
9658                     type: string
9659                   maxIpsetSize:
9660                     type: integer
9661                   metadataAddr:
9662                     description: 'MetadataAddr is the IP address or domain name of the
9663                       server that can answer VM queries for cloud-init metadata. In OpenStack,
9664                       this corresponds to the machine running nova-api (or in Ubuntu,
9665                       nova-api-metadata). A value of none (case insensitive) means that
9666                       Felix should not set up any NAT rule for the metadata path. [Default:
9667                       127.0.0.1]'
9668                     type: string
9669                   metadataPort:
9670                     description: 'MetadataPort is the port of the metadata server. This,
9671                       combined with global.MetadataAddr (if not ''None''), is used to
9672                       set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
9673                       In most cases this should not need to be changed [Default: 8775].'
9674                     type: integer
9675                   mtuIfacePattern:
9676                     description: MTUIfacePattern is a regular expression that controls
9677                       which interfaces Felix should scan in order to calculate the host's
9678                       MTU. This should not match workload interfaces (usually named cali...).
9679                     type: string
9680                   natOutgoingAddress:
9681                     description: NATOutgoingAddress specifies an address to use when performing
9682                       source NAT for traffic in a natOutgoing pool that is leaving the
9683                       network. By default the address used is an address on the interface
9684                       the traffic is leaving on (ie it uses the iptables MASQUERADE target)
9685                     type: string
9686                   natPortRange:
9687                     anyOf:
9688                     - type: integer
9689                     - type: string
9690                     description: NATPortRange specifies the range of ports that is used
9691                       for port mapping when doing outgoing NAT. When unset the default
9692                       behavior of the network stack is used.
9693                     pattern: ^.*
9694                     x-kubernetes-int-or-string: true
9695                   netlinkTimeout:
9696                     type: string
9697                   openstackRegion:
9698                     description: 'OpenstackRegion is the name of the region that a particular
9699                       Felix belongs to. In a multi-region Calico/OpenStack deployment,
9700                       this must be configured somehow for each Felix (here in the datamodel,
9701                       or in felix.cfg or the environment on each compute node), and must
9702                       match the [calico] openstack_region value configured in neutron.conf
9703                       on each node. [Default: Empty]'
9704                     type: string
9705                   policySyncPathPrefix:
9706                     description: 'PolicySyncPathPrefix is used to by Felix to communicate
9707                       policy changes to external services, like Application layer policy.
9708                       [Default: Empty]'
9709                     type: string
9710                   prometheusGoMetricsEnabled:
9711                     description: 'PrometheusGoMetricsEnabled disables Go runtime metrics
9712                       collection, which the Prometheus client does by default, when set
9713                       to false. This reduces the number of metrics reported, reducing
9714                       Prometheus load. [Default: true]'
9715                     type: boolean
9716                   prometheusMetricsEnabled:
9717                     description: 'PrometheusMetricsEnabled enables the Prometheus metrics
9718                       server in Felix if set to true. [Default: false]'
9719                     type: boolean
9720                   prometheusMetricsHost:
9721                     description: 'PrometheusMetricsHost is the host that the Prometheus
9722                       metrics server should bind to. [Default: empty]'
9723                     type: string
9724                   prometheusMetricsPort:
9725                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
9726                       metrics server should bind to. [Default: 9091]'
9727                     type: integer
9728                   prometheusProcessMetricsEnabled:
9729                     description: 'PrometheusProcessMetricsEnabled disables process metrics
9730                       collection, which the Prometheus client does by default, when set
9731                       to false. This reduces the number of metrics reported, reducing
9732                       Prometheus load. [Default: true]'
9733                     type: boolean
9734                   prometheusWireGuardMetricsEnabled:
9735                     description: 'PrometheusWireGuardMetricsEnabled disables wireguard
9736                       metrics collection, which the Prometheus client does by default,
9737                       when set to false. This reduces the number of metrics reported,
9738                       reducing Prometheus load. [Default: true]'
9739                     type: boolean
9740                   removeExternalRoutes:
9741                     description: Whether or not to remove device routes that have not
9742                       been programmed by Felix. Disabling this will allow external applications
9743                       to also add device routes. This is enabled by default which means
9744                       we will remove externally added routes.
9745                     type: boolean
9746                   reportingInterval:
9747                     description: 'ReportingInterval is the interval at which Felix reports
9748                       its status into the datastore or 0 to disable. Must be non-zero
9749                       in OpenStack deployments. [Default: 30s]'
9750                     type: string
9751                   reportingTTL:
9752                     description: 'ReportingTTL is the time-to-live setting for process-wide
9753                       status reports. [Default: 90s]'
9754                     type: string
9755                   routeRefreshInterval:
9756                     description: 'RouteRefreshInterval is the period at which Felix re-checks
9757                       the routes in the dataplane to ensure that no other process has
9758                       accidentally broken Calico''s rules. Set to 0 to disable route refresh.
9759                       [Default: 90s]'
9760                     type: string
9761                   routeSource:
9762                     description: 'RouteSource configures where Felix gets its routing
9763                       information. - WorkloadIPs: use workload endpoints to construct
9764                       routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
9765                     type: string
9766                   routeTableRange:
9767                     description: Calico programs additional Linux route tables for various
9768                       purposes.  RouteTableRange specifies the indices of the route tables
9769                       that Calico should use.
9770                     properties:
9771                       max:
9772                         type: integer
9773                       min:
9774                         type: integer
9775                     required:
9776                     - max
9777                     - min
9778                     type: object
9779                   serviceLoopPrevention:
9780                     description: 'When service IP advertisement is enabled, prevent routing
9781                       loops to service IPs that are not in use, by dropping or rejecting
9782                       packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled",
9783                       in which case such routing loops continue to be allowed. [Default:
9784                       Drop]'
9785                     type: string
9786                   sidecarAccelerationEnabled:
9787                     description: 'SidecarAccelerationEnabled enables experimental sidecar
9788                       acceleration [Default: false]'
9789                     type: boolean
9790                   usageReportingEnabled:
9791                     description: 'UsageReportingEnabled reports anonymous Calico version
9792                       number and cluster size to projectcalico.org. Logs warnings returned
9793                       by the usage server. For example, if a significant security vulnerability
9794                       has been discovered in the version of Calico being used. [Default:
9795                       true]'
9796                     type: boolean
9797                   usageReportingInitialDelay:
9798                     description: 'UsageReportingInitialDelay controls the minimum delay
9799                       before Felix makes a report. [Default: 300s]'
9800                     type: string
9801                   usageReportingInterval:
9802                     description: 'UsageReportingInterval controls the interval at which
9803                       Felix makes reports. [Default: 86400s]'
9804                     type: string
9805                   useInternalDataplaneDriver:
9806                     type: boolean
9807                   vxlanEnabled:
9808                     type: boolean
9809                   vxlanMTU:
9810                     description: 'VXLANMTU is the MTU to set on the tunnel device. See
9811                       Configuring MTU [Default: 1440]'
9812                     type: integer
9813                   vxlanPort:
9814                     type: integer
9815                   vxlanVNI:
9816                     type: integer
9817                   wireguardEnabled:
9818                     description: 'WireguardEnabled controls whether Wireguard is enabled.
9819                       [Default: false]'
9820                     type: boolean
9821                   wireguardHostEncryptionEnabled:
9822                     description: 'WireguardHostEncryptionEnabled controls whether Wireguard
9823                       host-to-host encryption is enabled. [Default: false]'
9824                     type: boolean
9825                   wireguardInterfaceName:
9826                     description: 'WireguardInterfaceName specifies the name to use for
9827                       the Wireguard interface. [Default: wg.calico]'
9828                     type: string
9829                   wireguardListeningPort:
9830                     description: 'WireguardListeningPort controls the listening port used
9831                       by Wireguard. [Default: 51820]'
9832                     type: integer
9833                   wireguardMTU:
9834                     description: 'WireguardMTU controls the MTU on the Wireguard interface.
9835                       See Configuring MTU [Default: 1420]'
9836                     type: integer
9837                   wireguardRoutingRulePriority:
9838                     description: 'WireguardRoutingRulePriority controls the priority value
9839                       to use for the Wireguard routing rule. [Default: 99]'
9840                     type: integer
9841                   xdpEnabled:
9842                     description: 'XDPEnabled enables XDP acceleration for suitable untracked
9843                       incoming deny rules. [Default: true]'
9844                     type: boolean
9845                   xdpRefreshInterval:
9846                     description: 'XDPRefreshInterval is the period at which Felix re-checks
9847                       all XDP state to ensure that no other process has accidentally broken
9848                       Calico''s BPF maps or attached programs. Set to 0 to disable XDP
9849                       refresh. [Default: 90s]'
9850                     type: string
9851                 type: object
9852             type: object
9853         served: true
9854         storage: true
9855     status:
9856       acceptedNames:
9857         kind: ""
9858         plural: ""
9859       conditions: []
9860       storedVersions: []
9861     ---
9862     apiVersion: apiextensions.k8s.io/v1
9863     kind: CustomResourceDefinition
9864     metadata:
9865       name: globalnetworkpolicies.crd.projectcalico.org
9866     spec:
9867       group: crd.projectcalico.org
9868       names:
9869         kind: GlobalNetworkPolicy
9870         listKind: GlobalNetworkPolicyList
9871         plural: globalnetworkpolicies
9872         singular: globalnetworkpolicy
9873       scope: Cluster
9874       versions:
9875       - name: v1
9876         schema:
9877           openAPIV3Schema:
9878             properties:
9879               apiVersion:
9880                 description: 'APIVersion defines the versioned schema of this representation
9881                   of an object. Servers should convert recognized schemas to the latest
9882                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
9883                 type: string
9884               kind:
9885                 description: 'Kind is a string value representing the REST resource this
9886                   object represents. Servers may infer this from the endpoint the client
9887                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
9888                 type: string
9889               metadata:
9890                 type: object
9891               spec:
9892                 properties:
9893                   applyOnForward:
9894                     description: ApplyOnForward indicates to apply the rules in this policy
9895                       on forward traffic.
9896                     type: boolean
9897                   doNotTrack:
9898                     description: DoNotTrack indicates whether packets matched by the rules
9899                       in this policy should go through the data plane's connection tracking,
9900                       such as Linux conntrack.  If True, the rules in this policy are
9901                       applied before any data plane connection tracking, and packets allowed
9902                       by this policy are marked as not to be tracked.
9903                     type: boolean
9904                   egress:
9905                     description: The ordered set of egress rules.  Each rule contains
9906                       a set of packet match criteria and a corresponding action to apply.
9907                     items:
9908                       description: "A Rule encapsulates a set of match criteria and an
9909                         action.  Both selector-based security Policy and security Profiles
9910                         reference rules - separated out as a list of rules for both ingress
9911                         and egress packet matching. \n Each positive match criteria has
9912                         a negated version, prefixed with \"Not\". All the match criteria
9913                         within a rule must be satisfied for a packet to match. A single
9914                         rule can contain the positive and negative version of a match
9915                         and both must be satisfied for the rule to match."
9916                       properties:
9917                         action:
9918                           type: string
9919                         destination:
9920                           description: Destination contains the match criteria that apply
9921                             to destination entity.
9922                           properties:
9923                             namespaceSelector:
9924                               description: "NamespaceSelector is an optional field that
9925                                 contains a selector expression. Only traffic that originates
9926                                 from (or terminates at) endpoints within the selected
9927                                 namespaces will be matched. When both NamespaceSelector
9928                                 and another selector are defined on the same rule, then
9929                                 only workload endpoints that are matched by both selectors
9930                                 will be selected by the rule. \n For NetworkPolicy, an
9931                                 empty NamespaceSelector implies that the Selector is limited
9932                                 to selecting only workload endpoints in the same namespace
9933                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
9934                                 NamespaceSelector implies that the Selector is limited
9935                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
9936                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
9937                                 the Selector applies to workload endpoints across all
9938                                 namespaces."
9939                               type: string
9940                             nets:
9941                               description: Nets is an optional field that restricts the
9942                                 rule to only apply to traffic that originates from (or
9943                                 terminates at) IP addresses in any of the given subnets.
9944                               items:
9945                                 type: string
9946                               type: array
9947                             notNets:
9948                               description: NotNets is the negated version of the Nets
9949                                 field.
9950                               items:
9951                                 type: string
9952                               type: array
9953                             notPorts:
9954                               description: NotPorts is the negated version of the Ports
9955                                 field. Since only some protocols have ports, if any ports
9956                                 are specified it requires the Protocol match in the Rule
9957                                 to be set to "TCP" or "UDP".
9958                               items:
9959                                 anyOf:
9960                                 - type: integer
9961                                 - type: string
9962                                 pattern: ^.*
9963                                 x-kubernetes-int-or-string: true
9964                               type: array
9965                             notSelector:
9966                               description: NotSelector is the negated version of the Selector
9967                                 field.  See Selector field for subtleties with negated
9968                                 selectors.
9969                               type: string
9970                             ports:
9971                               description: "Ports is an optional field that restricts
9972                                 the rule to only apply to traffic that has a source (destination)
9973                                 port that matches one of these ranges/values. This value
9974                                 is a list of integers or strings that represent ranges
9975                                 of ports. \n Since only some protocols have ports, if
9976                                 any ports are specified it requires the Protocol match
9977                                 in the Rule to be set to \"TCP\" or \"UDP\"."
9978                               items:
9979                                 anyOf:
9980                                 - type: integer
9981                                 - type: string
9982                                 pattern: ^.*
9983                                 x-kubernetes-int-or-string: true
9984                               type: array
9985                             selector:
9986                               description: "Selector is an optional field that contains
9987                                 a selector expression (see Policy for sample syntax).
9988                                 \ Only traffic that originates from (terminates at) endpoints
9989                                 matching the selector will be matched. \n Note that: in
9990                                 addition to the negated version of the Selector (see NotSelector
9991                                 below), the selector expression syntax itself supports
9992                                 negation.  The two types of negation are subtly different.
9993                                 One negates the set of matched endpoints, the other negates
9994                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
9995                                 packets that are from other Calico-controlled \tendpoints
9996                                 that do not have the label \"my_label\". \n \tNotSelector
9997                                 = \"has(my_label)\" matches packets that are not from
9998                                 Calico-controlled \tendpoints that do have the label \"my_label\".
9999                                 \n The effect is that the latter will accept packets from
10000                                 non-Calico sources whereas the former is limited to packets
10001                                 from Calico-controlled endpoints."
10002                               type: string
10003                             serviceAccounts:
10004                               description: ServiceAccounts is an optional field that restricts
10005                                 the rule to only apply to traffic that originates from
10006                                 (or terminates at) a pod running as a matching service
10007                                 account.
10008                               properties:
10009                                 names:
10010                                   description: Names is an optional field that restricts
10011                                     the rule to only apply to traffic that originates
10012                                     from (or terminates at) a pod running as a service
10013                                     account whose name is in the list.
10014                                   items:
10015                                     type: string
10016                                   type: array
10017                                 selector:
10018                                   description: Selector is an optional field that restricts
10019                                     the rule to only apply to traffic that originates
10020                                     from (or terminates at) a pod running as a service
10021                                     account that matches the given label selector. If
10022                                     both Names and Selector are specified then they are
10023                                     AND'ed.
10024                                   type: string
10025                               type: object
10026                             services:
10027                               description: "Services is an optional field that contains
10028                                 options for matching Kubernetes Services. If specified,
10029                                 only traffic that originates from or terminates at endpoints
10030                                 within the selected service(s) will be matched, and only
10031                                 to/from each endpoint's port. \n Services cannot be specified
10032                                 on the same rule as Selector, NotSelector, NamespaceSelector,
10033                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
10034                                 can only be specified with Services on ingress rules."
10035                               properties:
10036                                 name:
10037                                   description: Name specifies the name of a Kubernetes
10038                                     Service to match.
10039                                   type: string
10040                                 namespace:
10041                                   description: Namespace specifies the namespace of the
10042                                     given Service. If left empty, the rule will match
10043                                     within this policy's namespace.
10044                                   type: string
10045                               type: object
10046                           type: object
10047                         http:
10048                           description: HTTP contains match criteria that apply to HTTP
10049                             requests.
10050                           properties:
10051                             methods:
10052                               description: Methods is an optional field that restricts
10053                                 the rule to apply only to HTTP requests that use one of
10054                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
10055                                 methods are OR'd together.
10056                               items:
10057                                 type: string
10058                               type: array
10059                             paths:
10060                               description: 'Paths is an optional field that restricts
10061                                 the rule to apply to HTTP requests that use one of the
10062                                 listed HTTP Paths. Multiple paths are OR''d together.
10063                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
10064                                 ONLY specify either a `exact` or a `prefix` match. The
10065                                 validator will check for it.'
10066                               items:
10067                                 description: 'HTTPPath specifies an HTTP path to match.
10068                                   It may be either of the form: exact: <path>: which matches
10069                                   the path exactly or prefix: <path-prefix>: which matches
10070                                   the path prefix'
10071                                 properties:
10072                                   exact:
10073                                     type: string
10074                                   prefix:
10075                                     type: string
10076                                 type: object
10077                               type: array
10078                           type: object
10079                         icmp:
10080                           description: ICMP is an optional field that restricts the rule
10081                             to apply to a specific type and code of ICMP traffic.  This
10082                             should only be specified if the Protocol field is set to "ICMP"
10083                             or "ICMPv6".
10084                           properties:
10085                             code:
10086                               description: Match on a specific ICMP code.  If specified,
10087                                 the Type value must also be specified. This is a technical
10088                                 limitation imposed by the kernel's iptables firewall,
10089                                 which Calico uses to enforce the rule.
10090                               type: integer
10091                             type:
10092                               description: Match on a specific ICMP type.  For example
10093                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
10094                               type: integer
10095                           type: object
10096                         ipVersion:
10097                           description: IPVersion is an optional field that restricts the
10098                             rule to only match a specific IP version.
10099                           type: integer
10100                         metadata:
10101                           description: Metadata contains additional information for this
10102                             rule
10103                           properties:
10104                             annotations:
10105                               additionalProperties:
10106                                 type: string
10107                               description: Annotations is a set of key value pairs that
10108                                 give extra information about the rule
10109                               type: object
10110                           type: object
10111                         notICMP:
10112                           description: NotICMP is the negated version of the ICMP field.
10113                           properties:
10114                             code:
10115                               description: Match on a specific ICMP code.  If specified,
10116                                 the Type value must also be specified. This is a technical
10117                                 limitation imposed by the kernel's iptables firewall,
10118                                 which Calico uses to enforce the rule.
10119                               type: integer
10120                             type:
10121                               description: Match on a specific ICMP type.  For example
10122                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
10123                               type: integer
10124                           type: object
10125                         notProtocol:
10126                           anyOf:
10127                           - type: integer
10128                           - type: string
10129                           description: NotProtocol is the negated version of the Protocol
10130                             field.
10131                           pattern: ^.*
10132                           x-kubernetes-int-or-string: true
10133                         protocol:
10134                           anyOf:
10135                           - type: integer
10136                           - type: string
10137                           description: "Protocol is an optional field that restricts the
10138                             rule to only apply to traffic of a specific IP protocol. Required
10139                             if any of the EntityRules contain Ports (because ports only
10140                             apply to certain protocols). \n Must be one of these string
10141                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
10142                             \"UDPLite\" or an integer in the range 1-255."
10143                           pattern: ^.*
10144                           x-kubernetes-int-or-string: true
10145                         source:
10146                           description: Source contains the match criteria that apply to
10147                             source entity.
10148                           properties:
10149                             namespaceSelector:
10150                               description: "NamespaceSelector is an optional field that
10151                                 contains a selector expression. Only traffic that originates
10152                                 from (or terminates at) endpoints within the selected
10153                                 namespaces will be matched. When both NamespaceSelector
10154                                 and another selector are defined on the same rule, then
10155                                 only workload endpoints that are matched by both selectors
10156                                 will be selected by the rule. \n For NetworkPolicy, an
10157                                 empty NamespaceSelector implies that the Selector is limited
10158                                 to selecting only workload endpoints in the same namespace
10159                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
10160                                 NamespaceSelector implies that the Selector is limited
10161                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
10162                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
10163                                 the Selector applies to workload endpoints across all
10164                                 namespaces."
10165                               type: string
10166                             nets:
10167                               description: Nets is an optional field that restricts the
10168                                 rule to only apply to traffic that originates from (or
10169                                 terminates at) IP addresses in any of the given subnets.
10170                               items:
10171                                 type: string
10172                               type: array
10173                             notNets:
10174                               description: NotNets is the negated version of the Nets
10175                                 field.
10176                               items:
10177                                 type: string
10178                               type: array
10179                             notPorts:
10180                               description: NotPorts is the negated version of the Ports
10181                                 field. Since only some protocols have ports, if any ports
10182                                 are specified it requires the Protocol match in the Rule
10183                                 to be set to "TCP" or "UDP".
10184                               items:
10185                                 anyOf:
10186                                 - type: integer
10187                                 - type: string
10188                                 pattern: ^.*
10189                                 x-kubernetes-int-or-string: true
10190                               type: array
10191                             notSelector:
10192                               description: NotSelector is the negated version of the Selector
10193                                 field.  See Selector field for subtleties with negated
10194                                 selectors.
10195                               type: string
10196                             ports:
10197                               description: "Ports is an optional field that restricts
10198                                 the rule to only apply to traffic that has a source (destination)
10199                                 port that matches one of these ranges/values. This value
10200                                 is a list of integers or strings that represent ranges
10201                                 of ports. \n Since only some protocols have ports, if
10202                                 any ports are specified it requires the Protocol match
10203                                 in the Rule to be set to \"TCP\" or \"UDP\"."
10204                               items:
10205                                 anyOf:
10206                                 - type: integer
10207                                 - type: string
10208                                 pattern: ^.*
10209                                 x-kubernetes-int-or-string: true
10210                               type: array
10211                             selector:
10212                               description: "Selector is an optional field that contains
10213                                 a selector expression (see Policy for sample syntax).
10214                                 \ Only traffic that originates from (terminates at) endpoints
10215                                 matching the selector will be matched. \n Note that: in
10216                                 addition to the negated version of the Selector (see NotSelector
10217                                 below), the selector expression syntax itself supports
10218                                 negation.  The two types of negation are subtly different.
10219                                 One negates the set of matched endpoints, the other negates
10220                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
10221                                 packets that are from other Calico-controlled \tendpoints
10222                                 that do not have the label \"my_label\". \n \tNotSelector
10223                                 = \"has(my_label)\" matches packets that are not from
10224                                 Calico-controlled \tendpoints that do have the label \"my_label\".
10225                                 \n The effect is that the latter will accept packets from
10226                                 non-Calico sources whereas the former is limited to packets
10227                                 from Calico-controlled endpoints."
10228                               type: string
10229                             serviceAccounts:
10230                               description: ServiceAccounts is an optional field that restricts
10231                                 the rule to only apply to traffic that originates from
10232                                 (or terminates at) a pod running as a matching service
10233                                 account.
10234                               properties:
10235                                 names:
10236                                   description: Names is an optional field that restricts
10237                                     the rule to only apply to traffic that originates
10238                                     from (or terminates at) a pod running as a service
10239                                     account whose name is in the list.
10240                                   items:
10241                                     type: string
10242                                   type: array
10243                                 selector:
10244                                   description: Selector is an optional field that restricts
10245                                     the rule to only apply to traffic that originates
10246                                     from (or terminates at) a pod running as a service
10247                                     account that matches the given label selector. If
10248                                     both Names and Selector are specified then they are
10249                                     AND'ed.
10250                                   type: string
10251                               type: object
10252                             services:
10253                               description: "Services is an optional field that contains
10254                                 options for matching Kubernetes Services. If specified,
10255                                 only traffic that originates from or terminates at endpoints
10256                                 within the selected service(s) will be matched, and only
10257                                 to/from each endpoint's port. \n Services cannot be specified
10258                                 on the same rule as Selector, NotSelector, NamespaceSelector,
10259                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
10260                                 can only be specified with Services on ingress rules."
10261                               properties:
10262                                 name:
10263                                   description: Name specifies the name of a Kubernetes
10264                                     Service to match.
10265                                   type: string
10266                                 namespace:
10267                                   description: Namespace specifies the namespace of the
10268                                     given Service. If left empty, the rule will match
10269                                     within this policy's namespace.
10270                                   type: string
10271                               type: object
10272                           type: object
10273                       required:
10274                       - action
10275                       type: object
10276                     type: array
10277                   ingress:
10278                     description: The ordered set of ingress rules.  Each rule contains
10279                       a set of packet match criteria and a corresponding action to apply.
10280                     items:
10281                       description: "A Rule encapsulates a set of match criteria and an
10282                         action.  Both selector-based security Policy and security Profiles
10283                         reference rules - separated out as a list of rules for both ingress
10284                         and egress packet matching. \n Each positive match criteria has
10285                         a negated version, prefixed with \"Not\". All the match criteria
10286                         within a rule must be satisfied for a packet to match. A single
10287                         rule can contain the positive and negative version of a match
10288                         and both must be satisfied for the rule to match."
10289                       properties:
10290                         action:
10291                           type: string
10292                         destination:
10293                           description: Destination contains the match criteria that apply
10294                             to destination entity.
10295                           properties:
10296                             namespaceSelector:
10297                               description: "NamespaceSelector is an optional field that
10298                                 contains a selector expression. Only traffic that originates
10299                                 from (or terminates at) endpoints within the selected
10300                                 namespaces will be matched. When both NamespaceSelector
10301                                 and another selector are defined on the same rule, then
10302                                 only workload endpoints that are matched by both selectors
10303                                 will be selected by the rule. \n For NetworkPolicy, an
10304                                 empty NamespaceSelector implies that the Selector is limited
10305                                 to selecting only workload endpoints in the same namespace
10306                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
10307                                 NamespaceSelector implies that the Selector is limited
10308                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
10309                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
10310                                 the Selector applies to workload endpoints across all
10311                                 namespaces."
10312                               type: string
10313                             nets:
10314                               description: Nets is an optional field that restricts the
10315                                 rule to only apply to traffic that originates from (or
10316                                 terminates at) IP addresses in any of the given subnets.
10317                               items:
10318                                 type: string
10319                               type: array
10320                             notNets:
10321                               description: NotNets is the negated version of the Nets
10322                                 field.
10323                               items:
10324                                 type: string
10325                               type: array
10326                             notPorts:
10327                               description: NotPorts is the negated version of the Ports
10328                                 field. Since only some protocols have ports, if any ports
10329                                 are specified it requires the Protocol match in the Rule
10330                                 to be set to "TCP" or "UDP".
10331                               items:
10332                                 anyOf:
10333                                 - type: integer
10334                                 - type: string
10335                                 pattern: ^.*
10336                                 x-kubernetes-int-or-string: true
10337                               type: array
10338                             notSelector:
10339                               description: NotSelector is the negated version of the Selector
10340                                 field.  See Selector field for subtleties with negated
10341                                 selectors.
10342                               type: string
10343                             ports:
10344                               description: "Ports is an optional field that restricts
10345                                 the rule to only apply to traffic that has a source (destination)
10346                                 port that matches one of these ranges/values. This value
10347                                 is a list of integers or strings that represent ranges
10348                                 of ports. \n Since only some protocols have ports, if
10349                                 any ports are specified it requires the Protocol match
10350                                 in the Rule to be set to \"TCP\" or \"UDP\"."
10351                               items:
10352                                 anyOf:
10353                                 - type: integer
10354                                 - type: string
10355                                 pattern: ^.*
10356                                 x-kubernetes-int-or-string: true
10357                               type: array
10358                             selector:
10359                               description: "Selector is an optional field that contains
10360                                 a selector expression (see Policy for sample syntax).
10361                                 \ Only traffic that originates from (terminates at) endpoints
10362                                 matching the selector will be matched. \n Note that: in
10363                                 addition to the negated version of the Selector (see NotSelector
10364                                 below), the selector expression syntax itself supports
10365                                 negation.  The two types of negation are subtly different.
10366                                 One negates the set of matched endpoints, the other negates
10367                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
10368                                 packets that are from other Calico-controlled \tendpoints
10369                                 that do not have the label \"my_label\". \n \tNotSelector
10370                                 = \"has(my_label)\" matches packets that are not from
10371                                 Calico-controlled \tendpoints that do have the label \"my_label\".
10372                                 \n The effect is that the latter will accept packets from
10373                                 non-Calico sources whereas the former is limited to packets
10374                                 from Calico-controlled endpoints."
10375                               type: string
10376                             serviceAccounts:
10377                               description: ServiceAccounts is an optional field that restricts
10378                                 the rule to only apply to traffic that originates from
10379                                 (or terminates at) a pod running as a matching service
10380                                 account.
10381                               properties:
10382                                 names:
10383                                   description: Names is an optional field that restricts
10384                                     the rule to only apply to traffic that originates
10385                                     from (or terminates at) a pod running as a service
10386                                     account whose name is in the list.
10387                                   items:
10388                                     type: string
10389                                   type: array
10390                                 selector:
10391                                   description: Selector is an optional field that restricts
10392                                     the rule to only apply to traffic that originates
10393                                     from (or terminates at) a pod running as a service
10394                                     account that matches the given label selector. If
10395                                     both Names and Selector are specified then they are
10396                                     AND'ed.
10397                                   type: string
10398                               type: object
10399                             services:
10400                               description: "Services is an optional field that contains
10401                                 options for matching Kubernetes Services. If specified,
10402                                 only traffic that originates from or terminates at endpoints
10403                                 within the selected service(s) will be matched, and only
10404                                 to/from each endpoint's port. \n Services cannot be specified
10405                                 on the same rule as Selector, NotSelector, NamespaceSelector,
10406                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
10407                                 can only be specified with Services on ingress rules."
10408                               properties:
10409                                 name:
10410                                   description: Name specifies the name of a Kubernetes
10411                                     Service to match.
10412                                   type: string
10413                                 namespace:
10414                                   description: Namespace specifies the namespace of the
10415                                     given Service. If left empty, the rule will match
10416                                     within this policy's namespace.
10417                                   type: string
10418                               type: object
10419                           type: object
10420                         http:
10421                           description: HTTP contains match criteria that apply to HTTP
10422                             requests.
10423                           properties:
10424                             methods:
10425                               description: Methods is an optional field that restricts
10426                                 the rule to apply only to HTTP requests that use one of
10427                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
10428                                 methods are OR'd together.
10429                               items:
10430                                 type: string
10431                               type: array
10432                             paths:
10433                               description: 'Paths is an optional field that restricts
10434                                 the rule to apply to HTTP requests that use one of the
10435                                 listed HTTP Paths. Multiple paths are OR''d together.
10436                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
10437                                 ONLY specify either a `exact` or a `prefix` match. The
10438                                 validator will check for it.'
10439                               items:
10440                                 description: 'HTTPPath specifies an HTTP path to match.
10441                                   It may be either of the form: exact: <path>: which matches
10442                                   the path exactly or prefix: <path-prefix>: which matches
10443                                   the path prefix'
10444                                 properties:
10445                                   exact:
10446                                     type: string
10447                                   prefix:
10448                                     type: string
10449                                 type: object
10450                               type: array
10451                           type: object
10452                         icmp:
10453                           description: ICMP is an optional field that restricts the rule
10454                             to apply to a specific type and code of ICMP traffic.  This
10455                             should only be specified if the Protocol field is set to "ICMP"
10456                             or "ICMPv6".
10457                           properties:
10458                             code:
10459                               description: Match on a specific ICMP code.  If specified,
10460                                 the Type value must also be specified. This is a technical
10461                                 limitation imposed by the kernel's iptables firewall,
10462                                 which Calico uses to enforce the rule.
10463                               type: integer
10464                             type:
10465                               description: Match on a specific ICMP type.  For example
10466                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
10467                               type: integer
10468                           type: object
10469                         ipVersion:
10470                           description: IPVersion is an optional field that restricts the
10471                             rule to only match a specific IP version.
10472                           type: integer
10473                         metadata:
10474                           description: Metadata contains additional information for this
10475                             rule
10476                           properties:
10477                             annotations:
10478                               additionalProperties:
10479                                 type: string
10480                               description: Annotations is a set of key value pairs that
10481                                 give extra information about the rule
10482                               type: object
10483                           type: object
10484                         notICMP:
10485                           description: NotICMP is the negated version of the ICMP field.
10486                           properties:
10487                             code:
10488                               description: Match on a specific ICMP code.  If specified,
10489                                 the Type value must also be specified. This is a technical
10490                                 limitation imposed by the kernel's iptables firewall,
10491                                 which Calico uses to enforce the rule.
10492                               type: integer
10493                             type:
10494                               description: Match on a specific ICMP type.  For example
10495                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
10496                               type: integer
10497                           type: object
10498                         notProtocol:
10499                           anyOf:
10500                           - type: integer
10501                           - type: string
10502                           description: NotProtocol is the negated version of the Protocol
10503                             field.
10504                           pattern: ^.*
10505                           x-kubernetes-int-or-string: true
10506                         protocol:
10507                           anyOf:
10508                           - type: integer
10509                           - type: string
10510                           description: "Protocol is an optional field that restricts the
10511                             rule to only apply to traffic of a specific IP protocol. Required
10512                             if any of the EntityRules contain Ports (because ports only
10513                             apply to certain protocols). \n Must be one of these string
10514                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
10515                             \"UDPLite\" or an integer in the range 1-255."
10516                           pattern: ^.*
10517                           x-kubernetes-int-or-string: true
10518                         source:
10519                           description: Source contains the match criteria that apply to
10520                             source entity.
10521                           properties:
10522                             namespaceSelector:
10523                               description: "NamespaceSelector is an optional field that
10524                                 contains a selector expression. Only traffic that originates
10525                                 from (or terminates at) endpoints within the selected
10526                                 namespaces will be matched. When both NamespaceSelector
10527                                 and another selector are defined on the same rule, then
10528                                 only workload endpoints that are matched by both selectors
10529                                 will be selected by the rule. \n For NetworkPolicy, an
10530                                 empty NamespaceSelector implies that the Selector is limited
10531                                 to selecting only workload endpoints in the same namespace
10532                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
10533                                 NamespaceSelector implies that the Selector is limited
10534                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
10535                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
10536                                 the Selector applies to workload endpoints across all
10537                                 namespaces."
10538                               type: string
10539                             nets:
10540                               description: Nets is an optional field that restricts the
10541                                 rule to only apply to traffic that originates from (or
10542                                 terminates at) IP addresses in any of the given subnets.
10543                               items:
10544                                 type: string
10545                               type: array
10546                             notNets:
10547                               description: NotNets is the negated version of the Nets
10548                                 field.
10549                               items:
10550                                 type: string
10551                               type: array
10552                             notPorts:
10553                               description: NotPorts is the negated version of the Ports
10554                                 field. Since only some protocols have ports, if any ports
10555                                 are specified it requires the Protocol match in the Rule
10556                                 to be set to "TCP" or "UDP".
10557                               items:
10558                                 anyOf:
10559                                 - type: integer
10560                                 - type: string
10561                                 pattern: ^.*
10562                                 x-kubernetes-int-or-string: true
10563                               type: array
10564                             notSelector:
10565                               description: NotSelector is the negated version of the Selector
10566                                 field.  See Selector field for subtleties with negated
10567                                 selectors.
10568                               type: string
10569                             ports:
10570                               description: "Ports is an optional field that restricts
10571                                 the rule to only apply to traffic that has a source (destination)
10572                                 port that matches one of these ranges/values. This value
10573                                 is a list of integers or strings that represent ranges
10574                                 of ports. \n Since only some protocols have ports, if
10575                                 any ports are specified it requires the Protocol match
10576                                 in the Rule to be set to \"TCP\" or \"UDP\"."
10577                               items:
10578                                 anyOf:
10579                                 - type: integer
10580                                 - type: string
10581                                 pattern: ^.*
10582                                 x-kubernetes-int-or-string: true
10583                               type: array
10584                             selector:
10585                               description: "Selector is an optional field that contains
10586                                 a selector expression (see Policy for sample syntax).
10587                                 \ Only traffic that originates from (terminates at) endpoints
10588                                 matching the selector will be matched. \n Note that: in
10589                                 addition to the negated version of the Selector (see NotSelector
10590                                 below), the selector expression syntax itself supports
10591                                 negation.  The two types of negation are subtly different.
10592                                 One negates the set of matched endpoints, the other negates
10593                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
10594                                 packets that are from other Calico-controlled \tendpoints
10595                                 that do not have the label \"my_label\". \n \tNotSelector
10596                                 = \"has(my_label)\" matches packets that are not from
10597                                 Calico-controlled \tendpoints that do have the label \"my_label\".
10598                                 \n The effect is that the latter will accept packets from
10599                                 non-Calico sources whereas the former is limited to packets
10600                                 from Calico-controlled endpoints."
10601                               type: string
10602                             serviceAccounts:
10603                               description: ServiceAccounts is an optional field that restricts
10604                                 the rule to only apply to traffic that originates from
10605                                 (or terminates at) a pod running as a matching service
10606                                 account.
10607                               properties:
10608                                 names:
10609                                   description: Names is an optional field that restricts
10610                                     the rule to only apply to traffic that originates
10611                                     from (or terminates at) a pod running as a service
10612                                     account whose name is in the list.
10613                                   items:
10614                                     type: string
10615                                   type: array
10616                                 selector:
10617                                   description: Selector is an optional field that restricts
10618                                     the rule to only apply to traffic that originates
10619                                     from (or terminates at) a pod running as a service
10620                                     account that matches the given label selector. If
10621                                     both Names and Selector are specified then they are
10622                                     AND'ed.
10623                                   type: string
10624                               type: object
10625                             services:
10626                               description: "Services is an optional field that contains
10627                                 options for matching Kubernetes Services. If specified,
10628                                 only traffic that originates from or terminates at endpoints
10629                                 within the selected service(s) will be matched, and only
10630                                 to/from each endpoint's port. \n Services cannot be specified
10631                                 on the same rule as Selector, NotSelector, NamespaceSelector,
10632                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
10633                                 can only be specified with Services on ingress rules."
10634                               properties:
10635                                 name:
10636                                   description: Name specifies the name of a Kubernetes
10637                                     Service to match.
10638                                   type: string
10639                                 namespace:
10640                                   description: Namespace specifies the namespace of the
10641                                     given Service. If left empty, the rule will match
10642                                     within this policy's namespace.
10643                                   type: string
10644                               type: object
10645                           type: object
10646                       required:
10647                       - action
10648                       type: object
10649                     type: array
10650                   namespaceSelector:
10651                     description: NamespaceSelector is an optional field for an expression
10652                       used to select a pod based on namespaces.
10653                     type: string
10654                   order:
10655                     description: Order is an optional field that specifies the order in
10656                       which the policy is applied. Policies with higher "order" are applied
10657                       after those with lower order.  If the order is omitted, it may be
10658                       considered to be "infinite" - i.e. the policy will be applied last.  Policies
10659                       with identical order will be applied in alphanumerical order based
10660                       on the Policy "Name".
10661                     type: number
10662                   preDNAT:
10663                     description: PreDNAT indicates to apply the rules in this policy before
10664                       any DNAT.
10665                     type: boolean
10666                   selector:
10667                     description: "The selector is an expression used to pick pick out
10668                       the endpoints that the policy should be applied to. \n Selector
10669                       expressions follow this syntax: \n \tlabel == \"string_literal\"
10670                       \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
10671                       \  ->  not equal; also matches if label is not present \tlabel in
10672                       { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
10673                       one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
10674                       ... }  ->  true if the value of label X is not one of \"a\", \"b\",
10675                       \"c\" \thas(label_name)  -> True if that label is present \t! expr
10676                       -> negation of expr \texpr && expr  -> Short-circuit and \texpr
10677                       || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
10678                       or the empty selector -> matches all endpoints. \n Label names are
10679                       allowed to contain alphanumerics, -, _ and /. String literals are
10680                       more permissive but they do not support escape characters. \n Examples
10681                       (with made-up labels): \n \ttype == \"webserver\" && deployment
10682                       == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
10683                       \"dev\" \t! has(label_name)"
10684                     type: string
10685                   serviceAccountSelector:
10686                     description: ServiceAccountSelector is an optional field for an expression
10687                       used to select a pod based on service accounts.
10688                     type: string
10689                   types:
10690                     description: "Types indicates whether this policy applies to ingress,
10691                       or to egress, or to both.  When not explicitly specified (and so
10692                       the value on creation is empty or nil), Calico defaults Types according
10693                       to what Ingress and Egress rules are present in the policy.  The
10694                       default is: \n - [ PolicyTypeIngress ], if there are no Egress rules
10695                       (including the case where there are   also no Ingress rules) \n
10696                       - [ PolicyTypeEgress ], if there are Egress rules but no Ingress
10697                       rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are
10698                       both Ingress and Egress rules. \n When the policy is read back again,
10699                       Types will always be one of these values, never empty or nil."
10700                     items:
10701                       description: PolicyType enumerates the possible values of the PolicySpec
10702                         Types field.
10703                       type: string
10704                     type: array
10705                 type: object
10706             type: object
10707         served: true
10708         storage: true
10709     status:
10710       acceptedNames:
10711         kind: ""
10712         plural: ""
10713       conditions: []
10714       storedVersions: []
10715     ---
10716     apiVersion: apiextensions.k8s.io/v1
10717     kind: CustomResourceDefinition
10718     metadata:
10719       name: globalnetworksets.crd.projectcalico.org
10720     spec:
10721       group: crd.projectcalico.org
10722       names:
10723         kind: GlobalNetworkSet
10724         listKind: GlobalNetworkSetList
10725         plural: globalnetworksets
10726         singular: globalnetworkset
10727       scope: Cluster
10728       versions:
10729       - name: v1
10730         schema:
10731           openAPIV3Schema:
10732             description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
10733               that share labels to allow rules to refer to them via selectors.  The labels
10734               of GlobalNetworkSet are not namespaced.
10735             properties:
10736               apiVersion:
10737                 description: 'APIVersion defines the versioned schema of this representation
10738                   of an object. Servers should convert recognized schemas to the latest
10739                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
10740                 type: string
10741               kind:
10742                 description: 'Kind is a string value representing the REST resource this
10743                   object represents. Servers may infer this from the endpoint the client
10744                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
10745                 type: string
10746               metadata:
10747                 type: object
10748               spec:
10749                 description: GlobalNetworkSetSpec contains the specification for a NetworkSet
10750                   resource.
10751                 properties:
10752                   nets:
10753                     description: The list of IP networks that belong to this set.
10754                     items:
10755                       type: string
10756                     type: array
10757                 type: object
10758             type: object
10759         served: true
10760         storage: true
10761     status:
10762       acceptedNames:
10763         kind: ""
10764         plural: ""
10765       conditions: []
10766       storedVersions: []
10767     ---
10768     apiVersion: apiextensions.k8s.io/v1
10769     kind: CustomResourceDefinition
10770     metadata:
10771       name: hostendpoints.crd.projectcalico.org
10772     spec:
10773       group: crd.projectcalico.org
10774       names:
10775         kind: HostEndpoint
10776         listKind: HostEndpointList
10777         plural: hostendpoints
10778         singular: hostendpoint
10779       scope: Cluster
10780       versions:
10781       - name: v1
10782         schema:
10783           openAPIV3Schema:
10784             properties:
10785               apiVersion:
10786                 description: 'APIVersion defines the versioned schema of this representation
10787                   of an object. Servers should convert recognized schemas to the latest
10788                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
10789                 type: string
10790               kind:
10791                 description: 'Kind is a string value representing the REST resource this
10792                   object represents. Servers may infer this from the endpoint the client
10793                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
10794                 type: string
10795               metadata:
10796                 type: object
10797               spec:
10798                 description: HostEndpointSpec contains the specification for a HostEndpoint
10799                   resource.
10800                 properties:
10801                   expectedIPs:
10802                     description: "The expected IP addresses (IPv4 and IPv6) of the endpoint.
10803                       If \"InterfaceName\" is not present, Calico will look for an interface
10804                       matching any of the IPs in the list and apply policy to that. Note:
10805                       \tWhen using the selector match criteria in an ingress or egress
10806                       security Policy \tor Profile, Calico converts the selector into
10807                       a set of IP addresses. For host \tendpoints, the ExpectedIPs field
10808                       is used for that purpose. (If only the interface \tname is specified,
10809                       Calico does not learn the IPs of the interface for use in match
10810                       \tcriteria.)"
10811                     items:
10812                       type: string
10813                     type: array
10814                   interfaceName:
10815                     description: "Either \"*\", or the name of a specific Linux interface
10816                       to apply policy to; or empty.  \"*\" indicates that this HostEndpoint
10817                       governs all traffic to, from or through the default network namespace
10818                       of the host named by the \"Node\" field; entering and leaving that
10819                       namespace via any interface, including those from/to non-host-networked
10820                       local workloads. \n If InterfaceName is not \"*\", this HostEndpoint
10821                       only governs traffic that enters or leaves the host through the
10822                       specific interface named by InterfaceName, or - when InterfaceName
10823                       is empty - through the specific interface that has one of the IPs
10824                       in ExpectedIPs. Therefore, when InterfaceName is empty, at least
10825                       one expected IP must be specified.  Only external interfaces (such
10826                       as \"eth0\") are supported here; it isn't possible for a HostEndpoint
10827                       to protect traffic through a specific local workload interface.
10828                       \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
10829                       initially just pre-DNAT policy.  Please check Calico documentation
10830                       for the latest position."
10831                     type: string
10832                   node:
10833                     description: The node name identifying the Calico node instance.
10834                     type: string
10835                   ports:
10836                     description: Ports contains the endpoint's named ports, which may
10837                       be referenced in security policy rules.
10838                     items:
10839                       properties:
10840                         name:
10841                           type: string
10842                         port:
10843                           type: integer
10844                         protocol:
10845                           anyOf:
10846                           - type: integer
10847                           - type: string
10848                           pattern: ^.*
10849                           x-kubernetes-int-or-string: true
10850                       required:
10851                       - name
10852                       - port
10853                       - protocol
10854                       type: object
10855                     type: array
10856                   profiles:
10857                     description: A list of identifiers of security Profile objects that
10858                       apply to this endpoint. Each profile is applied in the order that
10859                       they appear in this list.  Profile rules are applied after the selector-based
10860                       security policy.
10861                     items:
10862                       type: string
10863                     type: array
10864                 type: object
10865             type: object
10866         served: true
10867         storage: true
10868     status:
10869       acceptedNames:
10870         kind: ""
10871         plural: ""
10872       conditions: []
10873       storedVersions: []
10874     ---
10875     apiVersion: apiextensions.k8s.io/v1
10876     kind: CustomResourceDefinition
10877     metadata:
10878       name: ipamblocks.crd.projectcalico.org
10879     spec:
10880       group: crd.projectcalico.org
10881       names:
10882         kind: IPAMBlock
10883         listKind: IPAMBlockList
10884         plural: ipamblocks
10885         singular: ipamblock
10886       scope: Cluster
10887       versions:
10888       - name: v1
10889         schema:
10890           openAPIV3Schema:
10891             properties:
10892               apiVersion:
10893                 description: 'APIVersion defines the versioned schema of this representation
10894                   of an object. Servers should convert recognized schemas to the latest
10895                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
10896                 type: string
10897               kind:
10898                 description: 'Kind is a string value representing the REST resource this
10899                   object represents. Servers may infer this from the endpoint the client
10900                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
10901                 type: string
10902               metadata:
10903                 type: object
10904               spec:
10905                 description: IPAMBlockSpec contains the specification for an IPAMBlock
10906                   resource.
10907                 properties:
10908                   affinity:
10909                     type: string
10910                   allocations:
10911                     items:
10912                       nullable: true
10913                       type: integer
10914                     type: array
10915                   attributes:
10916                     items:
10917                       properties:
10918                         handle_id:
10919                           type: string
10920                         secondary:
10921                           additionalProperties:
10922                             type: string
10923                           type: object
10924                       type: object
10925                     type: array
10926                   cidr:
10927                     type: string
10928                   deleted:
10929                     type: boolean
10930                   strictAffinity:
10931                     type: boolean
10932                   unallocated:
10933                     items:
10934                       type: integer
10935                     type: array
10936                 required:
10937                 - allocations
10938                 - attributes
10939                 - cidr
10940                 - strictAffinity
10941                 - unallocated
10942                 type: object
10943             type: object
10944         served: true
10945         storage: true
10946     status:
10947       acceptedNames:
10948         kind: ""
10949         plural: ""
10950       conditions: []
10951       storedVersions: []
10952     ---
10953     apiVersion: apiextensions.k8s.io/v1
10954     kind: CustomResourceDefinition
10955     metadata:
10956       name: ipamconfigs.crd.projectcalico.org
10957     spec:
10958       group: crd.projectcalico.org
10959       names:
10960         kind: IPAMConfig
10961         listKind: IPAMConfigList
10962         plural: ipamconfigs
10963         singular: ipamconfig
10964       scope: Cluster
10965       versions:
10966       - name: v1
10967         schema:
10968           openAPIV3Schema:
10969             properties:
10970               apiVersion:
10971                 description: 'APIVersion defines the versioned schema of this representation
10972                   of an object. Servers should convert recognized schemas to the latest
10973                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
10974                 type: string
10975               kind:
10976                 description: 'Kind is a string value representing the REST resource this
10977                   object represents. Servers may infer this from the endpoint the client
10978                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
10979                 type: string
10980               metadata:
10981                 type: object
10982               spec:
10983                 description: IPAMConfigSpec contains the specification for an IPAMConfig
10984                   resource.
10985                 properties:
10986                   autoAllocateBlocks:
10987                     type: boolean
10988                   maxBlocksPerHost:
10989                     description: MaxBlocksPerHost, if non-zero, is the max number of blocks
10990                       that can be affine to each host.
10991                     type: integer
10992                   strictAffinity:
10993                     type: boolean
10994                 required:
10995                 - autoAllocateBlocks
10996                 - strictAffinity
10997                 type: object
10998             type: object
10999         served: true
11000         storage: true
11001     status:
11002       acceptedNames:
11003         kind: ""
11004         plural: ""
11005       conditions: []
11006       storedVersions: []
11007     ---
11008     apiVersion: apiextensions.k8s.io/v1
11009     kind: CustomResourceDefinition
11010     metadata:
11011       name: ipamhandles.crd.projectcalico.org
11012     spec:
11013       group: crd.projectcalico.org
11014       names:
11015         kind: IPAMHandle
11016         listKind: IPAMHandleList
11017         plural: ipamhandles
11018         singular: ipamhandle
11019       scope: Cluster
11020       versions:
11021       - name: v1
11022         schema:
11023           openAPIV3Schema:
11024             properties:
11025               apiVersion:
11026                 description: 'APIVersion defines the versioned schema of this representation
11027                   of an object. Servers should convert recognized schemas to the latest
11028                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
11029                 type: string
11030               kind:
11031                 description: 'Kind is a string value representing the REST resource this
11032                   object represents. Servers may infer this from the endpoint the client
11033                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
11034                 type: string
11035               metadata:
11036                 type: object
11037               spec:
11038                 description: IPAMHandleSpec contains the specification for an IPAMHandle
11039                   resource.
11040                 properties:
11041                   block:
11042                     additionalProperties:
11043                       type: integer
11044                     type: object
11045                   deleted:
11046                     type: boolean
11047                   handleID:
11048                     type: string
11049                 required:
11050                 - block
11051                 - handleID
11052                 type: object
11053             type: object
11054         served: true
11055         storage: true
11056     status:
11057       acceptedNames:
11058         kind: ""
11059         plural: ""
11060       conditions: []
11061       storedVersions: []
11062     ---
11063     apiVersion: apiextensions.k8s.io/v1
11064     kind: CustomResourceDefinition
11065     metadata:
11066       name: ippools.crd.projectcalico.org
11067     spec:
11068       group: crd.projectcalico.org
11069       names:
11070         kind: IPPool
11071         listKind: IPPoolList
11072         plural: ippools
11073         singular: ippool
11074       scope: Cluster
11075       versions:
11076       - name: v1
11077         schema:
11078           openAPIV3Schema:
11079             properties:
11080               apiVersion:
11081                 description: 'APIVersion defines the versioned schema of this representation
11082                   of an object. Servers should convert recognized schemas to the latest
11083                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
11084                 type: string
11085               kind:
11086                 description: 'Kind is a string value representing the REST resource this
11087                   object represents. Servers may infer this from the endpoint the client
11088                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
11089                 type: string
11090               metadata:
11091                 type: object
11092               spec:
11093                 description: IPPoolSpec contains the specification for an IPPool resource.
11094                 properties:
11095                   allowedUses:
11096                     description: AllowedUse controls what the IP pool will be used for.  If
11097                       not specified or empty, defaults to ["Tunnel", "Workload"] for back-compatibility
11098                     items:
11099                       type: string
11100                     type: array
11101                   blockSize:
11102                     description: The block size to use for IP address assignments from
11103                       this pool. Defaults to 26 for IPv4 and 112 for IPv6.
11104                     type: integer
11105                   cidr:
11106                     description: The pool CIDR.
11107                     type: string
11108                   disableBGPExport:
11109                     description: 'Disable exporting routes from this IP Pool''s CIDR over
11110                       BGP. [Default: false]'
11111                     type: boolean
11112                   disabled:
11113                     description: When disabled is true, Calico IPAM will not assign addresses
11114                       from this pool.
11115                     type: boolean
11116                   ipip:
11117                     description: 'Deprecated: this field is only used for APIv1 backwards
11118                       compatibility. Setting this field is not allowed, this field is
11119                       for internal use only.'
11120                     properties:
11121                       enabled:
11122                         description: When enabled is true, ipip tunneling will be used
11123                           to deliver packets to destinations within this pool.
11124                         type: boolean
11125                       mode:
11126                         description: The IPIP mode.  This can be one of "always" or "cross-subnet".  A
11127                           mode of "always" will also use IPIP tunneling for routing to
11128                           destination IP addresses within this pool.  A mode of "cross-subnet"
11129                           will only use IPIP tunneling when the destination node is on
11130                           a different subnet to the originating node.  The default value
11131                           (if not specified) is "always".
11132                         type: string
11133                     type: object
11134                   ipipMode:
11135                     description: Contains configuration for IPIP tunneling for this pool.
11136                       If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling
11137                       is disabled).
11138                     type: string
11139                   nat-outgoing:
11140                     description: 'Deprecated: this field is only used for APIv1 backwards
11141                       compatibility. Setting this field is not allowed, this field is
11142                       for internal use only.'
11143                     type: boolean
11144                   natOutgoing:
11145                     description: When nat-outgoing is true, packets sent from Calico networked
11146                       containers in this pool to destinations outside of this pool will
11147                       be masqueraded.
11148                     type: boolean
11149                   nodeSelector:
11150                     description: Allows IPPool to allocate for a specific node by label
11151                       selector.
11152                     type: string
11153                   vxlanMode:
11154                     description: Contains configuration for VXLAN tunneling for this pool.
11155                       If not specified, then this is defaulted to "Never" (i.e. VXLAN
11156                       tunneling is disabled).
11157                     type: string
11158                 required:
11159                 - cidr
11160                 type: object
11161             type: object
11162         served: true
11163         storage: true
11164     status:
11165       acceptedNames:
11166         kind: ""
11167         plural: ""
11168       conditions: []
11169       storedVersions: []
11170     ---
11171     apiVersion: apiextensions.k8s.io/v1
11172     kind: CustomResourceDefinition
11173     metadata:
11174       name: ipreservations.crd.projectcalico.org
11175     spec:
11176       group: crd.projectcalico.org
11177       names:
11178         kind: IPReservation
11179         listKind: IPReservationList
11180         plural: ipreservations
11181         singular: ipreservation
11182       scope: Cluster
11183       versions:
11184       - name: v1
11185         schema:
11186           openAPIV3Schema:
11187             properties:
11188               apiVersion:
11189                 description: 'APIVersion defines the versioned schema of this representation
11190                   of an object. Servers should convert recognized schemas to the latest
11191                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
11192                 type: string
11193               kind:
11194                 description: 'Kind is a string value representing the REST resource this
11195                   object represents. Servers may infer this from the endpoint the client
11196                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
11197                 type: string
11198               metadata:
11199                 type: object
11200               spec:
11201                 description: IPReservationSpec contains the specification for an IPReservation
11202                   resource.
11203                 properties:
11204                   reservedCIDRs:
11205                     description: ReservedCIDRs is a list of CIDRs and/or IP addresses
11206                       that Calico IPAM will exclude from new allocations.
11207                     items:
11208                       type: string
11209                     type: array
11210                 type: object
11211             type: object
11212         served: true
11213         storage: true
11214     status:
11215       acceptedNames:
11216         kind: ""
11217         plural: ""
11218       conditions: []
11219       storedVersions: []
11220     ---
11221     apiVersion: apiextensions.k8s.io/v1
11222     kind: CustomResourceDefinition
11223     metadata:
11224       name: kubecontrollersconfigurations.crd.projectcalico.org
11225     spec:
11226       group: crd.projectcalico.org
11227       names:
11228         kind: KubeControllersConfiguration
11229         listKind: KubeControllersConfigurationList
11230         plural: kubecontrollersconfigurations
11231         singular: kubecontrollersconfiguration
11232       scope: Cluster
11233       versions:
11234       - name: v1
11235         schema:
11236           openAPIV3Schema:
11237             properties:
11238               apiVersion:
11239                 description: 'APIVersion defines the versioned schema of this representation
11240                   of an object. Servers should convert recognized schemas to the latest
11241                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
11242                 type: string
11243               kind:
11244                 description: 'Kind is a string value representing the REST resource this
11245                   object represents. Servers may infer this from the endpoint the client
11246                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
11247                 type: string
11248               metadata:
11249                 type: object
11250               spec:
11251                 description: KubeControllersConfigurationSpec contains the values of the
11252                   Kubernetes controllers configuration.
11253                 properties:
11254                   controllers:
11255                     description: Controllers enables and configures individual Kubernetes
11256                       controllers
11257                     properties:
11258                       namespace:
11259                         description: Namespace enables and configures the namespace controller.
11260                           Enabled by default, set to nil to disable.
11261                         properties:
11262                           reconcilerPeriod:
11263                             description: 'ReconcilerPeriod is the period to perform reconciliation
11264                               with the Calico datastore. [Default: 5m]'
11265                             type: string
11266                         type: object
11267                       node:
11268                         description: Node enables and configures the node controller.
11269                           Enabled by default, set to nil to disable.
11270                         properties:
11271                           hostEndpoint:
11272                             description: HostEndpoint controls syncing nodes to host endpoints.
11273                               Disabled by default, set to nil to disable.
11274                             properties:
11275                               autoCreate:
11276                                 description: 'AutoCreate enables automatic creation of
11277                                   host endpoints for every node. [Default: Disabled]'
11278                                 type: string
11279                             type: object
11280                           leakGracePeriod:
11281                             description: 'LeakGracePeriod is the period used by the controller
11282                               to determine if an IP address has been leaked. Set to 0
11283                               to disable IP garbage collection. [Default: 15m]'
11284                             type: string
11285                           reconcilerPeriod:
11286                             description: 'ReconcilerPeriod is the period to perform reconciliation
11287                               with the Calico datastore. [Default: 5m]'
11288                             type: string
11289                           syncLabels:
11290                             description: 'SyncLabels controls whether to copy Kubernetes
11291                               node labels to Calico nodes. [Default: Enabled]'
11292                             type: string
11293                         type: object
11294                       policy:
11295                         description: Policy enables and configures the policy controller.
11296                           Enabled by default, set to nil to disable.
11297                         properties:
11298                           reconcilerPeriod:
11299                             description: 'ReconcilerPeriod is the period to perform reconciliation
11300                               with the Calico datastore. [Default: 5m]'
11301                             type: string
11302                         type: object
11303                       serviceAccount:
11304                         description: ServiceAccount enables and configures the service
11305                           account controller. Enabled by default, set to nil to disable.
11306                         properties:
11307                           reconcilerPeriod:
11308                             description: 'ReconcilerPeriod is the period to perform reconciliation
11309                               with the Calico datastore. [Default: 5m]'
11310                             type: string
11311                         type: object
11312                       workloadEndpoint:
11313                         description: WorkloadEndpoint enables and configures the workload
11314                           endpoint controller. Enabled by default, set to nil to disable.
11315                         properties:
11316                           reconcilerPeriod:
11317                             description: 'ReconcilerPeriod is the period to perform reconciliation
11318                               with the Calico datastore. [Default: 5m]'
11319                             type: string
11320                         type: object
11321                     type: object
11322                   etcdV3CompactionPeriod:
11323                     description: 'EtcdV3CompactionPeriod is the period between etcdv3
11324                       compaction requests. Set to 0 to disable. [Default: 10m]'
11325                     type: string
11326                   healthChecks:
11327                     description: 'HealthChecks enables or disables support for health
11328                       checks [Default: Enabled]'
11329                     type: string
11330                   logSeverityScreen:
11331                     description: 'LogSeverityScreen is the log severity above which logs
11332                       are sent to the stdout. [Default: Info]'
11333                     type: string
11334                   prometheusMetricsPort:
11335                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
11336                       metrics server should bind to. Set to 0 to disable. [Default: 9094]'
11337                     type: integer
11338                 required:
11339                 - controllers
11340                 type: object
11341               status:
11342                 description: KubeControllersConfigurationStatus represents the status
11343                   of the configuration. It's useful for admins to be able to see the actual
11344                   config that was applied, which can be modified by environment variables
11345                   on the kube-controllers process.
11346                 properties:
11347                   environmentVars:
11348                     additionalProperties:
11349                       type: string
11350                     description: EnvironmentVars contains the environment variables on
11351                       the kube-controllers that influenced the RunningConfig.
11352                     type: object
11353                   runningConfig:
11354                     description: RunningConfig contains the effective config that is running
11355                       in the kube-controllers pod, after merging the API resource with
11356                       any environment variables.
11357                     properties:
11358                       controllers:
11359                         description: Controllers enables and configures individual Kubernetes
11360                           controllers
11361                         properties:
11362                           namespace:
11363                             description: Namespace enables and configures the namespace
11364                               controller. Enabled by default, set to nil to disable.
11365                             properties:
11366                               reconcilerPeriod:
11367                                 description: 'ReconcilerPeriod is the period to perform
11368                                   reconciliation with the Calico datastore. [Default:
11369                                   5m]'
11370                                 type: string
11371                             type: object
11372                           node:
11373                             description: Node enables and configures the node controller.
11374                               Enabled by default, set to nil to disable.
11375                             properties:
11376                               hostEndpoint:
11377                                 description: HostEndpoint controls syncing nodes to host
11378                                   endpoints. Disabled by default, set to nil to disable.
11379                                 properties:
11380                                   autoCreate:
11381                                     description: 'AutoCreate enables automatic creation
11382                                       of host endpoints for every node. [Default: Disabled]'
11383                                     type: string
11384                                 type: object
11385                               leakGracePeriod:
11386                                 description: 'LeakGracePeriod is the period used by the
11387                                   controller to determine if an IP address has been leaked.
11388                                   Set to 0 to disable IP garbage collection. [Default:
11389                                   15m]'
11390                                 type: string
11391                               reconcilerPeriod:
11392                                 description: 'ReconcilerPeriod is the period to perform
11393                                   reconciliation with the Calico datastore. [Default:
11394                                   5m]'
11395                                 type: string
11396                               syncLabels:
11397                                 description: 'SyncLabels controls whether to copy Kubernetes
11398                                   node labels to Calico nodes. [Default: Enabled]'
11399                                 type: string
11400                             type: object
11401                           policy:
11402                             description: Policy enables and configures the policy controller.
11403                               Enabled by default, set to nil to disable.
11404                             properties:
11405                               reconcilerPeriod:
11406                                 description: 'ReconcilerPeriod is the period to perform
11407                                   reconciliation with the Calico datastore. [Default:
11408                                   5m]'
11409                                 type: string
11410                             type: object
11411                           serviceAccount:
11412                             description: ServiceAccount enables and configures the service
11413                               account controller. Enabled by default, set to nil to disable.
11414                             properties:
11415                               reconcilerPeriod:
11416                                 description: 'ReconcilerPeriod is the period to perform
11417                                   reconciliation with the Calico datastore. [Default:
11418                                   5m]'
11419                                 type: string
11420                             type: object
11421                           workloadEndpoint:
11422                             description: WorkloadEndpoint enables and configures the workload
11423                               endpoint controller. Enabled by default, set to nil to disable.
11424                             properties:
11425                               reconcilerPeriod:
11426                                 description: 'ReconcilerPeriod is the period to perform
11427                                   reconciliation with the Calico datastore. [Default:
11428                                   5m]'
11429                                 type: string
11430                             type: object
11431                         type: object
11432                       etcdV3CompactionPeriod:
11433                         description: 'EtcdV3CompactionPeriod is the period between etcdv3
11434                           compaction requests. Set to 0 to disable. [Default: 10m]'
11435                         type: string
11436                       healthChecks:
11437                         description: 'HealthChecks enables or disables support for health
11438                           checks [Default: Enabled]'
11439                         type: string
11440                       logSeverityScreen:
11441                         description: 'LogSeverityScreen is the log severity above which
11442                           logs are sent to the stdout. [Default: Info]'
11443                         type: string
11444                       prometheusMetricsPort:
11445                         description: 'PrometheusMetricsPort is the TCP port that the Prometheus
11446                           metrics server should bind to. Set to 0 to disable. [Default:
11447                           9094]'
11448                         type: integer
11449                     required:
11450                     - controllers
11451                     type: object
11452                 type: object
11453             type: object
11454         served: true
11455         storage: true
11456     status:
11457       acceptedNames:
11458         kind: ""
11459         plural: ""
11460       conditions: []
11461       storedVersions: []
11462     ---
11463     apiVersion: apiextensions.k8s.io/v1
11464     kind: CustomResourceDefinition
11465     metadata:
11466       name: networkpolicies.crd.projectcalico.org
11467     spec:
11468       group: crd.projectcalico.org
11469       names:
11470         kind: NetworkPolicy
11471         listKind: NetworkPolicyList
11472         plural: networkpolicies
11473         singular: networkpolicy
11474       scope: Namespaced
11475       versions:
11476       - name: v1
11477         schema:
11478           openAPIV3Schema:
11479             properties:
11480               apiVersion:
11481                 description: 'APIVersion defines the versioned schema of this representation
11482                   of an object. Servers should convert recognized schemas to the latest
11483                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
11484                 type: string
11485               kind:
11486                 description: 'Kind is a string value representing the REST resource this
11487                   object represents. Servers may infer this from the endpoint the client
11488                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
11489                 type: string
11490               metadata:
11491                 type: object
11492               spec:
11493                 properties:
11494                   egress:
11495                     description: The ordered set of egress rules.  Each rule contains
11496                       a set of packet match criteria and a corresponding action to apply.
11497                     items:
11498                       description: "A Rule encapsulates a set of match criteria and an
11499                         action.  Both selector-based security Policy and security Profiles
11500                         reference rules - separated out as a list of rules for both ingress
11501                         and egress packet matching. \n Each positive match criteria has
11502                         a negated version, prefixed with \"Not\". All the match criteria
11503                         within a rule must be satisfied for a packet to match. A single
11504                         rule can contain the positive and negative version of a match
11505                         and both must be satisfied for the rule to match."
11506                       properties:
11507                         action:
11508                           type: string
11509                         destination:
11510                           description: Destination contains the match criteria that apply
11511                             to destination entity.
11512                           properties:
11513                             namespaceSelector:
11514                               description: "NamespaceSelector is an optional field that
11515                                 contains a selector expression. Only traffic that originates
11516                                 from (or terminates at) endpoints within the selected
11517                                 namespaces will be matched. When both NamespaceSelector
11518                                 and another selector are defined on the same rule, then
11519                                 only workload endpoints that are matched by both selectors
11520                                 will be selected by the rule. \n For NetworkPolicy, an
11521                                 empty NamespaceSelector implies that the Selector is limited
11522                                 to selecting only workload endpoints in the same namespace
11523                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
11524                                 NamespaceSelector implies that the Selector is limited
11525                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
11526                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
11527                                 the Selector applies to workload endpoints across all
11528                                 namespaces."
11529                               type: string
11530                             nets:
11531                               description: Nets is an optional field that restricts the
11532                                 rule to only apply to traffic that originates from (or
11533                                 terminates at) IP addresses in any of the given subnets.
11534                               items:
11535                                 type: string
11536                               type: array
11537                             notNets:
11538                               description: NotNets is the negated version of the Nets
11539                                 field.
11540                               items:
11541                                 type: string
11542                               type: array
11543                             notPorts:
11544                               description: NotPorts is the negated version of the Ports
11545                                 field. Since only some protocols have ports, if any ports
11546                                 are specified it requires the Protocol match in the Rule
11547                                 to be set to "TCP" or "UDP".
11548                               items:
11549                                 anyOf:
11550                                 - type: integer
11551                                 - type: string
11552                                 pattern: ^.*
11553                                 x-kubernetes-int-or-string: true
11554                               type: array
11555                             notSelector:
11556                               description: NotSelector is the negated version of the Selector
11557                                 field.  See Selector field for subtleties with negated
11558                                 selectors.
11559                               type: string
11560                             ports:
11561                               description: "Ports is an optional field that restricts
11562                                 the rule to only apply to traffic that has a source (destination)
11563                                 port that matches one of these ranges/values. This value
11564                                 is a list of integers or strings that represent ranges
11565                                 of ports. \n Since only some protocols have ports, if
11566                                 any ports are specified it requires the Protocol match
11567                                 in the Rule to be set to \"TCP\" or \"UDP\"."
11568                               items:
11569                                 anyOf:
11570                                 - type: integer
11571                                 - type: string
11572                                 pattern: ^.*
11573                                 x-kubernetes-int-or-string: true
11574                               type: array
11575                             selector:
11576                               description: "Selector is an optional field that contains
11577                                 a selector expression (see Policy for sample syntax).
11578                                 \ Only traffic that originates from (terminates at) endpoints
11579                                 matching the selector will be matched. \n Note that: in
11580                                 addition to the negated version of the Selector (see NotSelector
11581                                 below), the selector expression syntax itself supports
11582                                 negation.  The two types of negation are subtly different.
11583                                 One negates the set of matched endpoints, the other negates
11584                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
11585                                 packets that are from other Calico-controlled \tendpoints
11586                                 that do not have the label \"my_label\". \n \tNotSelector
11587                                 = \"has(my_label)\" matches packets that are not from
11588                                 Calico-controlled \tendpoints that do have the label \"my_label\".
11589                                 \n The effect is that the latter will accept packets from
11590                                 non-Calico sources whereas the former is limited to packets
11591                                 from Calico-controlled endpoints."
11592                               type: string
11593                             serviceAccounts:
11594                               description: ServiceAccounts is an optional field that restricts
11595                                 the rule to only apply to traffic that originates from
11596                                 (or terminates at) a pod running as a matching service
11597                                 account.
11598                               properties:
11599                                 names:
11600                                   description: Names is an optional field that restricts
11601                                     the rule to only apply to traffic that originates
11602                                     from (or terminates at) a pod running as a service
11603                                     account whose name is in the list.
11604                                   items:
11605                                     type: string
11606                                   type: array
11607                                 selector:
11608                                   description: Selector is an optional field that restricts
11609                                     the rule to only apply to traffic that originates
11610                                     from (or terminates at) a pod running as a service
11611                                     account that matches the given label selector. If
11612                                     both Names and Selector are specified then they are
11613                                     AND'ed.
11614                                   type: string
11615                               type: object
11616                             services:
11617                               description: "Services is an optional field that contains
11618                                 options for matching Kubernetes Services. If specified,
11619                                 only traffic that originates from or terminates at endpoints
11620                                 within the selected service(s) will be matched, and only
11621                                 to/from each endpoint's port. \n Services cannot be specified
11622                                 on the same rule as Selector, NotSelector, NamespaceSelector,
11623                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
11624                                 can only be specified with Services on ingress rules."
11625                               properties:
11626                                 name:
11627                                   description: Name specifies the name of a Kubernetes
11628                                     Service to match.
11629                                   type: string
11630                                 namespace:
11631                                   description: Namespace specifies the namespace of the
11632                                     given Service. If left empty, the rule will match
11633                                     within this policy's namespace.
11634                                   type: string
11635                               type: object
11636                           type: object
11637                         http:
11638                           description: HTTP contains match criteria that apply to HTTP
11639                             requests.
11640                           properties:
11641                             methods:
11642                               description: Methods is an optional field that restricts
11643                                 the rule to apply only to HTTP requests that use one of
11644                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
11645                                 methods are OR'd together.
11646                               items:
11647                                 type: string
11648                               type: array
11649                             paths:
11650                               description: 'Paths is an optional field that restricts
11651                                 the rule to apply to HTTP requests that use one of the
11652                                 listed HTTP Paths. Multiple paths are OR''d together.
11653                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
11654                                 ONLY specify either a `exact` or a `prefix` match. The
11655                                 validator will check for it.'
11656                               items:
11657                                 description: 'HTTPPath specifies an HTTP path to match.
11658                                   It may be either of the form: exact: <path>: which matches
11659                                   the path exactly or prefix: <path-prefix>: which matches
11660                                   the path prefix'
11661                                 properties:
11662                                   exact:
11663                                     type: string
11664                                   prefix:
11665                                     type: string
11666                                 type: object
11667                               type: array
11668                           type: object
11669                         icmp:
11670                           description: ICMP is an optional field that restricts the rule
11671                             to apply to a specific type and code of ICMP traffic.  This
11672                             should only be specified if the Protocol field is set to "ICMP"
11673                             or "ICMPv6".
11674                           properties:
11675                             code:
11676                               description: Match on a specific ICMP code.  If specified,
11677                                 the Type value must also be specified. This is a technical
11678                                 limitation imposed by the kernel's iptables firewall,
11679                                 which Calico uses to enforce the rule.
11680                               type: integer
11681                             type:
11682                               description: Match on a specific ICMP type.  For example
11683                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
11684                               type: integer
11685                           type: object
11686                         ipVersion:
11687                           description: IPVersion is an optional field that restricts the
11688                             rule to only match a specific IP version.
11689                           type: integer
11690                         metadata:
11691                           description: Metadata contains additional information for this
11692                             rule
11693                           properties:
11694                             annotations:
11695                               additionalProperties:
11696                                 type: string
11697                               description: Annotations is a set of key value pairs that
11698                                 give extra information about the rule
11699                               type: object
11700                           type: object
11701                         notICMP:
11702                           description: NotICMP is the negated version of the ICMP field.
11703                           properties:
11704                             code:
11705                               description: Match on a specific ICMP code.  If specified,
11706                                 the Type value must also be specified. This is a technical
11707                                 limitation imposed by the kernel's iptables firewall,
11708                                 which Calico uses to enforce the rule.
11709                               type: integer
11710                             type:
11711                               description: Match on a specific ICMP type.  For example
11712                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
11713                               type: integer
11714                           type: object
11715                         notProtocol:
11716                           anyOf:
11717                           - type: integer
11718                           - type: string
11719                           description: NotProtocol is the negated version of the Protocol
11720                             field.
11721                           pattern: ^.*
11722                           x-kubernetes-int-or-string: true
11723                         protocol:
11724                           anyOf:
11725                           - type: integer
11726                           - type: string
11727                           description: "Protocol is an optional field that restricts the
11728                             rule to only apply to traffic of a specific IP protocol. Required
11729                             if any of the EntityRules contain Ports (because ports only
11730                             apply to certain protocols). \n Must be one of these string
11731                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
11732                             \"UDPLite\" or an integer in the range 1-255."
11733                           pattern: ^.*
11734                           x-kubernetes-int-or-string: true
11735                         source:
11736                           description: Source contains the match criteria that apply to
11737                             source entity.
11738                           properties:
11739                             namespaceSelector:
11740                               description: "NamespaceSelector is an optional field that
11741                                 contains a selector expression. Only traffic that originates
11742                                 from (or terminates at) endpoints within the selected
11743                                 namespaces will be matched. When both NamespaceSelector
11744                                 and another selector are defined on the same rule, then
11745                                 only workload endpoints that are matched by both selectors
11746                                 will be selected by the rule. \n For NetworkPolicy, an
11747                                 empty NamespaceSelector implies that the Selector is limited
11748                                 to selecting only workload endpoints in the same namespace
11749                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
11750                                 NamespaceSelector implies that the Selector is limited
11751                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
11752                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
11753                                 the Selector applies to workload endpoints across all
11754                                 namespaces."
11755                               type: string
11756                             nets:
11757                               description: Nets is an optional field that restricts the
11758                                 rule to only apply to traffic that originates from (or
11759                                 terminates at) IP addresses in any of the given subnets.
11760                               items:
11761                                 type: string
11762                               type: array
11763                             notNets:
11764                               description: NotNets is the negated version of the Nets
11765                                 field.
11766                               items:
11767                                 type: string
11768                               type: array
11769                             notPorts:
11770                               description: NotPorts is the negated version of the Ports
11771                                 field. Since only some protocols have ports, if any ports
11772                                 are specified it requires the Protocol match in the Rule
11773                                 to be set to "TCP" or "UDP".
11774                               items:
11775                                 anyOf:
11776                                 - type: integer
11777                                 - type: string
11778                                 pattern: ^.*
11779                                 x-kubernetes-int-or-string: true
11780                               type: array
11781                             notSelector:
11782                               description: NotSelector is the negated version of the Selector
11783                                 field.  See Selector field for subtleties with negated
11784                                 selectors.
11785                               type: string
11786                             ports:
11787                               description: "Ports is an optional field that restricts
11788                                 the rule to only apply to traffic that has a source (destination)
11789                                 port that matches one of these ranges/values. This value
11790                                 is a list of integers or strings that represent ranges
11791                                 of ports. \n Since only some protocols have ports, if
11792                                 any ports are specified it requires the Protocol match
11793                                 in the Rule to be set to \"TCP\" or \"UDP\"."
11794                               items:
11795                                 anyOf:
11796                                 - type: integer
11797                                 - type: string
11798                                 pattern: ^.*
11799                                 x-kubernetes-int-or-string: true
11800                               type: array
11801                             selector:
11802                               description: "Selector is an optional field that contains
11803                                 a selector expression (see Policy for sample syntax).
11804                                 \ Only traffic that originates from (terminates at) endpoints
11805                                 matching the selector will be matched. \n Note that: in
11806                                 addition to the negated version of the Selector (see NotSelector
11807                                 below), the selector expression syntax itself supports
11808                                 negation.  The two types of negation are subtly different.
11809                                 One negates the set of matched endpoints, the other negates
11810                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
11811                                 packets that are from other Calico-controlled \tendpoints
11812                                 that do not have the label \"my_label\". \n \tNotSelector
11813                                 = \"has(my_label)\" matches packets that are not from
11814                                 Calico-controlled \tendpoints that do have the label \"my_label\".
11815                                 \n The effect is that the latter will accept packets from
11816                                 non-Calico sources whereas the former is limited to packets
11817                                 from Calico-controlled endpoints."
11818                               type: string
11819                             serviceAccounts:
11820                               description: ServiceAccounts is an optional field that restricts
11821                                 the rule to only apply to traffic that originates from
11822                                 (or terminates at) a pod running as a matching service
11823                                 account.
11824                               properties:
11825                                 names:
11826                                   description: Names is an optional field that restricts
11827                                     the rule to only apply to traffic that originates
11828                                     from (or terminates at) a pod running as a service
11829                                     account whose name is in the list.
11830                                   items:
11831                                     type: string
11832                                   type: array
11833                                 selector:
11834                                   description: Selector is an optional field that restricts
11835                                     the rule to only apply to traffic that originates
11836                                     from (or terminates at) a pod running as a service
11837                                     account that matches the given label selector. If
11838                                     both Names and Selector are specified then they are
11839                                     AND'ed.
11840                                   type: string
11841                               type: object
11842                             services:
11843                               description: "Services is an optional field that contains
11844                                 options for matching Kubernetes Services. If specified,
11845                                 only traffic that originates from or terminates at endpoints
11846                                 within the selected service(s) will be matched, and only
11847                                 to/from each endpoint's port. \n Services cannot be specified
11848                                 on the same rule as Selector, NotSelector, NamespaceSelector,
11849                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
11850                                 can only be specified with Services on ingress rules."
11851                               properties:
11852                                 name:
11853                                   description: Name specifies the name of a Kubernetes
11854                                     Service to match.
11855                                   type: string
11856                                 namespace:
11857                                   description: Namespace specifies the namespace of the
11858                                     given Service. If left empty, the rule will match
11859                                     within this policy's namespace.
11860                                   type: string
11861                               type: object
11862                           type: object
11863                       required:
11864                       - action
11865                       type: object
11866                     type: array
11867                   ingress:
11868                     description: The ordered set of ingress rules.  Each rule contains
11869                       a set of packet match criteria and a corresponding action to apply.
11870                     items:
11871                       description: "A Rule encapsulates a set of match criteria and an
11872                         action.  Both selector-based security Policy and security Profiles
11873                         reference rules - separated out as a list of rules for both ingress
11874                         and egress packet matching. \n Each positive match criteria has
11875                         a negated version, prefixed with \"Not\". All the match criteria
11876                         within a rule must be satisfied for a packet to match. A single
11877                         rule can contain the positive and negative version of a match
11878                         and both must be satisfied for the rule to match."
11879                       properties:
11880                         action:
11881                           type: string
11882                         destination:
11883                           description: Destination contains the match criteria that apply
11884                             to destination entity.
11885                           properties:
11886                             namespaceSelector:
11887                               description: "NamespaceSelector is an optional field that
11888                                 contains a selector expression. Only traffic that originates
11889                                 from (or terminates at) endpoints within the selected
11890                                 namespaces will be matched. When both NamespaceSelector
11891                                 and another selector are defined on the same rule, then
11892                                 only workload endpoints that are matched by both selectors
11893                                 will be selected by the rule. \n For NetworkPolicy, an
11894                                 empty NamespaceSelector implies that the Selector is limited
11895                                 to selecting only workload endpoints in the same namespace
11896                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
11897                                 NamespaceSelector implies that the Selector is limited
11898                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
11899                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
11900                                 the Selector applies to workload endpoints across all
11901                                 namespaces."
11902                               type: string
11903                             nets:
11904                               description: Nets is an optional field that restricts the
11905                                 rule to only apply to traffic that originates from (or
11906                                 terminates at) IP addresses in any of the given subnets.
11907                               items:
11908                                 type: string
11909                               type: array
11910                             notNets:
11911                               description: NotNets is the negated version of the Nets
11912                                 field.
11913                               items:
11914                                 type: string
11915                               type: array
11916                             notPorts:
11917                               description: NotPorts is the negated version of the Ports
11918                                 field. Since only some protocols have ports, if any ports
11919                                 are specified it requires the Protocol match in the Rule
11920                                 to be set to "TCP" or "UDP".
11921                               items:
11922                                 anyOf:
11923                                 - type: integer
11924                                 - type: string
11925                                 pattern: ^.*
11926                                 x-kubernetes-int-or-string: true
11927                               type: array
11928                             notSelector:
11929                               description: NotSelector is the negated version of the Selector
11930                                 field.  See Selector field for subtleties with negated
11931                                 selectors.
11932                               type: string
11933                             ports:
11934                               description: "Ports is an optional field that restricts
11935                                 the rule to only apply to traffic that has a source (destination)
11936                                 port that matches one of these ranges/values. This value
11937                                 is a list of integers or strings that represent ranges
11938                                 of ports. \n Since only some protocols have ports, if
11939                                 any ports are specified it requires the Protocol match
11940                                 in the Rule to be set to \"TCP\" or \"UDP\"."
11941                               items:
11942                                 anyOf:
11943                                 - type: integer
11944                                 - type: string
11945                                 pattern: ^.*
11946                                 x-kubernetes-int-or-string: true
11947                               type: array
11948                             selector:
11949                               description: "Selector is an optional field that contains
11950                                 a selector expression (see Policy for sample syntax).
11951                                 \ Only traffic that originates from (terminates at) endpoints
11952                                 matching the selector will be matched. \n Note that: in
11953                                 addition to the negated version of the Selector (see NotSelector
11954                                 below), the selector expression syntax itself supports
11955                                 negation.  The two types of negation are subtly different.
11956                                 One negates the set of matched endpoints, the other negates
11957                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
11958                                 packets that are from other Calico-controlled \tendpoints
11959                                 that do not have the label \"my_label\". \n \tNotSelector
11960                                 = \"has(my_label)\" matches packets that are not from
11961                                 Calico-controlled \tendpoints that do have the label \"my_label\".
11962                                 \n The effect is that the latter will accept packets from
11963                                 non-Calico sources whereas the former is limited to packets
11964                                 from Calico-controlled endpoints."
11965                               type: string
11966                             serviceAccounts:
11967                               description: ServiceAccounts is an optional field that restricts
11968                                 the rule to only apply to traffic that originates from
11969                                 (or terminates at) a pod running as a matching service
11970                                 account.
11971                               properties:
11972                                 names:
11973                                   description: Names is an optional field that restricts
11974                                     the rule to only apply to traffic that originates
11975                                     from (or terminates at) a pod running as a service
11976                                     account whose name is in the list.
11977                                   items:
11978                                     type: string
11979                                   type: array
11980                                 selector:
11981                                   description: Selector is an optional field that restricts
11982                                     the rule to only apply to traffic that originates
11983                                     from (or terminates at) a pod running as a service
11984                                     account that matches the given label selector. If
11985                                     both Names and Selector are specified then they are
11986                                     AND'ed.
11987                                   type: string
11988                               type: object
11989                             services:
11990                               description: "Services is an optional field that contains
11991                                 options for matching Kubernetes Services. If specified,
11992                                 only traffic that originates from or terminates at endpoints
11993                                 within the selected service(s) will be matched, and only
11994                                 to/from each endpoint's port. \n Services cannot be specified
11995                                 on the same rule as Selector, NotSelector, NamespaceSelector,
11996                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
11997                                 can only be specified with Services on ingress rules."
11998                               properties:
11999                                 name:
12000                                   description: Name specifies the name of a Kubernetes
12001                                     Service to match.
12002                                   type: string
12003                                 namespace:
12004                                   description: Namespace specifies the namespace of the
12005                                     given Service. If left empty, the rule will match
12006                                     within this policy's namespace.
12007                                   type: string
12008                               type: object
12009                           type: object
12010                         http:
12011                           description: HTTP contains match criteria that apply to HTTP
12012                             requests.
12013                           properties:
12014                             methods:
12015                               description: Methods is an optional field that restricts
12016                                 the rule to apply only to HTTP requests that use one of
12017                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
12018                                 methods are OR'd together.
12019                               items:
12020                                 type: string
12021                               type: array
12022                             paths:
12023                               description: 'Paths is an optional field that restricts
12024                                 the rule to apply to HTTP requests that use one of the
12025                                 listed HTTP Paths. Multiple paths are OR''d together.
12026                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
12027                                 ONLY specify either a `exact` or a `prefix` match. The
12028                                 validator will check for it.'
12029                               items:
12030                                 description: 'HTTPPath specifies an HTTP path to match.
12031                                   It may be either of the form: exact: <path>: which matches
12032                                   the path exactly or prefix: <path-prefix>: which matches
12033                                   the path prefix'
12034                                 properties:
12035                                   exact:
12036                                     type: string
12037                                   prefix:
12038                                     type: string
12039                                 type: object
12040                               type: array
12041                           type: object
12042                         icmp:
12043                           description: ICMP is an optional field that restricts the rule
12044                             to apply to a specific type and code of ICMP traffic.  This
12045                             should only be specified if the Protocol field is set to "ICMP"
12046                             or "ICMPv6".
12047                           properties:
12048                             code:
12049                               description: Match on a specific ICMP code.  If specified,
12050                                 the Type value must also be specified. This is a technical
12051                                 limitation imposed by the kernel's iptables firewall,
12052                                 which Calico uses to enforce the rule.
12053                               type: integer
12054                             type:
12055                               description: Match on a specific ICMP type.  For example
12056                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
12057                               type: integer
12058                           type: object
12059                         ipVersion:
12060                           description: IPVersion is an optional field that restricts the
12061                             rule to only match a specific IP version.
12062                           type: integer
12063                         metadata:
12064                           description: Metadata contains additional information for this
12065                             rule
12066                           properties:
12067                             annotations:
12068                               additionalProperties:
12069                                 type: string
12070                               description: Annotations is a set of key value pairs that
12071                                 give extra information about the rule
12072                               type: object
12073                           type: object
12074                         notICMP:
12075                           description: NotICMP is the negated version of the ICMP field.
12076                           properties:
12077                             code:
12078                               description: Match on a specific ICMP code.  If specified,
12079                                 the Type value must also be specified. This is a technical
12080                                 limitation imposed by the kernel's iptables firewall,
12081                                 which Calico uses to enforce the rule.
12082                               type: integer
12083                             type:
12084                               description: Match on a specific ICMP type.  For example
12085                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
12086                               type: integer
12087                           type: object
12088                         notProtocol:
12089                           anyOf:
12090                           - type: integer
12091                           - type: string
12092                           description: NotProtocol is the negated version of the Protocol
12093                             field.
12094                           pattern: ^.*
12095                           x-kubernetes-int-or-string: true
12096                         protocol:
12097                           anyOf:
12098                           - type: integer
12099                           - type: string
12100                           description: "Protocol is an optional field that restricts the
12101                             rule to only apply to traffic of a specific IP protocol. Required
12102                             if any of the EntityRules contain Ports (because ports only
12103                             apply to certain protocols). \n Must be one of these string
12104                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
12105                             \"UDPLite\" or an integer in the range 1-255."
12106                           pattern: ^.*
12107                           x-kubernetes-int-or-string: true
12108                         source:
12109                           description: Source contains the match criteria that apply to
12110                             source entity.
12111                           properties:
12112                             namespaceSelector:
12113                               description: "NamespaceSelector is an optional field that
12114                                 contains a selector expression. Only traffic that originates
12115                                 from (or terminates at) endpoints within the selected
12116                                 namespaces will be matched. When both NamespaceSelector
12117                                 and another selector are defined on the same rule, then
12118                                 only workload endpoints that are matched by both selectors
12119                                 will be selected by the rule. \n For NetworkPolicy, an
12120                                 empty NamespaceSelector implies that the Selector is limited
12121                                 to selecting only workload endpoints in the same namespace
12122                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
12123                                 NamespaceSelector implies that the Selector is limited
12124                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
12125                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
12126                                 the Selector applies to workload endpoints across all
12127                                 namespaces."
12128                               type: string
12129                             nets:
12130                               description: Nets is an optional field that restricts the
12131                                 rule to only apply to traffic that originates from (or
12132                                 terminates at) IP addresses in any of the given subnets.
12133                               items:
12134                                 type: string
12135                               type: array
12136                             notNets:
12137                               description: NotNets is the negated version of the Nets
12138                                 field.
12139                               items:
12140                                 type: string
12141                               type: array
12142                             notPorts:
12143                               description: NotPorts is the negated version of the Ports
12144                                 field. Since only some protocols have ports, if any ports
12145                                 are specified it requires the Protocol match in the Rule
12146                                 to be set to "TCP" or "UDP".
12147                               items:
12148                                 anyOf:
12149                                 - type: integer
12150                                 - type: string
12151                                 pattern: ^.*
12152                                 x-kubernetes-int-or-string: true
12153                               type: array
12154                             notSelector:
12155                               description: NotSelector is the negated version of the Selector
12156                                 field.  See Selector field for subtleties with negated
12157                                 selectors.
12158                               type: string
12159                             ports:
12160                               description: "Ports is an optional field that restricts
12161                                 the rule to only apply to traffic that has a source (destination)
12162                                 port that matches one of these ranges/values. This value
12163                                 is a list of integers or strings that represent ranges
12164                                 of ports. \n Since only some protocols have ports, if
12165                                 any ports are specified it requires the Protocol match
12166                                 in the Rule to be set to \"TCP\" or \"UDP\"."
12167                               items:
12168                                 anyOf:
12169                                 - type: integer
12170                                 - type: string
12171                                 pattern: ^.*
12172                                 x-kubernetes-int-or-string: true
12173                               type: array
12174                             selector:
12175                               description: "Selector is an optional field that contains
12176                                 a selector expression (see Policy for sample syntax).
12177                                 \ Only traffic that originates from (terminates at) endpoints
12178                                 matching the selector will be matched. \n Note that: in
12179                                 addition to the negated version of the Selector (see NotSelector
12180                                 below), the selector expression syntax itself supports
12181                                 negation.  The two types of negation are subtly different.
12182                                 One negates the set of matched endpoints, the other negates
12183                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
12184                                 packets that are from other Calico-controlled \tendpoints
12185                                 that do not have the label \"my_label\". \n \tNotSelector
12186                                 = \"has(my_label)\" matches packets that are not from
12187                                 Calico-controlled \tendpoints that do have the label \"my_label\".
12188                                 \n The effect is that the latter will accept packets from
12189                                 non-Calico sources whereas the former is limited to packets
12190                                 from Calico-controlled endpoints."
12191                               type: string
12192                             serviceAccounts:
12193                               description: ServiceAccounts is an optional field that restricts
12194                                 the rule to only apply to traffic that originates from
12195                                 (or terminates at) a pod running as a matching service
12196                                 account.
12197                               properties:
12198                                 names:
12199                                   description: Names is an optional field that restricts
12200                                     the rule to only apply to traffic that originates
12201                                     from (or terminates at) a pod running as a service
12202                                     account whose name is in the list.
12203                                   items:
12204                                     type: string
12205                                   type: array
12206                                 selector:
12207                                   description: Selector is an optional field that restricts
12208                                     the rule to only apply to traffic that originates
12209                                     from (or terminates at) a pod running as a service
12210                                     account that matches the given label selector. If
12211                                     both Names and Selector are specified then they are
12212                                     AND'ed.
12213                                   type: string
12214                               type: object
12215                             services:
12216                               description: "Services is an optional field that contains
12217                                 options for matching Kubernetes Services. If specified,
12218                                 only traffic that originates from or terminates at endpoints
12219                                 within the selected service(s) will be matched, and only
12220                                 to/from each endpoint's port. \n Services cannot be specified
12221                                 on the same rule as Selector, NotSelector, NamespaceSelector,
12222                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
12223                                 can only be specified with Services on ingress rules."
12224                               properties:
12225                                 name:
12226                                   description: Name specifies the name of a Kubernetes
12227                                     Service to match.
12228                                   type: string
12229                                 namespace:
12230                                   description: Namespace specifies the namespace of the
12231                                     given Service. If left empty, the rule will match
12232                                     within this policy's namespace.
12233                                   type: string
12234                               type: object
12235                           type: object
12236                       required:
12237                       - action
12238                       type: object
12239                     type: array
12240                   order:
12241                     description: Order is an optional field that specifies the order in
12242                       which the policy is applied. Policies with higher "order" are applied
12243                       after those with lower order.  If the order is omitted, it may be
12244                       considered to be "infinite" - i.e. the policy will be applied last.  Policies
12245                       with identical order will be applied in alphanumerical order based
12246                       on the Policy "Name".
12247                     type: number
12248                   selector:
12249                     description: "The selector is an expression used to pick pick out
12250                       the endpoints that the policy should be applied to. \n Selector
12251                       expressions follow this syntax: \n \tlabel == \"string_literal\"
12252                       \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
12253                       \  ->  not equal; also matches if label is not present \tlabel in
12254                       { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
12255                       one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
12256                       ... }  ->  true if the value of label X is not one of \"a\", \"b\",
12257                       \"c\" \thas(label_name)  -> True if that label is present \t! expr
12258                       -> negation of expr \texpr && expr  -> Short-circuit and \texpr
12259                       || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
12260                       or the empty selector -> matches all endpoints. \n Label names are
12261                       allowed to contain alphanumerics, -, _ and /. String literals are
12262                       more permissive but they do not support escape characters. \n Examples
12263                       (with made-up labels): \n \ttype == \"webserver\" && deployment
12264                       == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
12265                       \"dev\" \t! has(label_name)"
12266                     type: string
12267                   serviceAccountSelector:
12268                     description: ServiceAccountSelector is an optional field for an expression
12269                       used to select a pod based on service accounts.
12270                     type: string
12271                   types:
12272                     description: "Types indicates whether this policy applies to ingress,
12273                       or to egress, or to both.  When not explicitly specified (and so
12274                       the value on creation is empty or nil), Calico defaults Types according
12275                       to what Ingress and Egress are present in the policy.  The default
12276                       is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
12277                       the case where there are   also no Ingress rules) \n - [ PolicyTypeEgress
12278                       ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
12279                       PolicyTypeEgress ], if there are both Ingress and Egress rules.
12280                       \n When the policy is read back again, Types will always be one
12281                       of these values, never empty or nil."
12282                     items:
12283                       description: PolicyType enumerates the possible values of the PolicySpec
12284                         Types field.
12285                       type: string
12286                     type: array
12287                 type: object
12288             type: object
12289         served: true
12290         storage: true
12291     status:
12292       acceptedNames:
12293         kind: ""
12294         plural: ""
12295       conditions: []
12296       storedVersions: []
12297     ---
12298     apiVersion: apiextensions.k8s.io/v1
12299     kind: CustomResourceDefinition
12300     metadata:
12301       name: networksets.crd.projectcalico.org
12302     spec:
12303       group: crd.projectcalico.org
12304       names:
12305         kind: NetworkSet
12306         listKind: NetworkSetList
12307         plural: networksets
12308         singular: networkset
12309       scope: Namespaced
12310       versions:
12311       - name: v1
12312         schema:
12313           openAPIV3Schema:
12314             description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet.
12315             properties:
12316               apiVersion:
12317                 description: 'APIVersion defines the versioned schema of this representation
12318                   of an object. Servers should convert recognized schemas to the latest
12319                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
12320                 type: string
12321               kind:
12322                 description: 'Kind is a string value representing the REST resource this
12323                   object represents. Servers may infer this from the endpoint the client
12324                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
12325                 type: string
12326               metadata:
12327                 type: object
12328               spec:
12329                 description: NetworkSetSpec contains the specification for a NetworkSet
12330                   resource.
12331                 properties:
12332                   nets:
12333                     description: The list of IP networks that belong to this set.
12334                     items:
12335                       type: string
12336                     type: array
12337                 type: object
12338             type: object
12339         served: true
12340         storage: true
12341     status:
12342       acceptedNames:
12343         kind: ""
12344         plural: ""
12345       conditions: []
12346       storedVersions: []
12347     ---
12348     apiVersion: v1
12349     kind: ServiceAccount
12350     metadata:
12351       name: calico-kube-controllers
12352       namespace: kube-system
12353     ---
12354     apiVersion: v1
12355     kind: ServiceAccount
12356     metadata:
12357       name: calico-node
12358       namespace: kube-system
12359     ---
12360     apiVersion: rbac.authorization.k8s.io/v1
12361     kind: ClusterRole
12362     metadata:
12363       name: calico-kube-controllers
12364     rules:
12365     - apiGroups:
12366       - ""
12367       resources:
12368       - nodes
12369       verbs:
12370       - watch
12371       - list
12372       - get
12373     - apiGroups:
12374       - ""
12375       resources:
12376       - pods
12377       verbs:
12378       - get
12379       - list
12380       - watch
12381     - apiGroups:
12382       - crd.projectcalico.org
12383       resources:
12384       - ippools
12385       - ipreservations
12386       verbs:
12387       - list
12388     - apiGroups:
12389       - crd.projectcalico.org
12390       resources:
12391       - blockaffinities
12392       - ipamblocks
12393       - ipamhandles
12394       verbs:
12395       - get
12396       - list
12397       - create
12398       - update
12399       - delete
12400       - watch
12401     - apiGroups:
12402       - crd.projectcalico.org
12403       resources:
12404       - hostendpoints
12405       verbs:
12406       - get
12407       - list
12408       - create
12409       - update
12410       - delete
12411     - apiGroups:
12412       - crd.projectcalico.org
12413       resources:
12414       - clusterinformations
12415       verbs:
12416       - get
12417       - create
12418       - update
12419     - apiGroups:
12420       - crd.projectcalico.org
12421       resources:
12422       - kubecontrollersconfigurations
12423       verbs:
12424       - get
12425       - create
12426       - update
12427       - watch
12428     ---
12429     apiVersion: rbac.authorization.k8s.io/v1
12430     kind: ClusterRole
12431     metadata:
12432       name: calico-node
12433     rules:
12434     - apiGroups:
12435       - ""
12436       resources:
12437       - pods
12438       - nodes
12439       - namespaces
12440       verbs:
12441       - get
12442     - apiGroups:
12443       - discovery.k8s.io
12444       resources:
12445       - endpointslices
12446       verbs:
12447       - watch
12448       - list
12449     - apiGroups:
12450       - ""
12451       resources:
12452       - endpoints
12453       - services
12454       verbs:
12455       - watch
12456       - list
12457       - get
12458     - apiGroups:
12459       - ""
12460       resources:
12461       - configmaps
12462       verbs:
12463       - get
12464     - apiGroups:
12465       - ""
12466       resources:
12467       - nodes/status
12468       verbs:
12469       - patch
12470       - update
12471     - apiGroups:
12472       - networking.k8s.io
12473       resources:
12474       - networkpolicies
12475       verbs:
12476       - watch
12477       - list
12478     - apiGroups:
12479       - ""
12480       resources:
12481       - pods
12482       - namespaces
12483       - serviceaccounts
12484       verbs:
12485       - list
12486       - watch
12487     - apiGroups:
12488       - ""
12489       resources:
12490       - pods/status
12491       verbs:
12492       - patch
12493     - apiGroups:
12494       - crd.projectcalico.org
12495       resources:
12496       - globalfelixconfigs
12497       - felixconfigurations
12498       - bgppeers
12499       - globalbgpconfigs
12500       - bgpconfigurations
12501       - ippools
12502       - ipreservations
12503       - ipamblocks
12504       - globalnetworkpolicies
12505       - globalnetworksets
12506       - networkpolicies
12507       - networksets
12508       - clusterinformations
12509       - hostendpoints
12510       - blockaffinities
12511       - caliconodestatuses
12512       verbs:
12513       - get
12514       - list
12515       - watch
12516     - apiGroups:
12517       - crd.projectcalico.org
12518       resources:
12519       - ippools
12520       - felixconfigurations
12521       - clusterinformations
12522       verbs:
12523       - create
12524       - update
12525     - apiGroups:
12526       - crd.projectcalico.org
12527       resources:
12528       - caliconodestatuses
12529       verbs:
12530       - update
12531     - apiGroups:
12532       - ""
12533       resources:
12534       - nodes
12535       verbs:
12536       - get
12537       - list
12538       - watch
12539     - apiGroups:
12540       - crd.projectcalico.org
12541       resources:
12542       - bgpconfigurations
12543       - bgppeers
12544       verbs:
12545       - create
12546       - update
12547     - apiGroups:
12548       - crd.projectcalico.org
12549       resources:
12550       - blockaffinities
12551       - ipamblocks
12552       - ipamhandles
12553       verbs:
12554       - get
12555       - list
12556       - create
12557       - update
12558       - delete
12559     - apiGroups:
12560       - crd.projectcalico.org
12561       resources:
12562       - ipamconfigs
12563       verbs:
12564       - get
12565     - apiGroups:
12566       - crd.projectcalico.org
12567       resources:
12568       - blockaffinities
12569       verbs:
12570       - watch
12571     - apiGroups:
12572       - apps
12573       resources:
12574       - daemonsets
12575       verbs:
12576       - get
12577     ---
12578     apiVersion: rbac.authorization.k8s.io/v1
12579     kind: ClusterRoleBinding
12580     metadata:
12581       name: calico-kube-controllers
12582     roleRef:
12583       apiGroup: rbac.authorization.k8s.io
12584       kind: ClusterRole
12585       name: calico-kube-controllers
12586     subjects:
12587     - kind: ServiceAccount
12588       name: calico-kube-controllers
12589       namespace: kube-system
12590     ---
12591     apiVersion: rbac.authorization.k8s.io/v1
12592     kind: ClusterRoleBinding
12593     metadata:
12594       name: calico-node
12595     roleRef:
12596       apiGroup: rbac.authorization.k8s.io
12597       kind: ClusterRole
12598       name: calico-node
12599     subjects:
12600     - kind: ServiceAccount
12601       name: calico-node
12602       namespace: kube-system
12603     ---
12604     apiVersion: v1
12605     data:
12606       calico_backend: bird
12607       cni_network_config: |-
12608         {
12609           "name": "k8s-pod-network",
12610           "cniVersion": "0.3.1",
12611           "plugins": [
12612             {
12613               "type": "calico",
12614               "log_level": "info",
12615               "log_file_path": "/var/log/calico/cni/cni.log",
12616               "datastore_type": "kubernetes",
12617               "nodename": "__KUBERNETES_NODE_NAME__",
12618               "mtu": __CNI_MTU__,
12619               "ipam": {
12620                   "type": "calico-ipam",
12621                   "assign_ipv4": "false",
12622                   "assign_ipv6": "true"
12623               },
12624               "policy": {
12625                   "type": "k8s"
12626               },
12627               "kubernetes": {
12628                   "kubeconfig": "__KUBECONFIG_FILEPATH__"
12629               }
12630             },
12631             {
12632               "type": "portmap",
12633               "snat": true,
12634               "capabilities": {"portMappings": true}
12635             },
12636             {
12637               "type": "bandwidth",
12638               "capabilities": {"bandwidth": true}
12639             }
12640           ]
12641         }
12642       typha_service_name: none
12643       veth_mtu: "0"
12644     kind: ConfigMap
12645     metadata:
12646       name: calico-config
12647       namespace: kube-system
12648     ---
12649     apiVersion: apps/v1
12650     kind: Deployment
12651     metadata:
12652       labels:
12653         k8s-app: calico-kube-controllers
12654       name: calico-kube-controllers
12655       namespace: kube-system
12656     spec:
12657       replicas: 1
12658       selector:
12659         matchLabels:
12660           k8s-app: calico-kube-controllers
12661       strategy:
12662         type: Recreate
12663       template:
12664         metadata:
12665           labels:
12666             k8s-app: calico-kube-controllers
12667           name: calico-kube-controllers
12668           namespace: kube-system
12669         spec:
12670           containers:
12671           - env:
12672             - name: ENABLED_CONTROLLERS
12673               value: node
12674             - name: DATASTORE_TYPE
12675               value: kubernetes
12676             image: docker.io/calico/kube-controllers:v3.22.1
12677             livenessProbe:
12678               exec:
12679                 command:
12680                 - /usr/bin/check-status
12681                 - -l
12682               failureThreshold: 6
12683               initialDelaySeconds: 10
12684               periodSeconds: 10
12685               timeoutSeconds: 10
12686             name: calico-kube-controllers
12687             readinessProbe:
12688               exec:
12689                 command:
12690                 - /usr/bin/check-status
12691                 - -r
12692               periodSeconds: 10
12693           nodeSelector:
12694             kubernetes.io/os: linux
12695           priorityClassName: system-cluster-critical
12696           serviceAccountName: calico-kube-controllers
12697           tolerations:
12698           - key: CriticalAddonsOnly
12699             operator: Exists
12700           - effect: NoSchedule
12701             key: node-role.kubernetes.io/master
12702     ---
12703     apiVersion: policy/v1beta1
12704     kind: PodDisruptionBudget
12705     metadata:
12706       labels:
12707         k8s-app: calico-kube-controllers
12708       name: calico-kube-controllers
12709       namespace: kube-system
12710     spec:
12711       maxUnavailable: 1
12712       selector:
12713         matchLabels:
12714           k8s-app: calico-kube-controllers
12715     ---
12716     apiVersion: apps/v1
12717     kind: DaemonSet
12718     metadata:
12719       labels:
12720         k8s-app: calico-node
12721       name: calico-node
12722       namespace: kube-system
12723     spec:
12724       selector:
12725         matchLabels:
12726           k8s-app: calico-node
12727       template:
12728         metadata:
12729           labels:
12730             k8s-app: calico-node
12731         spec:
12732           containers:
12733           - env:
12734             - name: IP6_AUTODETECTION_METHOD
12735               value: can-reach=www.google.com
12736             - name: IP6
12737               value: autodetect
12738             - name: FELIX_IPV6SUPPORT
12739               value: "true"
12740             - name: IP
12741               value: none
12742             - name: CALICO_ROUTER_ID
12743               value: hash
12744             - name: DATASTORE_TYPE
12745               value: kubernetes
12746             - name: WAIT_FOR_DATASTORE
12747               value: "true"
12748             - name: NODENAME
12749               valueFrom:
12750                 fieldRef:
12751                   fieldPath: spec.nodeName
12752             - name: CALICO_NETWORKING_BACKEND
12753               valueFrom:
12754                 configMapKeyRef:
12755                   key: calico_backend
12756                   name: calico-config
12757             - name: CLUSTER_TYPE
12758               value: k8s,bgp
12759             - name: CALICO_IPV4POOL_IPIP
12760               value: Always
12761             - name: CALICO_IPV4POOL_VXLAN
12762               value: Never
12763             - name: FELIX_IPINIPMTU
12764               valueFrom:
12765                 configMapKeyRef:
12766                   key: veth_mtu
12767                   name: calico-config
12768             - name: FELIX_VXLANMTU
12769               valueFrom:
12770                 configMapKeyRef:
12771                   key: veth_mtu
12772                   name: calico-config
12773             - name: FELIX_WIREGUARDMTU
12774               valueFrom:
12775                 configMapKeyRef:
12776                   key: veth_mtu
12777                   name: calico-config
12778             - name: CALICO_DISABLE_FILE_LOGGING
12779               value: "true"
12780             - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
12781               value: ACCEPT
12782             - name: FELIX_HEALTHENABLED
12783               value: "true"
12784             envFrom:
12785             - configMapRef:
12786                 name: kubernetes-services-endpoint
12787                 optional: true
12788             image: docker.io/calico/node:v3.22.1
12789             lifecycle:
12790               preStop:
12791                 exec:
12792                   command:
12793                   - /bin/calico-node
12794                   - -shutdown
12795             livenessProbe:
12796               exec:
12797                 command:
12798                 - /bin/calico-node
12799                 - -felix-live
12800                 - -bird-live
12801               failureThreshold: 6
12802               initialDelaySeconds: 10
12803               periodSeconds: 10
12804               timeoutSeconds: 10
12805             name: calico-node
12806             readinessProbe:
12807               exec:
12808                 command:
12809                 - /bin/calico-node
12810                 - -felix-ready
12811                 - -bird-ready
12812               periodSeconds: 10
12813               timeoutSeconds: 10
12814             resources:
12815               requests:
12816                 cpu: 250m
12817             securityContext:
12818               privileged: true
12819             volumeMounts:
12820             - mountPath: /host/etc/cni/net.d
12821               name: cni-net-dir
12822               readOnly: false
12823             - mountPath: /lib/modules
12824               name: lib-modules
12825               readOnly: true
12826             - mountPath: /run/xtables.lock
12827               name: xtables-lock
12828               readOnly: false
12829             - mountPath: /var/run/calico
12830               name: var-run-calico
12831               readOnly: false
12832             - mountPath: /var/lib/calico
12833               name: var-lib-calico
12834               readOnly: false
12835             - mountPath: /var/run/nodeagent
12836               name: policysync
12837             - mountPath: /sys/fs/
12838               mountPropagation: Bidirectional
12839               name: sysfs
12840             - mountPath: /var/log/calico/cni
12841               name: cni-log-dir
12842               readOnly: true
12843           hostNetwork: true
12844           initContainers:
12845           - command:
12846             - /opt/cni/bin/calico-ipam
12847             - -upgrade
12848             env:
12849             - name: KUBERNETES_NODE_NAME
12850               valueFrom:
12851                 fieldRef:
12852                   fieldPath: spec.nodeName
12853             - name: CALICO_NETWORKING_BACKEND
12854               valueFrom:
12855                 configMapKeyRef:
12856                   key: calico_backend
12857                   name: calico-config
12858             envFrom:
12859             - configMapRef:
12860                 name: kubernetes-services-endpoint
12861                 optional: true
12862             image: docker.io/calico/cni:v3.22.1
12863             name: upgrade-ipam
12864             securityContext:
12865               privileged: true
12866             volumeMounts:
12867             - mountPath: /var/lib/cni/networks
12868               name: host-local-net-dir
12869             - mountPath: /host/opt/cni/bin
12870               name: cni-bin-dir
12871           - command:
12872             - /opt/cni/bin/install
12873             env:
12874             - name: CNI_CONF_NAME
12875               value: 10-calico.conflist
12876             - name: CNI_NETWORK_CONFIG
12877               valueFrom:
12878                 configMapKeyRef:
12879                   key: cni_network_config
12880                   name: calico-config
12881             - name: KUBERNETES_NODE_NAME
12882               valueFrom:
12883                 fieldRef:
12884                   fieldPath: spec.nodeName
12885             - name: CNI_MTU
12886               valueFrom:
12887                 configMapKeyRef:
12888                   key: veth_mtu
12889                   name: calico-config
12890             - name: SLEEP
12891               value: "false"
12892             envFrom:
12893             - configMapRef:
12894                 name: kubernetes-services-endpoint
12895                 optional: true
12896             image: docker.io/calico/cni:v3.22.1
12897             name: install-cni
12898             securityContext:
12899               privileged: true
12900             volumeMounts:
12901             - mountPath: /host/opt/cni/bin
12902               name: cni-bin-dir
12903             - mountPath: /host/etc/cni/net.d
12904               name: cni-net-dir
12905           - image: docker.io/calico/pod2daemon-flexvol:v3.22.1
12906             name: flexvol-driver
12907             securityContext:
12908               privileged: true
12909             volumeMounts:
12910             - mountPath: /host/driver
12911               name: flexvol-driver-host
12912           nodeSelector:
12913             kubernetes.io/os: linux
12914           priorityClassName: system-node-critical
12915           serviceAccountName: calico-node
12916           terminationGracePeriodSeconds: 0
12917           tolerations:
12918           - effect: NoSchedule
12919             operator: Exists
12920           - key: CriticalAddonsOnly
12921             operator: Exists
12922           - effect: NoExecute
12923             operator: Exists
12924           volumes:
12925           - hostPath:
12926               path: /lib/modules
12927             name: lib-modules
12928           - hostPath:
12929               path: /var/run/calico
12930             name: var-run-calico
12931           - hostPath:
12932               path: /var/lib/calico
12933             name: var-lib-calico
12934           - hostPath:
12935               path: /run/xtables.lock
12936               type: FileOrCreate
12937             name: xtables-lock
12938           - hostPath:
12939               path: /sys/fs/
12940               type: DirectoryOrCreate
12941             name: sysfs
12942           - hostPath:
12943               path: /opt/cni/bin
12944             name: cni-bin-dir
12945           - hostPath:
12946               path: /etc/cni/net.d
12947             name: cni-net-dir
12948           - hostPath:
12949               path: /var/log/calico/cni
12950             name: cni-log-dir
12951           - hostPath:
12952               path: /var/lib/cni/networks
12953             name: host-local-net-dir
12954           - hostPath:
12955               path: /var/run/nodeagent
12956               type: DirectoryOrCreate
12957             name: policysync
12958           - hostPath:
12959               path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
12960               type: DirectoryOrCreate
12961             name: flexvol-driver-host
12962       updateStrategy:
12963         rollingUpdate:
12964           maxUnavailable: 1
12965         type: RollingUpdate
12966 kind: ConfigMap
12967 metadata:
12968   creationTimestamp: null
12969   name: {{ .Values.clusterName }}-calico-addon
12970 {{- end }}
12971 {{- end }}