deploy/cluster/templates/calico-addon.yaml

   1 {{- if eq .Values.cni "calico" }}
   2 ---
   3 apiVersion: v1
   4 data:
   5   calico.yaml: |
   6     apiVersion: apiextensions.k8s.io/v1
   7     kind: CustomResourceDefinition
   8     metadata:
   9       name: bgpconfigurations.crd.projectcalico.org
  10     spec:
  11       group: crd.projectcalico.org
  12       names:
  13         kind: BGPConfiguration
  14         listKind: BGPConfigurationList
  15         plural: bgpconfigurations
  16         singular: bgpconfiguration
  17       scope: Cluster
  18       versions:
  19       - name: v1
  20         schema:
  21           openAPIV3Schema:
  22             description: BGPConfiguration contains the configuration for any BGP routing.
  23             properties:
  24               apiVersion:
  25                 description: 'APIVersion defines the versioned schema of this representation
  26                   of an object. Servers should convert recognized schemas to the latest
  27                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  28                 type: string
  29               kind:
  30                 description: 'Kind is a string value representing the REST resource this
  31                   object represents. Servers may infer this from the endpoint the client
  32                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  33                 type: string
  34               metadata:
  35                 type: object
  36               spec:
  37                 description: BGPConfigurationSpec contains the values of the BGP configuration.
  38                 properties:
  39                   asNumber:
  40                     description: 'ASNumber is the default AS number used by a node. [Default:
  41                       64512]'
  42                     format: int32
  43                     type: integer
  44                   communities:
  45                     description: Communities is a list of BGP community values and their
  46                       arbitrary names for tagging routes.
  47                     items:
  48                       description: Community contains standard or large community value
  49                         and its name.
  50                       properties:
  51                         name:
  52                           description: Name given to community value.
  53                           type: string
  54                         value:
  55                           description: Value must be of format `aa:nn` or `aa:nn:mm`.
  56                             For standard community use `aa:nn` format, where `aa` and
  57                             `nn` are 16 bit number. For large community use `aa:nn:mm`
  58                             format, where `aa`, `nn` and `mm` are 32 bit number. Where,
  59                             `aa` is an AS Number, `nn` and `mm` are per-AS identifier.
  60                           pattern: ^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$
  61                           type: string
  62                       type: object
  63                     type: array
  64                   listenPort:
  65                     description: ListenPort is the port where BGP protocol should listen.
  66                       Defaults to 179
  67                     maximum: 65535
  68                     minimum: 1
  69                     type: integer
  70                   logSeverityScreen:
  71                     description: 'LogSeverityScreen is the log severity above which logs
  72                       are sent to the stdout. [Default: INFO]'
  73                     type: string
  74                   nodeToNodeMeshEnabled:
  75                     description: 'NodeToNodeMeshEnabled sets whether full node to node
  76                       BGP mesh is enabled. [Default: true]'
  77                     type: boolean
  78                   prefixAdvertisements:
  79                     description: PrefixAdvertisements contains per-prefix advertisement
  80                       configuration.
  81                     items:
  82                       description: PrefixAdvertisement configures advertisement properties
  83                         for the specified CIDR.
  84                       properties:
  85                         cidr:
  86                           description: CIDR for which properties should be advertised.
  87                           type: string
  88                         communities:
  89                           description: Communities can be list of either community names
  90                             already defined in `Specs.Communities` or community value
  91                             of format `aa:nn` or `aa:nn:mm`. For standard community use
  92                             `aa:nn` format, where `aa` and `nn` are 16 bit number. For
  93                             large community use `aa:nn:mm` format, where `aa`, `nn` and
  94                             `mm` are 32 bit number. Where,`aa` is an AS Number, `nn` and
  95                             `mm` are per-AS identifier.
  96                           items:
  97                             type: string
  98                           type: array
  99                       type: object
 100                     type: array
 101                   serviceClusterIPs:
 102                     description: ServiceClusterIPs are the CIDR blocks from which service
 103                       cluster IPs are allocated. If specified, Calico will advertise these
 104                       blocks, as well as any cluster IPs within them.
 105                     items:
 106                       description: ServiceClusterIPBlock represents a single allowed ClusterIP
 107                         CIDR block.
 108                       properties:
 109                         cidr:
 110                           type: string
 111                       type: object
 112                     type: array
 113                   serviceExternalIPs:
 114                     description: ServiceExternalIPs are the CIDR blocks for Kubernetes
 115                       Service External IPs. Kubernetes Service ExternalIPs will only be
 116                       advertised if they are within one of these blocks.
 117                     items:
 118                       description: ServiceExternalIPBlock represents a single allowed
 119                         External IP CIDR block.
 120                       properties:
 121                         cidr:
 122                           type: string
 123                       type: object
 124                     type: array
 125                   serviceLoadBalancerIPs:
 126                     description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes
 127                       Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress
 128                       IPs will only be advertised if they are within one of these blocks.
 129                     items:
 130                       description: ServiceLoadBalancerIPBlock represents a single allowed
 131                         LoadBalancer IP CIDR block.
 132                       properties:
 133                         cidr:
 134                           type: string
 135                       type: object
 136                     type: array
 137                 type: object
 138             type: object
 139         served: true
 140         storage: true
 141     status:
 142       acceptedNames:
 143         kind: ""
 144         plural: ""
 145       conditions: []
 146       storedVersions: []
 147     ---
 148     apiVersion: apiextensions.k8s.io/v1
 149     kind: CustomResourceDefinition
 150     metadata:
 151       name: bgppeers.crd.projectcalico.org
 152     spec:
 153       group: crd.projectcalico.org
 154       names:
 155         kind: BGPPeer
 156         listKind: BGPPeerList
 157         plural: bgppeers
 158         singular: bgppeer
 159       scope: Cluster
 160       versions:
 161       - name: v1
 162         schema:
 163           openAPIV3Schema:
 164             properties:
 165               apiVersion:
 166                 description: 'APIVersion defines the versioned schema of this representation
 167                   of an object. Servers should convert recognized schemas to the latest
 168                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 169                 type: string
 170               kind:
 171                 description: 'Kind is a string value representing the REST resource this
 172                   object represents. Servers may infer this from the endpoint the client
 173                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 174                 type: string
 175               metadata:
 176                 type: object
 177               spec:
 178                 description: BGPPeerSpec contains the specification for a BGPPeer resource.
 179                 properties:
 180                   asNumber:
 181                     description: The AS Number of the peer.
 182                     format: int32
 183                     type: integer
 184                   keepOriginalNextHop:
 185                     description: Option to keep the original nexthop field when routes
 186                       are sent to a BGP Peer. Setting "true" configures the selected BGP
 187                       Peers node to use the "next hop keep;" instead of "next hop self;"(default)
 188                       in the specific branch of the Node on "bird.cfg".
 189                     type: boolean
 190                   maxRestartTime:
 191                     description: Time to allow for software restart.  When specified,
 192                       this is configured as the graceful restart timeout.  When not specified,
 193                       the BIRD default of 120s is used.
 194                     type: string
 195                   node:
 196                     description: The node name identifying the Calico node instance that
 197                       is targeted by this peer. If this is not set, and no nodeSelector
 198                       is specified, then this BGP peer selects all nodes in the cluster.
 199                     type: string
 200                   nodeSelector:
 201                     description: Selector for the nodes that should have this peering.  When
 202                       this is set, the Node field must be empty.
 203                     type: string
 204                   password:
 205                     description: Optional BGP password for the peerings generated by this
 206                       BGPPeer resource.
 207                     properties:
 208                       secretKeyRef:
 209                         description: Selects a key of a secret in the node pod's namespace.
 210                         properties:
 211                           key:
 212                             description: The key of the secret to select from.  Must be
 213                               a valid secret key.
 214                             type: string
 215                           name:
 216                             description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 217                               TODO: Add other useful fields. apiVersion, kind, uid?'
 218                             type: string
 219                           optional:
 220                             description: Specify whether the Secret or its key must be
 221                               defined
 222                             type: boolean
 223                         required:
 224                         - key
 225                         type: object
 226                     type: object
 227                   peerIP:
 228                     description: The IP address of the peer followed by an optional port
 229                       number to peer with. If port number is given, format should be `[<IPv6>]:port`
 230                       or `<IPv4>:<port>` for IPv4. If optional port number is not set,
 231                       and this peer IP and ASNumber belongs to a calico/node with ListenPort
 232                       set in BGPConfiguration, then we use that port to peer.
 233                     type: string
 234                   peerSelector:
 235                     description: Selector for the remote nodes to peer with.  When this
 236                       is set, the PeerIP and ASNumber fields must be empty.  For each
 237                       peering between the local node and selected remote nodes, we configure
 238                       an IPv4 peering if both ends have NodeBGPSpec.IPv4Address specified,
 239                       and an IPv6 peering if both ends have NodeBGPSpec.IPv6Address specified.  The
 240                       remote AS number comes from the remote node's NodeBGPSpec.ASNumber,
 241                       or the global default if that is not set.
 242                     type: string
 243                   sourceAddress:
 244                     description: Specifies whether and how to configure a source address
 245                       for the peerings generated by this BGPPeer resource.  Default value
 246                       "UseNodeIP" means to configure the node IP as the source address.  "None"
 247                       means not to configure a source address.
 248                     type: string
 249                 type: object
 250             type: object
 251         served: true
 252         storage: true
 253     status:
 254       acceptedNames:
 255         kind: ""
 256         plural: ""
 257       conditions: []
 258       storedVersions: []
 259     ---
 260     apiVersion: apiextensions.k8s.io/v1
 261     kind: CustomResourceDefinition
 262     metadata:
 263       name: blockaffinities.crd.projectcalico.org
 264     spec:
 265       group: crd.projectcalico.org
 266       names:
 267         kind: BlockAffinity
 268         listKind: BlockAffinityList
 269         plural: blockaffinities
 270         singular: blockaffinity
 271       scope: Cluster
 272       versions:
 273       - name: v1
 274         schema:
 275           openAPIV3Schema:
 276             properties:
 277               apiVersion:
 278                 description: 'APIVersion defines the versioned schema of this representation
 279                   of an object. Servers should convert recognized schemas to the latest
 280                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 281                 type: string
 282               kind:
 283                 description: 'Kind is a string value representing the REST resource this
 284                   object represents. Servers may infer this from the endpoint the client
 285                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 286                 type: string
 287               metadata:
 288                 type: object
 289               spec:
 290                 description: BlockAffinitySpec contains the specification for a BlockAffinity
 291                   resource.
 292                 properties:
 293                   cidr:
 294                     type: string
 295                   deleted:
 296                     description: Deleted indicates that this block affinity is being deleted.
 297                       This field is a string for compatibility with older releases that
 298                       mistakenly treat this field as a string.
 299                     type: string
 300                   node:
 301                     type: string
 302                   state:
 303                     type: string
 304                 required:
 305                 - cidr
 306                 - deleted
 307                 - node
 308                 - state
 309                 type: object
 310             type: object
 311         served: true
 312         storage: true
 313     status:
 314       acceptedNames:
 315         kind: ""
 316         plural: ""
 317       conditions: []
 318       storedVersions: []
 319     ---
 320     apiVersion: apiextensions.k8s.io/v1
 321     kind: CustomResourceDefinition
 322     metadata:
 323       annotations:
 324         controller-gen.kubebuilder.io/version: (devel)
 325       creationTimestamp: null
 326       name: caliconodestatuses.crd.projectcalico.org
 327     spec:
 328       group: crd.projectcalico.org
 329       names:
 330         kind: CalicoNodeStatus
 331         listKind: CalicoNodeStatusList
 332         plural: caliconodestatuses
 333         singular: caliconodestatus
 334       scope: Cluster
 335       versions:
 336       - name: v1
 337         schema:
 338           openAPIV3Schema:
 339             properties:
 340               apiVersion:
 341                 description: 'APIVersion defines the versioned schema of this representation
 342                   of an object. Servers should convert recognized schemas to the latest
 343                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 344                 type: string
 345               kind:
 346                 description: 'Kind is a string value representing the REST resource this
 347                   object represents. Servers may infer this from the endpoint the client
 348                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 349                 type: string
 350               metadata:
 351                 type: object
 352               spec:
 353                 description: CalicoNodeStatusSpec contains the specification for a CalicoNodeStatus
 354                   resource.
 355                 properties:
 356                   classes:
 357                     description: Classes declares the types of information to monitor
 358                       for this calico/node, and allows for selective status reporting
 359                       about certain subsets of information.
 360                     items:
 361                       type: string
 362                     type: array
 363                   node:
 364                     description: The node name identifies the Calico node instance for
 365                       node status.
 366                     type: string
 367                   updatePeriodSeconds:
 368                     description: UpdatePeriodSeconds is the period at which CalicoNodeStatus
 369                       should be updated. Set to 0 to disable CalicoNodeStatus refresh.
 370                       Maximum update period is one day.
 371                     format: int32
 372                     type: integer
 373                 type: object
 374               status:
 375                 description: CalicoNodeStatusStatus defines the observed state of CalicoNodeStatus.
 376                   No validation needed for status since it is updated by Calico.
 377                 properties:
 378                   agent:
 379                     description: Agent holds agent status on the node.
 380                     properties:
 381                       birdV4:
 382                         description: BIRDV4 represents the latest observed status of bird4.
 383                         properties:
 384                           lastBootTime:
 385                             description: LastBootTime holds the value of lastBootTime
 386                               from bird.ctl output.
 387                             type: string
 388                           lastReconfigurationTime:
 389                             description: LastReconfigurationTime holds the value of lastReconfigTime
 390                               from bird.ctl output.
 391                             type: string
 392                           routerID:
 393                             description: Router ID used by bird.
 394                             type: string
 395                           state:
 396                             description: The state of the BGP Daemon.
 397                             type: string
 398                           version:
 399                             description: Version of the BGP daemon
 400                             type: string
 401                         type: object
 402                       birdV6:
 403                         description: BIRDV6 represents the latest observed status of bird6.
 404                         properties:
 405                           lastBootTime:
 406                             description: LastBootTime holds the value of lastBootTime
 407                               from bird.ctl output.
 408                             type: string
 409                           lastReconfigurationTime:
 410                             description: LastReconfigurationTime holds the value of lastReconfigTime
 411                               from bird.ctl output.
 412                             type: string
 413                           routerID:
 414                             description: Router ID used by bird.
 415                             type: string
 416                           state:
 417                             description: The state of the BGP Daemon.
 418                             type: string
 419                           version:
 420                             description: Version of the BGP daemon
 421                             type: string
 422                         type: object
 423                     type: object
 424                   bgp:
 425                     description: BGP holds node BGP status.
 426                     properties:
 427                       numberEstablishedV4:
 428                         description: The total number of IPv4 established bgp sessions.
 429                         type: integer
 430                       numberEstablishedV6:
 431                         description: The total number of IPv6 established bgp sessions.
 432                         type: integer
 433                       numberNotEstablishedV4:
 434                         description: The total number of IPv4 non-established bgp sessions.
 435                         type: integer
 436                       numberNotEstablishedV6:
 437                         description: The total number of IPv6 non-established bgp sessions.
 438                         type: integer
 439                       peersV4:
 440                         description: PeersV4 represents IPv4 BGP peers status on the node.
 441                         items:
 442                           description: CalicoNodePeer contains the status of BGP peers
 443                             on the node.
 444                           properties:
 445                             peerIP:
 446                               description: IP address of the peer whose condition we are
 447                                 reporting.
 448                               type: string
 449                             since:
 450                               description: Since the state or reason last changed.
 451                               type: string
 452                             state:
 453                               description: State is the BGP session state.
 454                               type: string
 455                             type:
 456                               description: Type indicates whether this peer is configured
 457                                 via the node-to-node mesh, or via en explicit global or
 458                                 per-node BGPPeer object.
 459                               type: string
 460                           type: object
 461                         type: array
 462                       peersV6:
 463                         description: PeersV6 represents IPv6 BGP peers status on the node.
 464                         items:
 465                           description: CalicoNodePeer contains the status of BGP peers
 466                             on the node.
 467                           properties:
 468                             peerIP:
 469                               description: IP address of the peer whose condition we are
 470                                 reporting.
 471                               type: string
 472                             since:
 473                               description: Since the state or reason last changed.
 474                               type: string
 475                             state:
 476                               description: State is the BGP session state.
 477                               type: string
 478                             type:
 479                               description: Type indicates whether this peer is configured
 480                                 via the node-to-node mesh, or via en explicit global or
 481                                 per-node BGPPeer object.
 482                               type: string
 483                           type: object
 484                         type: array
 485                     required:
 486                     - numberEstablishedV4
 487                     - numberEstablishedV6
 488                     - numberNotEstablishedV4
 489                     - numberNotEstablishedV6
 490                     type: object
 491                   lastUpdated:
 492                     description: LastUpdated is a timestamp representing the server time
 493                       when CalicoNodeStatus object last updated. It is represented in
 494                       RFC3339 form and is in UTC.
 495                     format: date-time
 496                     nullable: true
 497                     type: string
 498                   routes:
 499                     description: Routes reports routes known to the Calico BGP daemon
 500                       on the node.
 501                     properties:
 502                       routesV4:
 503                         description: RoutesV4 represents IPv4 routes on the node.
 504                         items:
 505                           description: CalicoNodeRoute contains the status of BGP routes
 506                             on the node.
 507                           properties:
 508                             destination:
 509                               description: Destination of the route.
 510                               type: string
 511                             gateway:
 512                               description: Gateway for the destination.
 513                               type: string
 514                             interface:
 515                               description: Interface for the destination
 516                               type: string
 517                             learnedFrom:
 518                               description: LearnedFrom contains information regarding
 519                                 where this route originated.
 520                               properties:
 521                                 peerIP:
 522                                   description: If sourceType is NodeMesh or BGPPeer, IP
 523                                     address of the router that sent us this route.
 524                                   type: string
 525                                 sourceType:
 526                                   description: Type of the source where a route is learned
 527                                     from.
 528                                   type: string
 529                               type: object
 530                             type:
 531                               description: Type indicates if the route is being used for
 532                                 forwarding or not.
 533                               type: string
 534                           type: object
 535                         type: array
 536                       routesV6:
 537                         description: RoutesV6 represents IPv6 routes on the node.
 538                         items:
 539                           description: CalicoNodeRoute contains the status of BGP routes
 540                             on the node.
 541                           properties:
 542                             destination:
 543                               description: Destination of the route.
 544                               type: string
 545                             gateway:
 546                               description: Gateway for the destination.
 547                               type: string
 548                             interface:
 549                               description: Interface for the destination
 550                               type: string
 551                             learnedFrom:
 552                               description: LearnedFrom contains information regarding
 553                                 where this route originated.
 554                               properties:
 555                                 peerIP:
 556                                   description: If sourceType is NodeMesh or BGPPeer, IP
 557                                     address of the router that sent us this route.
 558                                   type: string
 559                                 sourceType:
 560                                   description: Type of the source where a route is learned
 561                                     from.
 562                                   type: string
 563                               type: object
 564                             type:
 565                               description: Type indicates if the route is being used for
 566                                 forwarding or not.
 567                               type: string
 568                           type: object
 569                         type: array
 570                     type: object
 571                 type: object
 572             type: object
 573         served: true
 574         storage: true
 575     status:
 576       acceptedNames:
 577         kind: ""
 578         plural: ""
 579       conditions: []
 580       storedVersions: []
 581     ---
 582     apiVersion: apiextensions.k8s.io/v1
 583     kind: CustomResourceDefinition
 584     metadata:
 585       name: clusterinformations.crd.projectcalico.org
 586     spec:
 587       group: crd.projectcalico.org
 588       names:
 589         kind: ClusterInformation
 590         listKind: ClusterInformationList
 591         plural: clusterinformations
 592         singular: clusterinformation
 593       scope: Cluster
 594       versions:
 595       - name: v1
 596         schema:
 597           openAPIV3Schema:
 598             description: ClusterInformation contains the cluster specific information.
 599             properties:
 600               apiVersion:
 601                 description: 'APIVersion defines the versioned schema of this representation
 602                   of an object. Servers should convert recognized schemas to the latest
 603                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 604                 type: string
 605               kind:
 606                 description: 'Kind is a string value representing the REST resource this
 607                   object represents. Servers may infer this from the endpoint the client
 608                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 609                 type: string
 610               metadata:
 611                 type: object
 612               spec:
 613                 description: ClusterInformationSpec contains the values of describing
 614                   the cluster.
 615                 properties:
 616                   calicoVersion:
 617                     description: CalicoVersion is the version of Calico that the cluster
 618                       is running
 619                     type: string
 620                   clusterGUID:
 621                     description: ClusterGUID is the GUID of the cluster
 622                     type: string
 623                   clusterType:
 624                     description: ClusterType describes the type of the cluster
 625                     type: string
 626                   datastoreReady:
 627                     description: DatastoreReady is used during significant datastore migrations
 628                       to signal to components such as Felix that it should wait before
 629                       accessing the datastore.
 630                     type: boolean
 631                   variant:
 632                     description: Variant declares which variant of Calico should be active.
 633                     type: string
 634                 type: object
 635             type: object
 636         served: true
 637         storage: true
 638     status:
 639       acceptedNames:
 640         kind: ""
 641         plural: ""
 642       conditions: []
 643       storedVersions: []
 644     ---
 645     apiVersion: apiextensions.k8s.io/v1
 646     kind: CustomResourceDefinition
 647     metadata:
 648       name: felixconfigurations.crd.projectcalico.org
 649     spec:
 650       group: crd.projectcalico.org
 651       names:
 652         kind: FelixConfiguration
 653         listKind: FelixConfigurationList
 654         plural: felixconfigurations
 655         singular: felixconfiguration
 656       scope: Cluster
 657       versions:
 658       - name: v1
 659         schema:
 660           openAPIV3Schema:
 661             description: Felix Configuration contains the configuration for Felix.
 662             properties:
 663               apiVersion:
 664                 description: 'APIVersion defines the versioned schema of this representation
 665                   of an object. Servers should convert recognized schemas to the latest
 666                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
 667                 type: string
 668               kind:
 669                 description: 'Kind is a string value representing the REST resource this
 670                   object represents. Servers may infer this from the endpoint the client
 671                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
 672                 type: string
 673               metadata:
 674                 type: object
 675               spec:
 676                 description: FelixConfigurationSpec contains the values of the Felix configuration.
 677                 properties:
 678                   allowIPIPPacketsFromWorkloads:
 679                     description: 'AllowIPIPPacketsFromWorkloads controls whether Felix
 680                       will add a rule to drop IPIP encapsulated traffic from workloads
 681                       [Default: false]'
 682                     type: boolean
 683                   allowVXLANPacketsFromWorkloads:
 684                     description: 'AllowVXLANPacketsFromWorkloads controls whether Felix
 685                       will add a rule to drop VXLAN encapsulated traffic from workloads
 686                       [Default: false]'
 687                     type: boolean
 688                   awsSrcDstCheck:
 689                     description: 'Set source-destination-check on AWS EC2 instances. Accepted
 690                       value must be one of "DoNothing", "Enable" or "Disable". [Default:
 691                       DoNothing]'
 692                     enum:
 693                     - DoNothing
 694                     - Enable
 695                     - Disable
 696                     type: string
 697                   bpfConnectTimeLoadBalancingEnabled:
 698                     description: 'BPFConnectTimeLoadBalancingEnabled when in BPF mode,
 699                       controls whether Felix installs the connection-time load balancer.  The
 700                       connect-time load balancer is required for the host to be able to
 701                       reach Kubernetes services and it improves the performance of pod-to-service
 702                       connections.  The only reason to disable it is for debugging purposes.  [Default:
 703                       true]'
 704                     type: boolean
 705                   bpfDataIfacePattern:
 706                     description: BPFDataIfacePattern is a regular expression that controls
 707                       which interfaces Felix should attach BPF programs to in order to
 708                       catch traffic to/from the network.  This needs to match the interfaces
 709                       that Calico workload traffic flows over as well as any interfaces
 710                       that handle incoming traffic to nodeports and services from outside
 711                       the cluster.  It should not match the workload interfaces (usually
 712                       named cali...).
 713                     type: string
 714                   bpfDisableUnprivileged:
 715                     description: 'BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled
 716                       sysctl to disable unprivileged use of BPF.  This ensures that unprivileged
 717                       users cannot access Calico''s BPF maps and cannot insert their own
 718                       BPF programs to interfere with Calico''s. [Default: true]'
 719                     type: boolean
 720                   bpfEnabled:
 721                     description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
 722                       [Default: false]'
 723                     type: boolean
 724                   bpfExtToServiceConnmark:
 725                     description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit
 726                       mark that is set on connections from an external client to a local
 727                       service. This mark allows us to control how packets of that connection
 728                       are routed within the host and how is routing intepreted by RPF
 729                       check. [Default: 0]'
 730                     type: integer
 731                   bpfExternalServiceMode:
 732                     description: 'BPFExternalServiceMode in BPF mode, controls how connections
 733                       from outside the cluster to services (node ports and cluster IPs)
 734                       are forwarded to remote workloads.  If set to "Tunnel" then both
 735                       request and response traffic is tunneled to the remote node.  If
 736                       set to "DSR", the request traffic is tunneled but the response traffic
 737                       is sent directly from the remote node.  In "DSR" mode, the remote
 738                       node appears to use the IP of the ingress node; this requires a
 739                       permissive L2 network.  [Default: Tunnel]'
 740                     type: string
 741                   bpfKubeProxyEndpointSlicesEnabled:
 742                     description: BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls
 743                       whether Felix's embedded kube-proxy accepts EndpointSlices or not.
 744                     type: boolean
 745                   bpfKubeProxyIptablesCleanupEnabled:
 746                     description: 'BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF
 747                       mode, Felix will proactively clean up the upstream Kubernetes kube-proxy''s
 748                       iptables chains.  Should only be enabled if kube-proxy is not running.  [Default:
 749                       true]'
 750                     type: boolean
 751                   bpfKubeProxyMinSyncPeriod:
 752                     description: 'BPFKubeProxyMinSyncPeriod, in BPF mode, controls the
 753                       minimum time between updates to the dataplane for Felix''s embedded
 754                       kube-proxy.  Lower values give reduced set-up latency.  Higher values
 755                       reduce Felix CPU usage by batching up more work.  [Default: 1s]'
 756                     type: string
 757                   bpfLogLevel:
 758                     description: 'BPFLogLevel controls the log level of the BPF programs
 759                       when in BPF dataplane mode.  One of "Off", "Info", or "Debug".  The
 760                       logs are emitted to the BPF trace pipe, accessible with the command
 761                       `tc exec bpf debug`. [Default: Off].'
 762                     type: string
 763                   chainInsertMode:
 764                     description: 'ChainInsertMode controls whether Felix hooks the kernel''s
 765                       top-level iptables chains by inserting a rule at the top of the
 766                       chain or by appending a rule at the bottom. insert is the safe default
 767                       since it prevents Calico''s rules from being bypassed. If you switch
 768                       to append mode, be sure that the other rules in the chains signal
 769                       acceptance by falling through to the Calico rules, otherwise the
 770                       Calico policy will be bypassed. [Default: insert]'
 771                     type: string
 772                   dataplaneDriver:
 773                     type: string
 774                   debugDisableLogDropping:
 775                     type: boolean
 776                   debugMemoryProfilePath:
 777                     type: string
 778                   debugSimulateCalcGraphHangAfter:
 779                     type: string
 780                   debugSimulateDataplaneHangAfter:
 781                     type: string
 782                   defaultEndpointToHostAction:
 783                     description: 'DefaultEndpointToHostAction controls what happens to
 784                       traffic that goes from a workload endpoint to the host itself (after
 785                       the traffic hits the endpoint egress policy). By default Calico
 786                       blocks traffic from workload endpoints to the host itself with an
 787                       iptables "DROP" action. If you want to allow some or all traffic
 788                       from endpoint to host, set this parameter to RETURN or ACCEPT. Use
 789                       RETURN if you have your own rules in the iptables "INPUT" chain;
 790                       Calico will insert its rules at the top of that chain, then "RETURN"
 791                       packets to the "INPUT" chain once it has completed processing workload
 792                       endpoint egress policy. Use ACCEPT to unconditionally accept packets
 793                       from workloads after processing workload endpoint egress policy.
 794                       [Default: Drop]'
 795                     type: string
 796                   deviceRouteProtocol:
 797                     description: This defines the route protocol added to programmed device
 798                       routes, by default this will be RTPROT_BOOT when left blank.
 799                     type: integer
 800                   deviceRouteSourceAddress:
 801                     description: This is the source address to use on programmed device
 802                       routes. By default the source address is left blank, leaving the
 803                       kernel to choose the source address used.
 804                     type: string
 805                   disableConntrackInvalidCheck:
 806                     type: boolean
 807                   endpointReportingDelay:
 808                     type: string
 809                   endpointReportingEnabled:
 810                     type: boolean
 811                   externalNodesList:
 812                     description: ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes
 813                       which may source tunnel traffic and have the tunneled traffic be
 814                       accepted at calico nodes.
 815                     items:
 816                       type: string
 817                     type: array
 818                   failsafeInboundHostPorts:
 819                     description: 'FailsafeInboundHostPorts is a list of UDP/TCP ports
 820                       and CIDRs that Felix will allow incoming traffic to host endpoints
 821                       on irrespective of the security policy. This is useful to avoid
 822                       accidentally cutting off a host with incorrect configuration. For
 823                       back-compatibility, if the protocol is not specified, it defaults
 824                       to "tcp". If a CIDR is not specified, it will allow traffic from
 825                       all addresses. To disable all inbound host ports, use the value
 826                       none. The default value allows ssh access and DHCP. [Default: tcp:22,
 827                       udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
 828                     items:
 829                       description: ProtoPort is combination of protocol, port, and CIDR.
 830                         Protocol and port must be specified.
 831                       properties:
 832                         net:
 833                           type: string
 834                         port:
 835                           type: integer
 836                         protocol:
 837                           type: string
 838                       required:
 839                       - port
 840                       - protocol
 841                       type: object
 842                     type: array
 843                   failsafeOutboundHostPorts:
 844                     description: 'FailsafeOutboundHostPorts is a list of UDP/TCP ports
 845                       and CIDRs that Felix will allow outgoing traffic from host endpoints
 846                       to irrespective of the security policy. This is useful to avoid
 847                       accidentally cutting off a host with incorrect configuration. For
 848                       back-compatibility, if the protocol is not specified, it defaults
 849                       to "tcp". If a CIDR is not specified, it will allow traffic from
 850                       all addresses. To disable all outbound host ports, use the value
 851                       none. The default value opens etcd''s standard ports to ensure that
 852                       Felix does not get cut off from etcd as well as allowing DHCP and
 853                       DNS. [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666,
 854                       tcp:6667, udp:53, udp:67]'
 855                     items:
 856                       description: ProtoPort is combination of protocol, port, and CIDR.
 857                         Protocol and port must be specified.
 858                       properties:
 859                         net:
 860                           type: string
 861                         port:
 862                           type: integer
 863                         protocol:
 864                           type: string
 865                       required:
 866                       - port
 867                       - protocol
 868                       type: object
 869                     type: array
 870                   featureDetectOverride:
 871                     description: FeatureDetectOverride is used to override the feature
 872                       detection. Values are specified in a comma separated list with no
 873                       spaces, example; "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=".
 874                       "true" or "false" will force the feature, empty or omitted values
 875                       are auto-detected.
 876                     type: string
 877                   genericXDPEnabled:
 878                     description: 'GenericXDPEnabled enables Generic XDP so network cards
 879                       that don''t support XDP offload or driver modes can use XDP. This
 880                       is not recommended since it doesn''t provide better performance
 881                       than iptables. [Default: false]'
 882                     type: boolean
 883                   healthEnabled:
 884                     type: boolean
 885                   healthHost:
 886                     type: string
 887                   healthPort:
 888                     type: integer
 889                   interfaceExclude:
 890                     description: 'InterfaceExclude is a comma-separated list of interfaces
 891                       that Felix should exclude when monitoring for host endpoints. The
 892                       default value ensures that Felix ignores Kubernetes'' IPVS dummy
 893                       interface, which is used internally by kube-proxy. If you want to
 894                       exclude multiple interface names using a single value, the list
 895                       supports regular expressions. For regular expressions you must wrap
 896                       the value with ''/''. For example having values ''/^kube/,veth1''
 897                       will exclude all interfaces that begin with ''kube'' and also the
 898                       interface ''veth1''. [Default: kube-ipvs0]'
 899                     type: string
 900                   interfacePrefix:
 901                     description: 'InterfacePrefix is the interface name prefix that identifies
 902                       workload endpoints and so distinguishes them from host endpoint
 903                       interfaces. Note: in environments other than bare metal, the orchestrators
 904                       configure this appropriately. For example our Kubernetes and Docker
 905                       integrations set the ''cali'' value, and our OpenStack integration
 906                       sets the ''tap'' value. [Default: cali]'
 907                     type: string
 908                   interfaceRefreshInterval:
 909                     description: InterfaceRefreshInterval is the period at which Felix
 910                       rescans local interfaces to verify their state. The rescan can be
 911                       disabled by setting the interval to 0.
 912                     type: string
 913                   ipipEnabled:
 914                     type: boolean
 915                   ipipMTU:
 916                     description: 'IPIPMTU is the MTU to set on the tunnel device. See
 917                       Configuring MTU [Default: 1440]'
 918                     type: integer
 919                   ipsetsRefreshInterval:
 920                     description: 'IpsetsRefreshInterval is the period at which Felix re-checks
 921                       all iptables state to ensure that no other process has accidentally
 922                       broken Calico''s rules. Set to 0 to disable iptables refresh. [Default:
 923                       90s]'
 924                     type: string
 925                   iptablesBackend:
 926                     description: IptablesBackend specifies which backend of iptables will
 927                       be used. The default is legacy.
 928                     type: string
 929                   iptablesFilterAllowAction:
 930                     type: string
 931                   iptablesLockFilePath:
 932                     description: 'IptablesLockFilePath is the location of the iptables
 933                       lock file. You may need to change this if the lock file is not in
 934                       its standard location (for example if you have mapped it into Felix''s
 935                       container at a different path). [Default: /run/xtables.lock]'
 936                     type: string
 937                   iptablesLockProbeInterval:
 938                     description: 'IptablesLockProbeInterval is the time that Felix will
 939                       wait between attempts to acquire the iptables lock if it is not
 940                       available. Lower values make Felix more responsive when the lock
 941                       is contended, but use more CPU. [Default: 50ms]'
 942                     type: string
 943                   iptablesLockTimeout:
 944                     description: 'IptablesLockTimeout is the time that Felix will wait
 945                       for the iptables lock, or 0, to disable. To use this feature, Felix
 946                       must share the iptables lock file with all other processes that
 947                       also take the lock. When running Felix inside a container, this
 948                       requires the /run directory of the host to be mounted into the calico/node
 949                       or calico/felix container. [Default: 0s disabled]'
 950                     type: string
 951                   iptablesMangleAllowAction:
 952                     type: string
 953                   iptablesMarkMask:
 954                     description: 'IptablesMarkMask is the mask that Felix selects its
 955                       IPTables Mark bits from. Should be a 32 bit hexadecimal number with
 956                       at least 8 bits set, none of which clash with any other mark bits
 957                       in use on the system. [Default: 0xff000000]'
 958                     format: int32
 959                     type: integer
 960                   iptablesNATOutgoingInterfaceFilter:
 961                     type: string
 962                   iptablesPostWriteCheckInterval:
 963                     description: 'IptablesPostWriteCheckInterval is the period after Felix
 964                       has done a write to the dataplane that it schedules an extra read
 965                       back in order to check the write was not clobbered by another process.
 966                       This should only occur if another application on the system doesn''t
 967                       respect the iptables lock. [Default: 1s]'
 968                     type: string
 969                   iptablesRefreshInterval:
 970                     description: 'IptablesRefreshInterval is the period at which Felix
 971                       re-checks the IP sets in the dataplane to ensure that no other process
 972                       has accidentally broken Calico''s rules. Set to 0 to disable IP
 973                       sets refresh. Note: the default for this value is lower than the
 974                       other refresh intervals as a workaround for a Linux kernel bug that
 975                       was fixed in kernel version 4.11. If you are using v4.11 or greater
 976                       you may want to set this to, a higher value to reduce Felix CPU
 977                       usage. [Default: 10s]'
 978                     type: string
 979                   ipv6Support:
 980                     type: boolean
 981                   kubeNodePortRanges:
 982                     description: 'KubeNodePortRanges holds list of port ranges used for
 983                       service node ports. Only used if felix detects kube-proxy running
 984                       in ipvs mode. Felix uses these ranges to separate host and workload
 985                       traffic. [Default: 30000:32767].'
 986                     items:
 987                       anyOf:
 988                       - type: integer
 989                       - type: string
 990                       pattern: ^.*
 991                       x-kubernetes-int-or-string: true
 992                     type: array
 993                   logFilePath:
 994                     description: 'LogFilePath is the full path to the Felix log. Set to
 995                       none to disable file logging. [Default: /var/log/calico/felix.log]'
 996                     type: string
 997                   logPrefix:
 998                     description: 'LogPrefix is the log prefix that Felix uses when rendering
 999                       LOG rules. [Default: calico-packet]'
1000                     type: string
1001                   logSeverityFile:
1002                     description: 'LogSeverityFile is the log severity above which logs
1003                       are sent to the log file. [Default: Info]'
1004                     type: string
1005                   logSeverityScreen:
1006                     description: 'LogSeverityScreen is the log severity above which logs
1007                       are sent to the stdout. [Default: Info]'
1008                     type: string
1009                   logSeveritySys:
1010                     description: 'LogSeveritySys is the log severity above which logs
1011                       are sent to the syslog. Set to None for no logging to syslog. [Default:
1012                       Info]'
1013                     type: string
1014                   maxIpsetSize:
1015                     type: integer
1016                   metadataAddr:
1017                     description: 'MetadataAddr is the IP address or domain name of the
1018                       server that can answer VM queries for cloud-init metadata. In OpenStack,
1019                       this corresponds to the machine running nova-api (or in Ubuntu,
1020                       nova-api-metadata). A value of none (case insensitive) means that
1021                       Felix should not set up any NAT rule for the metadata path. [Default:
1022                       127.0.0.1]'
1023                     type: string
1024                   metadataPort:
1025                     description: 'MetadataPort is the port of the metadata server. This,
1026                       combined with global.MetadataAddr (if not ''None''), is used to
1027                       set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
1028                       In most cases this should not need to be changed [Default: 8775].'
1029                     type: integer
1030                   mtuIfacePattern:
1031                     description: MTUIfacePattern is a regular expression that controls
1032                       which interfaces Felix should scan in order to calculate the host's
1033                       MTU. This should not match workload interfaces (usually named cali...).
1034                     type: string
1035                   natOutgoingAddress:
1036                     description: NATOutgoingAddress specifies an address to use when performing
1037                       source NAT for traffic in a natOutgoing pool that is leaving the
1038                       network. By default the address used is an address on the interface
1039                       the traffic is leaving on (ie it uses the iptables MASQUERADE target)
1040                     type: string
1041                   natPortRange:
1042                     anyOf:
1043                     - type: integer
1044                     - type: string
1045                     description: NATPortRange specifies the range of ports that is used
1046                       for port mapping when doing outgoing NAT. When unset the default
1047                       behavior of the network stack is used.
1048                     pattern: ^.*
1049                     x-kubernetes-int-or-string: true
1050                   netlinkTimeout:
1051                     type: string
1052                   openstackRegion:
1053                     description: 'OpenstackRegion is the name of the region that a particular
1054                       Felix belongs to. In a multi-region Calico/OpenStack deployment,
1055                       this must be configured somehow for each Felix (here in the datamodel,
1056                       or in felix.cfg or the environment on each compute node), and must
1057                       match the [calico] openstack_region value configured in neutron.conf
1058                       on each node. [Default: Empty]'
1059                     type: string
1060                   policySyncPathPrefix:
1061                     description: 'PolicySyncPathPrefix is used to by Felix to communicate
1062                       policy changes to external services, like Application layer policy.
1063                       [Default: Empty]'
1064                     type: string
1065                   prometheusGoMetricsEnabled:
1066                     description: 'PrometheusGoMetricsEnabled disables Go runtime metrics
1067                       collection, which the Prometheus client does by default, when set
1068                       to false. This reduces the number of metrics reported, reducing
1069                       Prometheus load. [Default: true]'
1070                     type: boolean
1071                   prometheusMetricsEnabled:
1072                     description: 'PrometheusMetricsEnabled enables the Prometheus metrics
1073                       server in Felix if set to true. [Default: false]'
1074                     type: boolean
1075                   prometheusMetricsHost:
1076                     description: 'PrometheusMetricsHost is the host that the Prometheus
1077                       metrics server should bind to. [Default: empty]'
1078                     type: string
1079                   prometheusMetricsPort:
1080                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
1081                       metrics server should bind to. [Default: 9091]'
1082                     type: integer
1083                   prometheusProcessMetricsEnabled:
1084                     description: 'PrometheusProcessMetricsEnabled disables process metrics
1085                       collection, which the Prometheus client does by default, when set
1086                       to false. This reduces the number of metrics reported, reducing
1087                       Prometheus load. [Default: true]'
1088                     type: boolean
1089                   prometheusWireGuardMetricsEnabled:
1090                     description: 'PrometheusWireGuardMetricsEnabled disables wireguard
1091                       metrics collection, which the Prometheus client does by default,
1092                       when set to false. This reduces the number of metrics reported,
1093                       reducing Prometheus load. [Default: true]'
1094                     type: boolean
1095                   removeExternalRoutes:
1096                     description: Whether or not to remove device routes that have not
1097                       been programmed by Felix. Disabling this will allow external applications
1098                       to also add device routes. This is enabled by default which means
1099                       we will remove externally added routes.
1100                     type: boolean
1101                   reportingInterval:
1102                     description: 'ReportingInterval is the interval at which Felix reports
1103                       its status into the datastore or 0 to disable. Must be non-zero
1104                       in OpenStack deployments. [Default: 30s]'
1105                     type: string
1106                   reportingTTL:
1107                     description: 'ReportingTTL is the time-to-live setting for process-wide
1108                       status reports. [Default: 90s]'
1109                     type: string
1110                   routeRefreshInterval:
1111                     description: 'RouteRefreshInterval is the period at which Felix re-checks
1112                       the routes in the dataplane to ensure that no other process has
1113                       accidentally broken Calico''s rules. Set to 0 to disable route refresh.
1114                       [Default: 90s]'
1115                     type: string
1116                   routeSource:
1117                     description: 'RouteSource configures where Felix gets its routing
1118                       information. - WorkloadIPs: use workload endpoints to construct
1119                       routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
1120                     type: string
1121                   routeTableRange:
1122                     description: Calico programs additional Linux route tables for various
1123                       purposes.  RouteTableRange specifies the indices of the route tables
1124                       that Calico should use.
1125                     properties:
1126                       max:
1127                         type: integer
1128                       min:
1129                         type: integer
1130                     required:
1131                     - max
1132                     - min
1133                     type: object
1134                   serviceLoopPrevention:
1135                     description: 'When service IP advertisement is enabled, prevent routing
1136                       loops to service IPs that are not in use, by dropping or rejecting
1137                       packets that do not get DNAT''d by kube-proxy. Unless set to "Disabled",
1138                       in which case such routing loops continue to be allowed. [Default:
1139                       Drop]'
1140                     type: string
1141                   sidecarAccelerationEnabled:
1142                     description: 'SidecarAccelerationEnabled enables experimental sidecar
1143                       acceleration [Default: false]'
1144                     type: boolean
1145                   usageReportingEnabled:
1146                     description: 'UsageReportingEnabled reports anonymous Calico version
1147                       number and cluster size to projectcalico.org. Logs warnings returned
1148                       by the usage server. For example, if a significant security vulnerability
1149                       has been discovered in the version of Calico being used. [Default:
1150                       true]'
1151                     type: boolean
1152                   usageReportingInitialDelay:
1153                     description: 'UsageReportingInitialDelay controls the minimum delay
1154                       before Felix makes a report. [Default: 300s]'
1155                     type: string
1156                   usageReportingInterval:
1157                     description: 'UsageReportingInterval controls the interval at which
1158                       Felix makes reports. [Default: 86400s]'
1159                     type: string
1160                   useInternalDataplaneDriver:
1161                     type: boolean
1162                   vxlanEnabled:
1163                     type: boolean
1164                   vxlanMTU:
1165                     description: 'VXLANMTU is the MTU to set on the tunnel device. See
1166                       Configuring MTU [Default: 1440]'
1167                     type: integer
1168                   vxlanPort:
1169                     type: integer
1170                   vxlanVNI:
1171                     type: integer
1172                   wireguardEnabled:
1173                     description: 'WireguardEnabled controls whether Wireguard is enabled.
1174                       [Default: false]'
1175                     type: boolean
1176                   wireguardHostEncryptionEnabled:
1177                     description: 'WireguardHostEncryptionEnabled controls whether Wireguard
1178                       host-to-host encryption is enabled. [Default: false]'
1179                     type: boolean
1180                   wireguardInterfaceName:
1181                     description: 'WireguardInterfaceName specifies the name to use for
1182                       the Wireguard interface. [Default: wg.calico]'
1183                     type: string
1184                   wireguardListeningPort:
1185                     description: 'WireguardListeningPort controls the listening port used
1186                       by Wireguard. [Default: 51820]'
1187                     type: integer
1188                   wireguardMTU:
1189                     description: 'WireguardMTU controls the MTU on the Wireguard interface.
1190                       See Configuring MTU [Default: 1420]'
1191                     type: integer
1192                   wireguardRoutingRulePriority:
1193                     description: 'WireguardRoutingRulePriority controls the priority value
1194                       to use for the Wireguard routing rule. [Default: 99]'
1195                     type: integer
1196                   xdpEnabled:
1197                     description: 'XDPEnabled enables XDP acceleration for suitable untracked
1198                       incoming deny rules. [Default: true]'
1199                     type: boolean
1200                   xdpRefreshInterval:
1201                     description: 'XDPRefreshInterval is the period at which Felix re-checks
1202                       all XDP state to ensure that no other process has accidentally broken
1203                       Calico''s BPF maps or attached programs. Set to 0 to disable XDP
1204                       refresh. [Default: 90s]'
1205                     type: string
1206                 type: object
1207             type: object
1208         served: true
1209         storage: true
1210     status:
1211       acceptedNames:
1212         kind: ""
1213         plural: ""
1214       conditions: []
1215       storedVersions: []
1216     ---
1217     apiVersion: apiextensions.k8s.io/v1
1218     kind: CustomResourceDefinition
1219     metadata:
1220       name: globalnetworkpolicies.crd.projectcalico.org
1221     spec:
1222       group: crd.projectcalico.org
1223       names:
1224         kind: GlobalNetworkPolicy
1225         listKind: GlobalNetworkPolicyList
1226         plural: globalnetworkpolicies
1227         singular: globalnetworkpolicy
1228       scope: Cluster
1229       versions:
1230       - name: v1
1231         schema:
1232           openAPIV3Schema:
1233             properties:
1234               apiVersion:
1235                 description: 'APIVersion defines the versioned schema of this representation
1236                   of an object. Servers should convert recognized schemas to the latest
1237                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
1238                 type: string
1239               kind:
1240                 description: 'Kind is a string value representing the REST resource this
1241                   object represents. Servers may infer this from the endpoint the client
1242                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
1243                 type: string
1244               metadata:
1245                 type: object
1246               spec:
1247                 properties:
1248                   applyOnForward:
1249                     description: ApplyOnForward indicates to apply the rules in this policy
1250                       on forward traffic.
1251                     type: boolean
1252                   doNotTrack:
1253                     description: DoNotTrack indicates whether packets matched by the rules
1254                       in this policy should go through the data plane's connection tracking,
1255                       such as Linux conntrack.  If True, the rules in this policy are
1256                       applied before any data plane connection tracking, and packets allowed
1257                       by this policy are marked as not to be tracked.
1258                     type: boolean
1259                   egress:
1260                     description: The ordered set of egress rules.  Each rule contains
1261                       a set of packet match criteria and a corresponding action to apply.
1262                     items:
1263                       description: "A Rule encapsulates a set of match criteria and an
1264                         action.  Both selector-based security Policy and security Profiles
1265                         reference rules - separated out as a list of rules for both ingress
1266                         and egress packet matching. \n Each positive match criteria has
1267                         a negated version, prefixed with \"Not\". All the match criteria
1268                         within a rule must be satisfied for a packet to match. A single
1269                         rule can contain the positive and negative version of a match
1270                         and both must be satisfied for the rule to match."
1271                       properties:
1272                         action:
1273                           type: string
1274                         destination:
1275                           description: Destination contains the match criteria that apply
1276                             to destination entity.
1277                           properties:
1278                             namespaceSelector:
1279                               description: "NamespaceSelector is an optional field that
1280                                 contains a selector expression. Only traffic that originates
1281                                 from (or terminates at) endpoints within the selected
1282                                 namespaces will be matched. When both NamespaceSelector
1283                                 and another selector are defined on the same rule, then
1284                                 only workload endpoints that are matched by both selectors
1285                                 will be selected by the rule. \n For NetworkPolicy, an
1286                                 empty NamespaceSelector implies that the Selector is limited
1287                                 to selecting only workload endpoints in the same namespace
1288                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
1289                                 NamespaceSelector implies that the Selector is limited
1290                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
1291                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
1292                                 the Selector applies to workload endpoints across all
1293                                 namespaces."
1294                               type: string
1295                             nets:
1296                               description: Nets is an optional field that restricts the
1297                                 rule to only apply to traffic that originates from (or
1298                                 terminates at) IP addresses in any of the given subnets.
1299                               items:
1300                                 type: string
1301                               type: array
1302                             notNets:
1303                               description: NotNets is the negated version of the Nets
1304                                 field.
1305                               items:
1306                                 type: string
1307                               type: array
1308                             notPorts:
1309                               description: NotPorts is the negated version of the Ports
1310                                 field. Since only some protocols have ports, if any ports
1311                                 are specified it requires the Protocol match in the Rule
1312                                 to be set to "TCP" or "UDP".
1313                               items:
1314                                 anyOf:
1315                                 - type: integer
1316                                 - type: string
1317                                 pattern: ^.*
1318                                 x-kubernetes-int-or-string: true
1319                               type: array
1320                             notSelector:
1321                               description: NotSelector is the negated version of the Selector
1322                                 field.  See Selector field for subtleties with negated
1323                                 selectors.
1324                               type: string
1325                             ports:
1326                               description: "Ports is an optional field that restricts
1327                                 the rule to only apply to traffic that has a source (destination)
1328                                 port that matches one of these ranges/values. This value
1329                                 is a list of integers or strings that represent ranges
1330                                 of ports. \n Since only some protocols have ports, if
1331                                 any ports are specified it requires the Protocol match
1332                                 in the Rule to be set to \"TCP\" or \"UDP\"."
1333                               items:
1334                                 anyOf:
1335                                 - type: integer
1336                                 - type: string
1337                                 pattern: ^.*
1338                                 x-kubernetes-int-or-string: true
1339                               type: array
1340                             selector:
1341                               description: "Selector is an optional field that contains
1342                                 a selector expression (see Policy for sample syntax).
1343                                 \ Only traffic that originates from (terminates at) endpoints
1344                                 matching the selector will be matched. \n Note that: in
1345                                 addition to the negated version of the Selector (see NotSelector
1346                                 below), the selector expression syntax itself supports
1347                                 negation.  The two types of negation are subtly different.
1348                                 One negates the set of matched endpoints, the other negates
1349                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
1350                                 packets that are from other Calico-controlled \tendpoints
1351                                 that do not have the label \"my_label\". \n \tNotSelector
1352                                 = \"has(my_label)\" matches packets that are not from
1353                                 Calico-controlled \tendpoints that do have the label \"my_label\".
1354                                 \n The effect is that the latter will accept packets from
1355                                 non-Calico sources whereas the former is limited to packets
1356                                 from Calico-controlled endpoints."
1357                               type: string
1358                             serviceAccounts:
1359                               description: ServiceAccounts is an optional field that restricts
1360                                 the rule to only apply to traffic that originates from
1361                                 (or terminates at) a pod running as a matching service
1362                                 account.
1363                               properties:
1364                                 names:
1365                                   description: Names is an optional field that restricts
1366                                     the rule to only apply to traffic that originates
1367                                     from (or terminates at) a pod running as a service
1368                                     account whose name is in the list.
1369                                   items:
1370                                     type: string
1371                                   type: array
1372                                 selector:
1373                                   description: Selector is an optional field that restricts
1374                                     the rule to only apply to traffic that originates
1375                                     from (or terminates at) a pod running as a service
1376                                     account that matches the given label selector. If
1377                                     both Names and Selector are specified then they are
1378                                     AND'ed.
1379                                   type: string
1380                               type: object
1381                             services:
1382                               description: "Services is an optional field that contains
1383                                 options for matching Kubernetes Services. If specified,
1384                                 only traffic that originates from or terminates at endpoints
1385                                 within the selected service(s) will be matched, and only
1386                                 to/from each endpoint's port. \n Services cannot be specified
1387                                 on the same rule as Selector, NotSelector, NamespaceSelector,
1388                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
1389                                 can only be specified with Services on ingress rules."
1390                               properties:
1391                                 name:
1392                                   description: Name specifies the name of a Kubernetes
1393                                     Service to match.
1394                                   type: string
1395                                 namespace:
1396                                   description: Namespace specifies the namespace of the
1397                                     given Service. If left empty, the rule will match
1398                                     within this policy's namespace.
1399                                   type: string
1400                               type: object
1401                           type: object
1402                         http:
1403                           description: HTTP contains match criteria that apply to HTTP
1404                             requests.
1405                           properties:
1406                             methods:
1407                               description: Methods is an optional field that restricts
1408                                 the rule to apply only to HTTP requests that use one of
1409                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
1410                                 methods are OR'd together.
1411                               items:
1412                                 type: string
1413                               type: array
1414                             paths:
1415                               description: 'Paths is an optional field that restricts
1416                                 the rule to apply to HTTP requests that use one of the
1417                                 listed HTTP Paths. Multiple paths are OR''d together.
1418                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
1419                                 ONLY specify either a `exact` or a `prefix` match. The
1420                                 validator will check for it.'
1421                               items:
1422                                 description: 'HTTPPath specifies an HTTP path to match.
1423                                   It may be either of the form: exact: <path>: which matches
1424                                   the path exactly or prefix: <path-prefix>: which matches
1425                                   the path prefix'
1426                                 properties:
1427                                   exact:
1428                                     type: string
1429                                   prefix:
1430                                     type: string
1431                                 type: object
1432                               type: array
1433                           type: object
1434                         icmp:
1435                           description: ICMP is an optional field that restricts the rule
1436                             to apply to a specific type and code of ICMP traffic.  This
1437                             should only be specified if the Protocol field is set to "ICMP"
1438                             or "ICMPv6".
1439                           properties:
1440                             code:
1441                               description: Match on a specific ICMP code.  If specified,
1442                                 the Type value must also be specified. This is a technical
1443                                 limitation imposed by the kernel's iptables firewall,
1444                                 which Calico uses to enforce the rule.
1445                               type: integer
1446                             type:
1447                               description: Match on a specific ICMP type.  For example
1448                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
1449                               type: integer
1450                           type: object
1451                         ipVersion:
1452                           description: IPVersion is an optional field that restricts the
1453                             rule to only match a specific IP version.
1454                           type: integer
1455                         metadata:
1456                           description: Metadata contains additional information for this
1457                             rule
1458                           properties:
1459                             annotations:
1460                               additionalProperties:
1461                                 type: string
1462                               description: Annotations is a set of key value pairs that
1463                                 give extra information about the rule
1464                               type: object
1465                           type: object
1466                         notICMP:
1467                           description: NotICMP is the negated version of the ICMP field.
1468                           properties:
1469                             code:
1470                               description: Match on a specific ICMP code.  If specified,
1471                                 the Type value must also be specified. This is a technical
1472                                 limitation imposed by the kernel's iptables firewall,
1473                                 which Calico uses to enforce the rule.
1474                               type: integer
1475                             type:
1476                               description: Match on a specific ICMP type.  For example
1477                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
1478                               type: integer
1479                           type: object
1480                         notProtocol:
1481                           anyOf:
1482                           - type: integer
1483                           - type: string
1484                           description: NotProtocol is the negated version of the Protocol
1485                             field.
1486                           pattern: ^.*
1487                           x-kubernetes-int-or-string: true
1488                         protocol:
1489                           anyOf:
1490                           - type: integer
1491                           - type: string
1492                           description: "Protocol is an optional field that restricts the
1493                             rule to only apply to traffic of a specific IP protocol. Required
1494                             if any of the EntityRules contain Ports (because ports only
1495                             apply to certain protocols). \n Must be one of these string
1496                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
1497                             \"UDPLite\" or an integer in the range 1-255."
1498                           pattern: ^.*
1499                           x-kubernetes-int-or-string: true
1500                         source:
1501                           description: Source contains the match criteria that apply to
1502                             source entity.
1503                           properties:
1504                             namespaceSelector:
1505                               description: "NamespaceSelector is an optional field that
1506                                 contains a selector expression. Only traffic that originates
1507                                 from (or terminates at) endpoints within the selected
1508                                 namespaces will be matched. When both NamespaceSelector
1509                                 and another selector are defined on the same rule, then
1510                                 only workload endpoints that are matched by both selectors
1511                                 will be selected by the rule. \n For NetworkPolicy, an
1512                                 empty NamespaceSelector implies that the Selector is limited
1513                                 to selecting only workload endpoints in the same namespace
1514                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
1515                                 NamespaceSelector implies that the Selector is limited
1516                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
1517                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
1518                                 the Selector applies to workload endpoints across all
1519                                 namespaces."
1520                               type: string
1521                             nets:
1522                               description: Nets is an optional field that restricts the
1523                                 rule to only apply to traffic that originates from (or
1524                                 terminates at) IP addresses in any of the given subnets.
1525                               items:
1526                                 type: string
1527                               type: array
1528                             notNets:
1529                               description: NotNets is the negated version of the Nets
1530                                 field.
1531                               items:
1532                                 type: string
1533                               type: array
1534                             notPorts:
1535                               description: NotPorts is the negated version of the Ports
1536                                 field. Since only some protocols have ports, if any ports
1537                                 are specified it requires the Protocol match in the Rule
1538                                 to be set to "TCP" or "UDP".
1539                               items:
1540                                 anyOf:
1541                                 - type: integer
1542                                 - type: string
1543                                 pattern: ^.*
1544                                 x-kubernetes-int-or-string: true
1545                               type: array
1546                             notSelector:
1547                               description: NotSelector is the negated version of the Selector
1548                                 field.  See Selector field for subtleties with negated
1549                                 selectors.
1550                               type: string
1551                             ports:
1552                               description: "Ports is an optional field that restricts
1553                                 the rule to only apply to traffic that has a source (destination)
1554                                 port that matches one of these ranges/values. This value
1555                                 is a list of integers or strings that represent ranges
1556                                 of ports. \n Since only some protocols have ports, if
1557                                 any ports are specified it requires the Protocol match
1558                                 in the Rule to be set to \"TCP\" or \"UDP\"."
1559                               items:
1560                                 anyOf:
1561                                 - type: integer
1562                                 - type: string
1563                                 pattern: ^.*
1564                                 x-kubernetes-int-or-string: true
1565                               type: array
1566                             selector:
1567                               description: "Selector is an optional field that contains
1568                                 a selector expression (see Policy for sample syntax).
1569                                 \ Only traffic that originates from (terminates at) endpoints
1570                                 matching the selector will be matched. \n Note that: in
1571                                 addition to the negated version of the Selector (see NotSelector
1572                                 below), the selector expression syntax itself supports
1573                                 negation.  The two types of negation are subtly different.
1574                                 One negates the set of matched endpoints, the other negates
1575                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
1576                                 packets that are from other Calico-controlled \tendpoints
1577                                 that do not have the label \"my_label\". \n \tNotSelector
1578                                 = \"has(my_label)\" matches packets that are not from
1579                                 Calico-controlled \tendpoints that do have the label \"my_label\".
1580                                 \n The effect is that the latter will accept packets from
1581                                 non-Calico sources whereas the former is limited to packets
1582                                 from Calico-controlled endpoints."
1583                               type: string
1584                             serviceAccounts:
1585                               description: ServiceAccounts is an optional field that restricts
1586                                 the rule to only apply to traffic that originates from
1587                                 (or terminates at) a pod running as a matching service
1588                                 account.
1589                               properties:
1590                                 names:
1591                                   description: Names is an optional field that restricts
1592                                     the rule to only apply to traffic that originates
1593                                     from (or terminates at) a pod running as a service
1594                                     account whose name is in the list.
1595                                   items:
1596                                     type: string
1597                                   type: array
1598                                 selector:
1599                                   description: Selector is an optional field that restricts
1600                                     the rule to only apply to traffic that originates
1601                                     from (or terminates at) a pod running as a service
1602                                     account that matches the given label selector. If
1603                                     both Names and Selector are specified then they are
1604                                     AND'ed.
1605                                   type: string
1606                               type: object
1607                             services:
1608                               description: "Services is an optional field that contains
1609                                 options for matching Kubernetes Services. If specified,
1610                                 only traffic that originates from or terminates at endpoints
1611                                 within the selected service(s) will be matched, and only
1612                                 to/from each endpoint's port. \n Services cannot be specified
1613                                 on the same rule as Selector, NotSelector, NamespaceSelector,
1614                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
1615                                 can only be specified with Services on ingress rules."
1616                               properties:
1617                                 name:
1618                                   description: Name specifies the name of a Kubernetes
1619                                     Service to match.
1620                                   type: string
1621                                 namespace:
1622                                   description: Namespace specifies the namespace of the
1623                                     given Service. If left empty, the rule will match
1624                                     within this policy's namespace.
1625                                   type: string
1626                               type: object
1627                           type: object
1628                       required:
1629                       - action
1630                       type: object
1631                     type: array
1632                   ingress:
1633                     description: The ordered set of ingress rules.  Each rule contains
1634                       a set of packet match criteria and a corresponding action to apply.
1635                     items:
1636                       description: "A Rule encapsulates a set of match criteria and an
1637                         action.  Both selector-based security Policy and security Profiles
1638                         reference rules - separated out as a list of rules for both ingress
1639                         and egress packet matching. \n Each positive match criteria has
1640                         a negated version, prefixed with \"Not\". All the match criteria
1641                         within a rule must be satisfied for a packet to match. A single
1642                         rule can contain the positive and negative version of a match
1643                         and both must be satisfied for the rule to match."
1644                       properties:
1645                         action:
1646                           type: string
1647                         destination:
1648                           description: Destination contains the match criteria that apply
1649                             to destination entity.
1650                           properties:
1651                             namespaceSelector:
1652                               description: "NamespaceSelector is an optional field that
1653                                 contains a selector expression. Only traffic that originates
1654                                 from (or terminates at) endpoints within the selected
1655                                 namespaces will be matched. When both NamespaceSelector
1656                                 and another selector are defined on the same rule, then
1657                                 only workload endpoints that are matched by both selectors
1658                                 will be selected by the rule. \n For NetworkPolicy, an
1659                                 empty NamespaceSelector implies that the Selector is limited
1660                                 to selecting only workload endpoints in the same namespace
1661                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
1662                                 NamespaceSelector implies that the Selector is limited
1663                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
1664                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
1665                                 the Selector applies to workload endpoints across all
1666                                 namespaces."
1667                               type: string
1668                             nets:
1669                               description: Nets is an optional field that restricts the
1670                                 rule to only apply to traffic that originates from (or
1671                                 terminates at) IP addresses in any of the given subnets.
1672                               items:
1673                                 type: string
1674                               type: array
1675                             notNets:
1676                               description: NotNets is the negated version of the Nets
1677                                 field.
1678                               items:
1679                                 type: string
1680                               type: array
1681                             notPorts:
1682                               description: NotPorts is the negated version of the Ports
1683                                 field. Since only some protocols have ports, if any ports
1684                                 are specified it requires the Protocol match in the Rule
1685                                 to be set to "TCP" or "UDP".
1686                               items:
1687                                 anyOf:
1688                                 - type: integer
1689                                 - type: string
1690                                 pattern: ^.*
1691                                 x-kubernetes-int-or-string: true
1692                               type: array
1693                             notSelector:
1694                               description: NotSelector is the negated version of the Selector
1695                                 field.  See Selector field for subtleties with negated
1696                                 selectors.
1697                               type: string
1698                             ports:
1699                               description: "Ports is an optional field that restricts
1700                                 the rule to only apply to traffic that has a source (destination)
1701                                 port that matches one of these ranges/values. This value
1702                                 is a list of integers or strings that represent ranges
1703                                 of ports. \n Since only some protocols have ports, if
1704                                 any ports are specified it requires the Protocol match
1705                                 in the Rule to be set to \"TCP\" or \"UDP\"."
1706                               items:
1707                                 anyOf:
1708                                 - type: integer
1709                                 - type: string
1710                                 pattern: ^.*
1711                                 x-kubernetes-int-or-string: true
1712                               type: array
1713                             selector:
1714                               description: "Selector is an optional field that contains
1715                                 a selector expression (see Policy for sample syntax).
1716                                 \ Only traffic that originates from (terminates at) endpoints
1717                                 matching the selector will be matched. \n Note that: in
1718                                 addition to the negated version of the Selector (see NotSelector
1719                                 below), the selector expression syntax itself supports
1720                                 negation.  The two types of negation are subtly different.
1721                                 One negates the set of matched endpoints, the other negates
1722                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
1723                                 packets that are from other Calico-controlled \tendpoints
1724                                 that do not have the label \"my_label\". \n \tNotSelector
1725                                 = \"has(my_label)\" matches packets that are not from
1726                                 Calico-controlled \tendpoints that do have the label \"my_label\".
1727                                 \n The effect is that the latter will accept packets from
1728                                 non-Calico sources whereas the former is limited to packets
1729                                 from Calico-controlled endpoints."
1730                               type: string
1731                             serviceAccounts:
1732                               description: ServiceAccounts is an optional field that restricts
1733                                 the rule to only apply to traffic that originates from
1734                                 (or terminates at) a pod running as a matching service
1735                                 account.
1736                               properties:
1737                                 names:
1738                                   description: Names is an optional field that restricts
1739                                     the rule to only apply to traffic that originates
1740                                     from (or terminates at) a pod running as a service
1741                                     account whose name is in the list.
1742                                   items:
1743                                     type: string
1744                                   type: array
1745                                 selector:
1746                                   description: Selector is an optional field that restricts
1747                                     the rule to only apply to traffic that originates
1748                                     from (or terminates at) a pod running as a service
1749                                     account that matches the given label selector. If
1750                                     both Names and Selector are specified then they are
1751                                     AND'ed.
1752                                   type: string
1753                               type: object
1754                             services:
1755                               description: "Services is an optional field that contains
1756                                 options for matching Kubernetes Services. If specified,
1757                                 only traffic that originates from or terminates at endpoints
1758                                 within the selected service(s) will be matched, and only
1759                                 to/from each endpoint's port. \n Services cannot be specified
1760                                 on the same rule as Selector, NotSelector, NamespaceSelector,
1761                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
1762                                 can only be specified with Services on ingress rules."
1763                               properties:
1764                                 name:
1765                                   description: Name specifies the name of a Kubernetes
1766                                     Service to match.
1767                                   type: string
1768                                 namespace:
1769                                   description: Namespace specifies the namespace of the
1770                                     given Service. If left empty, the rule will match
1771                                     within this policy's namespace.
1772                                   type: string
1773                               type: object
1774                           type: object
1775                         http:
1776                           description: HTTP contains match criteria that apply to HTTP
1777                             requests.
1778                           properties:
1779                             methods:
1780                               description: Methods is an optional field that restricts
1781                                 the rule to apply only to HTTP requests that use one of
1782                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
1783                                 methods are OR'd together.
1784                               items:
1785                                 type: string
1786                               type: array
1787                             paths:
1788                               description: 'Paths is an optional field that restricts
1789                                 the rule to apply to HTTP requests that use one of the
1790                                 listed HTTP Paths. Multiple paths are OR''d together.
1791                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
1792                                 ONLY specify either a `exact` or a `prefix` match. The
1793                                 validator will check for it.'
1794                               items:
1795                                 description: 'HTTPPath specifies an HTTP path to match.
1796                                   It may be either of the form: exact: <path>: which matches
1797                                   the path exactly or prefix: <path-prefix>: which matches
1798                                   the path prefix'
1799                                 properties:
1800                                   exact:
1801                                     type: string
1802                                   prefix:
1803                                     type: string
1804                                 type: object
1805                               type: array
1806                           type: object
1807                         icmp:
1808                           description: ICMP is an optional field that restricts the rule
1809                             to apply to a specific type and code of ICMP traffic.  This
1810                             should only be specified if the Protocol field is set to "ICMP"
1811                             or "ICMPv6".
1812                           properties:
1813                             code:
1814                               description: Match on a specific ICMP code.  If specified,
1815                                 the Type value must also be specified. This is a technical
1816                                 limitation imposed by the kernel's iptables firewall,
1817                                 which Calico uses to enforce the rule.
1818                               type: integer
1819                             type:
1820                               description: Match on a specific ICMP type.  For example
1821                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
1822                               type: integer
1823                           type: object
1824                         ipVersion:
1825                           description: IPVersion is an optional field that restricts the
1826                             rule to only match a specific IP version.
1827                           type: integer
1828                         metadata:
1829                           description: Metadata contains additional information for this
1830                             rule
1831                           properties:
1832                             annotations:
1833                               additionalProperties:
1834                                 type: string
1835                               description: Annotations is a set of key value pairs that
1836                                 give extra information about the rule
1837                               type: object
1838                           type: object
1839                         notICMP:
1840                           description: NotICMP is the negated version of the ICMP field.
1841                           properties:
1842                             code:
1843                               description: Match on a specific ICMP code.  If specified,
1844                                 the Type value must also be specified. This is a technical
1845                                 limitation imposed by the kernel's iptables firewall,
1846                                 which Calico uses to enforce the rule.
1847                               type: integer
1848                             type:
1849                               description: Match on a specific ICMP type.  For example
1850                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
1851                               type: integer
1852                           type: object
1853                         notProtocol:
1854                           anyOf:
1855                           - type: integer
1856                           - type: string
1857                           description: NotProtocol is the negated version of the Protocol
1858                             field.
1859                           pattern: ^.*
1860                           x-kubernetes-int-or-string: true
1861                         protocol:
1862                           anyOf:
1863                           - type: integer
1864                           - type: string
1865                           description: "Protocol is an optional field that restricts the
1866                             rule to only apply to traffic of a specific IP protocol. Required
1867                             if any of the EntityRules contain Ports (because ports only
1868                             apply to certain protocols). \n Must be one of these string
1869                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
1870                             \"UDPLite\" or an integer in the range 1-255."
1871                           pattern: ^.*
1872                           x-kubernetes-int-or-string: true
1873                         source:
1874                           description: Source contains the match criteria that apply to
1875                             source entity.
1876                           properties:
1877                             namespaceSelector:
1878                               description: "NamespaceSelector is an optional field that
1879                                 contains a selector expression. Only traffic that originates
1880                                 from (or terminates at) endpoints within the selected
1881                                 namespaces will be matched. When both NamespaceSelector
1882                                 and another selector are defined on the same rule, then
1883                                 only workload endpoints that are matched by both selectors
1884                                 will be selected by the rule. \n For NetworkPolicy, an
1885                                 empty NamespaceSelector implies that the Selector is limited
1886                                 to selecting only workload endpoints in the same namespace
1887                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
1888                                 NamespaceSelector implies that the Selector is limited
1889                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
1890                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
1891                                 the Selector applies to workload endpoints across all
1892                                 namespaces."
1893                               type: string
1894                             nets:
1895                               description: Nets is an optional field that restricts the
1896                                 rule to only apply to traffic that originates from (or
1897                                 terminates at) IP addresses in any of the given subnets.
1898                               items:
1899                                 type: string
1900                               type: array
1901                             notNets:
1902                               description: NotNets is the negated version of the Nets
1903                                 field.
1904                               items:
1905                                 type: string
1906                               type: array
1907                             notPorts:
1908                               description: NotPorts is the negated version of the Ports
1909                                 field. Since only some protocols have ports, if any ports
1910                                 are specified it requires the Protocol match in the Rule
1911                                 to be set to "TCP" or "UDP".
1912                               items:
1913                                 anyOf:
1914                                 - type: integer
1915                                 - type: string
1916                                 pattern: ^.*
1917                                 x-kubernetes-int-or-string: true
1918                               type: array
1919                             notSelector:
1920                               description: NotSelector is the negated version of the Selector
1921                                 field.  See Selector field for subtleties with negated
1922                                 selectors.
1923                               type: string
1924                             ports:
1925                               description: "Ports is an optional field that restricts
1926                                 the rule to only apply to traffic that has a source (destination)
1927                                 port that matches one of these ranges/values. This value
1928                                 is a list of integers or strings that represent ranges
1929                                 of ports. \n Since only some protocols have ports, if
1930                                 any ports are specified it requires the Protocol match
1931                                 in the Rule to be set to \"TCP\" or \"UDP\"."
1932                               items:
1933                                 anyOf:
1934                                 - type: integer
1935                                 - type: string
1936                                 pattern: ^.*
1937                                 x-kubernetes-int-or-string: true
1938                               type: array
1939                             selector:
1940                               description: "Selector is an optional field that contains
1941                                 a selector expression (see Policy for sample syntax).
1942                                 \ Only traffic that originates from (terminates at) endpoints
1943                                 matching the selector will be matched. \n Note that: in
1944                                 addition to the negated version of the Selector (see NotSelector
1945                                 below), the selector expression syntax itself supports
1946                                 negation.  The two types of negation are subtly different.
1947                                 One negates the set of matched endpoints, the other negates
1948                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
1949                                 packets that are from other Calico-controlled \tendpoints
1950                                 that do not have the label \"my_label\". \n \tNotSelector
1951                                 = \"has(my_label)\" matches packets that are not from
1952                                 Calico-controlled \tendpoints that do have the label \"my_label\".
1953                                 \n The effect is that the latter will accept packets from
1954                                 non-Calico sources whereas the former is limited to packets
1955                                 from Calico-controlled endpoints."
1956                               type: string
1957                             serviceAccounts:
1958                               description: ServiceAccounts is an optional field that restricts
1959                                 the rule to only apply to traffic that originates from
1960                                 (or terminates at) a pod running as a matching service
1961                                 account.
1962                               properties:
1963                                 names:
1964                                   description: Names is an optional field that restricts
1965                                     the rule to only apply to traffic that originates
1966                                     from (or terminates at) a pod running as a service
1967                                     account whose name is in the list.
1968                                   items:
1969                                     type: string
1970                                   type: array
1971                                 selector:
1972                                   description: Selector is an optional field that restricts
1973                                     the rule to only apply to traffic that originates
1974                                     from (or terminates at) a pod running as a service
1975                                     account that matches the given label selector. If
1976                                     both Names and Selector are specified then they are
1977                                     AND'ed.
1978                                   type: string
1979                               type: object
1980                             services:
1981                               description: "Services is an optional field that contains
1982                                 options for matching Kubernetes Services. If specified,
1983                                 only traffic that originates from or terminates at endpoints
1984                                 within the selected service(s) will be matched, and only
1985                                 to/from each endpoint's port. \n Services cannot be specified
1986                                 on the same rule as Selector, NotSelector, NamespaceSelector,
1987                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
1988                                 can only be specified with Services on ingress rules."
1989                               properties:
1990                                 name:
1991                                   description: Name specifies the name of a Kubernetes
1992                                     Service to match.
1993                                   type: string
1994                                 namespace:
1995                                   description: Namespace specifies the namespace of the
1996                                     given Service. If left empty, the rule will match
1997                                     within this policy's namespace.
1998                                   type: string
1999                               type: object
2000                           type: object
2001                       required:
2002                       - action
2003                       type: object
2004                     type: array
2005                   namespaceSelector:
2006                     description: NamespaceSelector is an optional field for an expression
2007                       used to select a pod based on namespaces.
2008                     type: string
2009                   order:
2010                     description: Order is an optional field that specifies the order in
2011                       which the policy is applied. Policies with higher "order" are applied
2012                       after those with lower order.  If the order is omitted, it may be
2013                       considered to be "infinite" - i.e. the policy will be applied last.  Policies
2014                       with identical order will be applied in alphanumerical order based
2015                       on the Policy "Name".
2016                     type: number
2017                   preDNAT:
2018                     description: PreDNAT indicates to apply the rules in this policy before
2019                       any DNAT.
2020                     type: boolean
2021                   selector:
2022                     description: "The selector is an expression used to pick pick out
2023                       the endpoints that the policy should be applied to. \n Selector
2024                       expressions follow this syntax: \n \tlabel == \"string_literal\"
2025                       \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
2026                       \  ->  not equal; also matches if label is not present \tlabel in
2027                       { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
2028                       one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
2029                       ... }  ->  true if the value of label X is not one of \"a\", \"b\",
2030                       \"c\" \thas(label_name)  -> True if that label is present \t! expr
2031                       -> negation of expr \texpr && expr  -> Short-circuit and \texpr
2032                       || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
2033                       or the empty selector -> matches all endpoints. \n Label names are
2034                       allowed to contain alphanumerics, -, _ and /. String literals are
2035                       more permissive but they do not support escape characters. \n Examples
2036                       (with made-up labels): \n \ttype == \"webserver\" && deployment
2037                       == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
2038                       \"dev\" \t! has(label_name)"
2039                     type: string
2040                   serviceAccountSelector:
2041                     description: ServiceAccountSelector is an optional field for an expression
2042                       used to select a pod based on service accounts.
2043                     type: string
2044                   types:
2045                     description: "Types indicates whether this policy applies to ingress,
2046                       or to egress, or to both.  When not explicitly specified (and so
2047                       the value on creation is empty or nil), Calico defaults Types according
2048                       to what Ingress and Egress rules are present in the policy.  The
2049                       default is: \n - [ PolicyTypeIngress ], if there are no Egress rules
2050                       (including the case where there are   also no Ingress rules) \n
2051                       - [ PolicyTypeEgress ], if there are Egress rules but no Ingress
2052                       rules \n - [ PolicyTypeIngress, PolicyTypeEgress ], if there are
2053                       both Ingress and Egress rules. \n When the policy is read back again,
2054                       Types will always be one of these values, never empty or nil."
2055                     items:
2056                       description: PolicyType enumerates the possible values of the PolicySpec
2057                         Types field.
2058                       type: string
2059                     type: array
2060                 type: object
2061             type: object
2062         served: true
2063         storage: true
2064     status:
2065       acceptedNames:
2066         kind: ""
2067         plural: ""
2068       conditions: []
2069       storedVersions: []
2070     ---
2071     apiVersion: apiextensions.k8s.io/v1
2072     kind: CustomResourceDefinition
2073     metadata:
2074       name: globalnetworksets.crd.projectcalico.org
2075     spec:
2076       group: crd.projectcalico.org
2077       names:
2078         kind: GlobalNetworkSet
2079         listKind: GlobalNetworkSetList
2080         plural: globalnetworksets
2081         singular: globalnetworkset
2082       scope: Cluster
2083       versions:
2084       - name: v1
2085         schema:
2086           openAPIV3Schema:
2087             description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
2088               that share labels to allow rules to refer to them via selectors.  The labels
2089               of GlobalNetworkSet are not namespaced.
2090             properties:
2091               apiVersion:
2092                 description: 'APIVersion defines the versioned schema of this representation
2093                   of an object. Servers should convert recognized schemas to the latest
2094                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2095                 type: string
2096               kind:
2097                 description: 'Kind is a string value representing the REST resource this
2098                   object represents. Servers may infer this from the endpoint the client
2099                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2100                 type: string
2101               metadata:
2102                 type: object
2103               spec:
2104                 description: GlobalNetworkSetSpec contains the specification for a NetworkSet
2105                   resource.
2106                 properties:
2107                   nets:
2108                     description: The list of IP networks that belong to this set.
2109                     items:
2110                       type: string
2111                     type: array
2112                 type: object
2113             type: object
2114         served: true
2115         storage: true
2116     status:
2117       acceptedNames:
2118         kind: ""
2119         plural: ""
2120       conditions: []
2121       storedVersions: []
2122     ---
2123     apiVersion: apiextensions.k8s.io/v1
2124     kind: CustomResourceDefinition
2125     metadata:
2126       name: hostendpoints.crd.projectcalico.org
2127     spec:
2128       group: crd.projectcalico.org
2129       names:
2130         kind: HostEndpoint
2131         listKind: HostEndpointList
2132         plural: hostendpoints
2133         singular: hostendpoint
2134       scope: Cluster
2135       versions:
2136       - name: v1
2137         schema:
2138           openAPIV3Schema:
2139             properties:
2140               apiVersion:
2141                 description: 'APIVersion defines the versioned schema of this representation
2142                   of an object. Servers should convert recognized schemas to the latest
2143                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2144                 type: string
2145               kind:
2146                 description: 'Kind is a string value representing the REST resource this
2147                   object represents. Servers may infer this from the endpoint the client
2148                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2149                 type: string
2150               metadata:
2151                 type: object
2152               spec:
2153                 description: HostEndpointSpec contains the specification for a HostEndpoint
2154                   resource.
2155                 properties:
2156                   expectedIPs:
2157                     description: "The expected IP addresses (IPv4 and IPv6) of the endpoint.
2158                       If \"InterfaceName\" is not present, Calico will look for an interface
2159                       matching any of the IPs in the list and apply policy to that. Note:
2160                       \tWhen using the selector match criteria in an ingress or egress
2161                       security Policy \tor Profile, Calico converts the selector into
2162                       a set of IP addresses. For host \tendpoints, the ExpectedIPs field
2163                       is used for that purpose. (If only the interface \tname is specified,
2164                       Calico does not learn the IPs of the interface for use in match
2165                       \tcriteria.)"
2166                     items:
2167                       type: string
2168                     type: array
2169                   interfaceName:
2170                     description: "Either \"*\", or the name of a specific Linux interface
2171                       to apply policy to; or empty.  \"*\" indicates that this HostEndpoint
2172                       governs all traffic to, from or through the default network namespace
2173                       of the host named by the \"Node\" field; entering and leaving that
2174                       namespace via any interface, including those from/to non-host-networked
2175                       local workloads. \n If InterfaceName is not \"*\", this HostEndpoint
2176                       only governs traffic that enters or leaves the host through the
2177                       specific interface named by InterfaceName, or - when InterfaceName
2178                       is empty - through the specific interface that has one of the IPs
2179                       in ExpectedIPs. Therefore, when InterfaceName is empty, at least
2180                       one expected IP must be specified.  Only external interfaces (such
2181                       as \"eth0\") are supported here; it isn't possible for a HostEndpoint
2182                       to protect traffic through a specific local workload interface.
2183                       \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
2184                       initially just pre-DNAT policy.  Please check Calico documentation
2185                       for the latest position."
2186                     type: string
2187                   node:
2188                     description: The node name identifying the Calico node instance.
2189                     type: string
2190                   ports:
2191                     description: Ports contains the endpoint's named ports, which may
2192                       be referenced in security policy rules.
2193                     items:
2194                       properties:
2195                         name:
2196                           type: string
2197                         port:
2198                           type: integer
2199                         protocol:
2200                           anyOf:
2201                           - type: integer
2202                           - type: string
2203                           pattern: ^.*
2204                           x-kubernetes-int-or-string: true
2205                       required:
2206                       - name
2207                       - port
2208                       - protocol
2209                       type: object
2210                     type: array
2211                   profiles:
2212                     description: A list of identifiers of security Profile objects that
2213                       apply to this endpoint. Each profile is applied in the order that
2214                       they appear in this list.  Profile rules are applied after the selector-based
2215                       security policy.
2216                     items:
2217                       type: string
2218                     type: array
2219                 type: object
2220             type: object
2221         served: true
2222         storage: true
2223     status:
2224       acceptedNames:
2225         kind: ""
2226         plural: ""
2227       conditions: []
2228       storedVersions: []
2229     ---
2230     apiVersion: apiextensions.k8s.io/v1
2231     kind: CustomResourceDefinition
2232     metadata:
2233       name: ipamblocks.crd.projectcalico.org
2234     spec:
2235       group: crd.projectcalico.org
2236       names:
2237         kind: IPAMBlock
2238         listKind: IPAMBlockList
2239         plural: ipamblocks
2240         singular: ipamblock
2241       scope: Cluster
2242       versions:
2243       - name: v1
2244         schema:
2245           openAPIV3Schema:
2246             properties:
2247               apiVersion:
2248                 description: 'APIVersion defines the versioned schema of this representation
2249                   of an object. Servers should convert recognized schemas to the latest
2250                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2251                 type: string
2252               kind:
2253                 description: 'Kind is a string value representing the REST resource this
2254                   object represents. Servers may infer this from the endpoint the client
2255                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2256                 type: string
2257               metadata:
2258                 type: object
2259               spec:
2260                 description: IPAMBlockSpec contains the specification for an IPAMBlock
2261                   resource.
2262                 properties:
2263                   affinity:
2264                     type: string
2265                   allocations:
2266                     items:
2267                       nullable: true
2268                       type: integer
2269                     type: array
2270                   attributes:
2271                     items:
2272                       properties:
2273                         handle_id:
2274                           type: string
2275                         secondary:
2276                           additionalProperties:
2277                             type: string
2278                           type: object
2279                       type: object
2280                     type: array
2281                   cidr:
2282                     type: string
2283                   deleted:
2284                     type: boolean
2285                   strictAffinity:
2286                     type: boolean
2287                   unallocated:
2288                     items:
2289                       type: integer
2290                     type: array
2291                 required:
2292                 - allocations
2293                 - attributes
2294                 - cidr
2295                 - strictAffinity
2296                 - unallocated
2297                 type: object
2298             type: object
2299         served: true
2300         storage: true
2301     status:
2302       acceptedNames:
2303         kind: ""
2304         plural: ""
2305       conditions: []
2306       storedVersions: []
2307     ---
2308     apiVersion: apiextensions.k8s.io/v1
2309     kind: CustomResourceDefinition
2310     metadata:
2311       name: ipamconfigs.crd.projectcalico.org
2312     spec:
2313       group: crd.projectcalico.org
2314       names:
2315         kind: IPAMConfig
2316         listKind: IPAMConfigList
2317         plural: ipamconfigs
2318         singular: ipamconfig
2319       scope: Cluster
2320       versions:
2321       - name: v1
2322         schema:
2323           openAPIV3Schema:
2324             properties:
2325               apiVersion:
2326                 description: 'APIVersion defines the versioned schema of this representation
2327                   of an object. Servers should convert recognized schemas to the latest
2328                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2329                 type: string
2330               kind:
2331                 description: 'Kind is a string value representing the REST resource this
2332                   object represents. Servers may infer this from the endpoint the client
2333                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2334                 type: string
2335               metadata:
2336                 type: object
2337               spec:
2338                 description: IPAMConfigSpec contains the specification for an IPAMConfig
2339                   resource.
2340                 properties:
2341                   autoAllocateBlocks:
2342                     type: boolean
2343                   maxBlocksPerHost:
2344                     description: MaxBlocksPerHost, if non-zero, is the max number of blocks
2345                       that can be affine to each host.
2346                     type: integer
2347                   strictAffinity:
2348                     type: boolean
2349                 required:
2350                 - autoAllocateBlocks
2351                 - strictAffinity
2352                 type: object
2353             type: object
2354         served: true
2355         storage: true
2356     status:
2357       acceptedNames:
2358         kind: ""
2359         plural: ""
2360       conditions: []
2361       storedVersions: []
2362     ---
2363     apiVersion: apiextensions.k8s.io/v1
2364     kind: CustomResourceDefinition
2365     metadata:
2366       name: ipamhandles.crd.projectcalico.org
2367     spec:
2368       group: crd.projectcalico.org
2369       names:
2370         kind: IPAMHandle
2371         listKind: IPAMHandleList
2372         plural: ipamhandles
2373         singular: ipamhandle
2374       scope: Cluster
2375       versions:
2376       - name: v1
2377         schema:
2378           openAPIV3Schema:
2379             properties:
2380               apiVersion:
2381                 description: 'APIVersion defines the versioned schema of this representation
2382                   of an object. Servers should convert recognized schemas to the latest
2383                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2384                 type: string
2385               kind:
2386                 description: 'Kind is a string value representing the REST resource this
2387                   object represents. Servers may infer this from the endpoint the client
2388                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2389                 type: string
2390               metadata:
2391                 type: object
2392               spec:
2393                 description: IPAMHandleSpec contains the specification for an IPAMHandle
2394                   resource.
2395                 properties:
2396                   block:
2397                     additionalProperties:
2398                       type: integer
2399                     type: object
2400                   deleted:
2401                     type: boolean
2402                   handleID:
2403                     type: string
2404                 required:
2405                 - block
2406                 - handleID
2407                 type: object
2408             type: object
2409         served: true
2410         storage: true
2411     status:
2412       acceptedNames:
2413         kind: ""
2414         plural: ""
2415       conditions: []
2416       storedVersions: []
2417     ---
2418     apiVersion: apiextensions.k8s.io/v1
2419     kind: CustomResourceDefinition
2420     metadata:
2421       name: ippools.crd.projectcalico.org
2422     spec:
2423       group: crd.projectcalico.org
2424       names:
2425         kind: IPPool
2426         listKind: IPPoolList
2427         plural: ippools
2428         singular: ippool
2429       scope: Cluster
2430       versions:
2431       - name: v1
2432         schema:
2433           openAPIV3Schema:
2434             properties:
2435               apiVersion:
2436                 description: 'APIVersion defines the versioned schema of this representation
2437                   of an object. Servers should convert recognized schemas to the latest
2438                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2439                 type: string
2440               kind:
2441                 description: 'Kind is a string value representing the REST resource this
2442                   object represents. Servers may infer this from the endpoint the client
2443                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2444                 type: string
2445               metadata:
2446                 type: object
2447               spec:
2448                 description: IPPoolSpec contains the specification for an IPPool resource.
2449                 properties:
2450                   allowedUses:
2451                     description: AllowedUse controls what the IP pool will be used for.  If
2452                       not specified or empty, defaults to ["Tunnel", "Workload"] for back-compatibility
2453                     items:
2454                       type: string
2455                     type: array
2456                   blockSize:
2457                     description: The block size to use for IP address assignments from
2458                       this pool. Defaults to 26 for IPv4 and 112 for IPv6.
2459                     type: integer
2460                   cidr:
2461                     description: The pool CIDR.
2462                     type: string
2463                   disableBGPExport:
2464                     description: 'Disable exporting routes from this IP Pool''s CIDR over
2465                       BGP. [Default: false]'
2466                     type: boolean
2467                   disabled:
2468                     description: When disabled is true, Calico IPAM will not assign addresses
2469                       from this pool.
2470                     type: boolean
2471                   ipip:
2472                     description: 'Deprecated: this field is only used for APIv1 backwards
2473                       compatibility. Setting this field is not allowed, this field is
2474                       for internal use only.'
2475                     properties:
2476                       enabled:
2477                         description: When enabled is true, ipip tunneling will be used
2478                           to deliver packets to destinations within this pool.
2479                         type: boolean
2480                       mode:
2481                         description: The IPIP mode.  This can be one of "always" or "cross-subnet".  A
2482                           mode of "always" will also use IPIP tunneling for routing to
2483                           destination IP addresses within this pool.  A mode of "cross-subnet"
2484                           will only use IPIP tunneling when the destination node is on
2485                           a different subnet to the originating node.  The default value
2486                           (if not specified) is "always".
2487                         type: string
2488                     type: object
2489                   ipipMode:
2490                     description: Contains configuration for IPIP tunneling for this pool.
2491                       If not specified, then this is defaulted to "Never" (i.e. IPIP tunneling
2492                       is disabled).
2493                     type: string
2494                   nat-outgoing:
2495                     description: 'Deprecated: this field is only used for APIv1 backwards
2496                       compatibility. Setting this field is not allowed, this field is
2497                       for internal use only.'
2498                     type: boolean
2499                   natOutgoing:
2500                     description: When nat-outgoing is true, packets sent from Calico networked
2501                       containers in this pool to destinations outside of this pool will
2502                       be masqueraded.
2503                     type: boolean
2504                   nodeSelector:
2505                     description: Allows IPPool to allocate for a specific node by label
2506                       selector.
2507                     type: string
2508                   vxlanMode:
2509                     description: Contains configuration for VXLAN tunneling for this pool.
2510                       If not specified, then this is defaulted to "Never" (i.e. VXLAN
2511                       tunneling is disabled).
2512                     type: string
2513                 required:
2514                 - cidr
2515                 type: object
2516             type: object
2517         served: true
2518         storage: true
2519     status:
2520       acceptedNames:
2521         kind: ""
2522         plural: ""
2523       conditions: []
2524       storedVersions: []
2525     ---
2526     apiVersion: apiextensions.k8s.io/v1
2527     kind: CustomResourceDefinition
2528     metadata:
2529       name: ipreservations.crd.projectcalico.org
2530     spec:
2531       group: crd.projectcalico.org
2532       names:
2533         kind: IPReservation
2534         listKind: IPReservationList
2535         plural: ipreservations
2536         singular: ipreservation
2537       scope: Cluster
2538       versions:
2539       - name: v1
2540         schema:
2541           openAPIV3Schema:
2542             properties:
2543               apiVersion:
2544                 description: 'APIVersion defines the versioned schema of this representation
2545                   of an object. Servers should convert recognized schemas to the latest
2546                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2547                 type: string
2548               kind:
2549                 description: 'Kind is a string value representing the REST resource this
2550                   object represents. Servers may infer this from the endpoint the client
2551                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2552                 type: string
2553               metadata:
2554                 type: object
2555               spec:
2556                 description: IPReservationSpec contains the specification for an IPReservation
2557                   resource.
2558                 properties:
2559                   reservedCIDRs:
2560                     description: ReservedCIDRs is a list of CIDRs and/or IP addresses
2561                       that Calico IPAM will exclude from new allocations.
2562                     items:
2563                       type: string
2564                     type: array
2565                 type: object
2566             type: object
2567         served: true
2568         storage: true
2569     status:
2570       acceptedNames:
2571         kind: ""
2572         plural: ""
2573       conditions: []
2574       storedVersions: []
2575     ---
2576     apiVersion: apiextensions.k8s.io/v1
2577     kind: CustomResourceDefinition
2578     metadata:
2579       name: kubecontrollersconfigurations.crd.projectcalico.org
2580     spec:
2581       group: crd.projectcalico.org
2582       names:
2583         kind: KubeControllersConfiguration
2584         listKind: KubeControllersConfigurationList
2585         plural: kubecontrollersconfigurations
2586         singular: kubecontrollersconfiguration
2587       scope: Cluster
2588       versions:
2589       - name: v1
2590         schema:
2591           openAPIV3Schema:
2592             properties:
2593               apiVersion:
2594                 description: 'APIVersion defines the versioned schema of this representation
2595                   of an object. Servers should convert recognized schemas to the latest
2596                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2597                 type: string
2598               kind:
2599                 description: 'Kind is a string value representing the REST resource this
2600                   object represents. Servers may infer this from the endpoint the client
2601                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2602                 type: string
2603               metadata:
2604                 type: object
2605               spec:
2606                 description: KubeControllersConfigurationSpec contains the values of the
2607                   Kubernetes controllers configuration.
2608                 properties:
2609                   controllers:
2610                     description: Controllers enables and configures individual Kubernetes
2611                       controllers
2612                     properties:
2613                       namespace:
2614                         description: Namespace enables and configures the namespace controller.
2615                           Enabled by default, set to nil to disable.
2616                         properties:
2617                           reconcilerPeriod:
2618                             description: 'ReconcilerPeriod is the period to perform reconciliation
2619                               with the Calico datastore. [Default: 5m]'
2620                             type: string
2621                         type: object
2622                       node:
2623                         description: Node enables and configures the node controller.
2624                           Enabled by default, set to nil to disable.
2625                         properties:
2626                           hostEndpoint:
2627                             description: HostEndpoint controls syncing nodes to host endpoints.
2628                               Disabled by default, set to nil to disable.
2629                             properties:
2630                               autoCreate:
2631                                 description: 'AutoCreate enables automatic creation of
2632                                   host endpoints for every node. [Default: Disabled]'
2633                                 type: string
2634                             type: object
2635                           leakGracePeriod:
2636                             description: 'LeakGracePeriod is the period used by the controller
2637                               to determine if an IP address has been leaked. Set to 0
2638                               to disable IP garbage collection. [Default: 15m]'
2639                             type: string
2640                           reconcilerPeriod:
2641                             description: 'ReconcilerPeriod is the period to perform reconciliation
2642                               with the Calico datastore. [Default: 5m]'
2643                             type: string
2644                           syncLabels:
2645                             description: 'SyncLabels controls whether to copy Kubernetes
2646                               node labels to Calico nodes. [Default: Enabled]'
2647                             type: string
2648                         type: object
2649                       policy:
2650                         description: Policy enables and configures the policy controller.
2651                           Enabled by default, set to nil to disable.
2652                         properties:
2653                           reconcilerPeriod:
2654                             description: 'ReconcilerPeriod is the period to perform reconciliation
2655                               with the Calico datastore. [Default: 5m]'
2656                             type: string
2657                         type: object
2658                       serviceAccount:
2659                         description: ServiceAccount enables and configures the service
2660                           account controller. Enabled by default, set to nil to disable.
2661                         properties:
2662                           reconcilerPeriod:
2663                             description: 'ReconcilerPeriod is the period to perform reconciliation
2664                               with the Calico datastore. [Default: 5m]'
2665                             type: string
2666                         type: object
2667                       workloadEndpoint:
2668                         description: WorkloadEndpoint enables and configures the workload
2669                           endpoint controller. Enabled by default, set to nil to disable.
2670                         properties:
2671                           reconcilerPeriod:
2672                             description: 'ReconcilerPeriod is the period to perform reconciliation
2673                               with the Calico datastore. [Default: 5m]'
2674                             type: string
2675                         type: object
2676                     type: object
2677                   etcdV3CompactionPeriod:
2678                     description: 'EtcdV3CompactionPeriod is the period between etcdv3
2679                       compaction requests. Set to 0 to disable. [Default: 10m]'
2680                     type: string
2681                   healthChecks:
2682                     description: 'HealthChecks enables or disables support for health
2683                       checks [Default: Enabled]'
2684                     type: string
2685                   logSeverityScreen:
2686                     description: 'LogSeverityScreen is the log severity above which logs
2687                       are sent to the stdout. [Default: Info]'
2688                     type: string
2689                   prometheusMetricsPort:
2690                     description: 'PrometheusMetricsPort is the TCP port that the Prometheus
2691                       metrics server should bind to. Set to 0 to disable. [Default: 9094]'
2692                     type: integer
2693                 required:
2694                 - controllers
2695                 type: object
2696               status:
2697                 description: KubeControllersConfigurationStatus represents the status
2698                   of the configuration. It's useful for admins to be able to see the actual
2699                   config that was applied, which can be modified by environment variables
2700                   on the kube-controllers process.
2701                 properties:
2702                   environmentVars:
2703                     additionalProperties:
2704                       type: string
2705                     description: EnvironmentVars contains the environment variables on
2706                       the kube-controllers that influenced the RunningConfig.
2707                     type: object
2708                   runningConfig:
2709                     description: RunningConfig contains the effective config that is running
2710                       in the kube-controllers pod, after merging the API resource with
2711                       any environment variables.
2712                     properties:
2713                       controllers:
2714                         description: Controllers enables and configures individual Kubernetes
2715                           controllers
2716                         properties:
2717                           namespace:
2718                             description: Namespace enables and configures the namespace
2719                               controller. Enabled by default, set to nil to disable.
2720                             properties:
2721                               reconcilerPeriod:
2722                                 description: 'ReconcilerPeriod is the period to perform
2723                                   reconciliation with the Calico datastore. [Default:
2724                                   5m]'
2725                                 type: string
2726                             type: object
2727                           node:
2728                             description: Node enables and configures the node controller.
2729                               Enabled by default, set to nil to disable.
2730                             properties:
2731                               hostEndpoint:
2732                                 description: HostEndpoint controls syncing nodes to host
2733                                   endpoints. Disabled by default, set to nil to disable.
2734                                 properties:
2735                                   autoCreate:
2736                                     description: 'AutoCreate enables automatic creation
2737                                       of host endpoints for every node. [Default: Disabled]'
2738                                     type: string
2739                                 type: object
2740                               leakGracePeriod:
2741                                 description: 'LeakGracePeriod is the period used by the
2742                                   controller to determine if an IP address has been leaked.
2743                                   Set to 0 to disable IP garbage collection. [Default:
2744                                   15m]'
2745                                 type: string
2746                               reconcilerPeriod:
2747                                 description: 'ReconcilerPeriod is the period to perform
2748                                   reconciliation with the Calico datastore. [Default:
2749                                   5m]'
2750                                 type: string
2751                               syncLabels:
2752                                 description: 'SyncLabels controls whether to copy Kubernetes
2753                                   node labels to Calico nodes. [Default: Enabled]'
2754                                 type: string
2755                             type: object
2756                           policy:
2757                             description: Policy enables and configures the policy controller.
2758                               Enabled by default, set to nil to disable.
2759                             properties:
2760                               reconcilerPeriod:
2761                                 description: 'ReconcilerPeriod is the period to perform
2762                                   reconciliation with the Calico datastore. [Default:
2763                                   5m]'
2764                                 type: string
2765                             type: object
2766                           serviceAccount:
2767                             description: ServiceAccount enables and configures the service
2768                               account controller. Enabled by default, set to nil to disable.
2769                             properties:
2770                               reconcilerPeriod:
2771                                 description: 'ReconcilerPeriod is the period to perform
2772                                   reconciliation with the Calico datastore. [Default:
2773                                   5m]'
2774                                 type: string
2775                             type: object
2776                           workloadEndpoint:
2777                             description: WorkloadEndpoint enables and configures the workload
2778                               endpoint controller. Enabled by default, set to nil to disable.
2779                             properties:
2780                               reconcilerPeriod:
2781                                 description: 'ReconcilerPeriod is the period to perform
2782                                   reconciliation with the Calico datastore. [Default:
2783                                   5m]'
2784                                 type: string
2785                             type: object
2786                         type: object
2787                       etcdV3CompactionPeriod:
2788                         description: 'EtcdV3CompactionPeriod is the period between etcdv3
2789                           compaction requests. Set to 0 to disable. [Default: 10m]'
2790                         type: string
2791                       healthChecks:
2792                         description: 'HealthChecks enables or disables support for health
2793                           checks [Default: Enabled]'
2794                         type: string
2795                       logSeverityScreen:
2796                         description: 'LogSeverityScreen is the log severity above which
2797                           logs are sent to the stdout. [Default: Info]'
2798                         type: string
2799                       prometheusMetricsPort:
2800                         description: 'PrometheusMetricsPort is the TCP port that the Prometheus
2801                           metrics server should bind to. Set to 0 to disable. [Default:
2802                           9094]'
2803                         type: integer
2804                     required:
2805                     - controllers
2806                     type: object
2807                 type: object
2808             type: object
2809         served: true
2810         storage: true
2811     status:
2812       acceptedNames:
2813         kind: ""
2814         plural: ""
2815       conditions: []
2816       storedVersions: []
2817     ---
2818     apiVersion: apiextensions.k8s.io/v1
2819     kind: CustomResourceDefinition
2820     metadata:
2821       name: networkpolicies.crd.projectcalico.org
2822     spec:
2823       group: crd.projectcalico.org
2824       names:
2825         kind: NetworkPolicy
2826         listKind: NetworkPolicyList
2827         plural: networkpolicies
2828         singular: networkpolicy
2829       scope: Namespaced
2830       versions:
2831       - name: v1
2832         schema:
2833           openAPIV3Schema:
2834             properties:
2835               apiVersion:
2836                 description: 'APIVersion defines the versioned schema of this representation
2837                   of an object. Servers should convert recognized schemas to the latest
2838                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2839                 type: string
2840               kind:
2841                 description: 'Kind is a string value representing the REST resource this
2842                   object represents. Servers may infer this from the endpoint the client
2843                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
2844                 type: string
2845               metadata:
2846                 type: object
2847               spec:
2848                 properties:
2849                   egress:
2850                     description: The ordered set of egress rules.  Each rule contains
2851                       a set of packet match criteria and a corresponding action to apply.
2852                     items:
2853                       description: "A Rule encapsulates a set of match criteria and an
2854                         action.  Both selector-based security Policy and security Profiles
2855                         reference rules - separated out as a list of rules for both ingress
2856                         and egress packet matching. \n Each positive match criteria has
2857                         a negated version, prefixed with \"Not\". All the match criteria
2858                         within a rule must be satisfied for a packet to match. A single
2859                         rule can contain the positive and negative version of a match
2860                         and both must be satisfied for the rule to match."
2861                       properties:
2862                         action:
2863                           type: string
2864                         destination:
2865                           description: Destination contains the match criteria that apply
2866                             to destination entity.
2867                           properties:
2868                             namespaceSelector:
2869                               description: "NamespaceSelector is an optional field that
2870                                 contains a selector expression. Only traffic that originates
2871                                 from (or terminates at) endpoints within the selected
2872                                 namespaces will be matched. When both NamespaceSelector
2873                                 and another selector are defined on the same rule, then
2874                                 only workload endpoints that are matched by both selectors
2875                                 will be selected by the rule. \n For NetworkPolicy, an
2876                                 empty NamespaceSelector implies that the Selector is limited
2877                                 to selecting only workload endpoints in the same namespace
2878                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
2879                                 NamespaceSelector implies that the Selector is limited
2880                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
2881                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
2882                                 the Selector applies to workload endpoints across all
2883                                 namespaces."
2884                               type: string
2885                             nets:
2886                               description: Nets is an optional field that restricts the
2887                                 rule to only apply to traffic that originates from (or
2888                                 terminates at) IP addresses in any of the given subnets.
2889                               items:
2890                                 type: string
2891                               type: array
2892                             notNets:
2893                               description: NotNets is the negated version of the Nets
2894                                 field.
2895                               items:
2896                                 type: string
2897                               type: array
2898                             notPorts:
2899                               description: NotPorts is the negated version of the Ports
2900                                 field. Since only some protocols have ports, if any ports
2901                                 are specified it requires the Protocol match in the Rule
2902                                 to be set to "TCP" or "UDP".
2903                               items:
2904                                 anyOf:
2905                                 - type: integer
2906                                 - type: string
2907                                 pattern: ^.*
2908                                 x-kubernetes-int-or-string: true
2909                               type: array
2910                             notSelector:
2911                               description: NotSelector is the negated version of the Selector
2912                                 field.  See Selector field for subtleties with negated
2913                                 selectors.
2914                               type: string
2915                             ports:
2916                               description: "Ports is an optional field that restricts
2917                                 the rule to only apply to traffic that has a source (destination)
2918                                 port that matches one of these ranges/values. This value
2919                                 is a list of integers or strings that represent ranges
2920                                 of ports. \n Since only some protocols have ports, if
2921                                 any ports are specified it requires the Protocol match
2922                                 in the Rule to be set to \"TCP\" or \"UDP\"."
2923                               items:
2924                                 anyOf:
2925                                 - type: integer
2926                                 - type: string
2927                                 pattern: ^.*
2928                                 x-kubernetes-int-or-string: true
2929                               type: array
2930                             selector:
2931                               description: "Selector is an optional field that contains
2932                                 a selector expression (see Policy for sample syntax).
2933                                 \ Only traffic that originates from (terminates at) endpoints
2934                                 matching the selector will be matched. \n Note that: in
2935                                 addition to the negated version of the Selector (see NotSelector
2936                                 below), the selector expression syntax itself supports
2937                                 negation.  The two types of negation are subtly different.
2938                                 One negates the set of matched endpoints, the other negates
2939                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
2940                                 packets that are from other Calico-controlled \tendpoints
2941                                 that do not have the label \"my_label\". \n \tNotSelector
2942                                 = \"has(my_label)\" matches packets that are not from
2943                                 Calico-controlled \tendpoints that do have the label \"my_label\".
2944                                 \n The effect is that the latter will accept packets from
2945                                 non-Calico sources whereas the former is limited to packets
2946                                 from Calico-controlled endpoints."
2947                               type: string
2948                             serviceAccounts:
2949                               description: ServiceAccounts is an optional field that restricts
2950                                 the rule to only apply to traffic that originates from
2951                                 (or terminates at) a pod running as a matching service
2952                                 account.
2953                               properties:
2954                                 names:
2955                                   description: Names is an optional field that restricts
2956                                     the rule to only apply to traffic that originates
2957                                     from (or terminates at) a pod running as a service
2958                                     account whose name is in the list.
2959                                   items:
2960                                     type: string
2961                                   type: array
2962                                 selector:
2963                                   description: Selector is an optional field that restricts
2964                                     the rule to only apply to traffic that originates
2965                                     from (or terminates at) a pod running as a service
2966                                     account that matches the given label selector. If
2967                                     both Names and Selector are specified then they are
2968                                     AND'ed.
2969                                   type: string
2970                               type: object
2971                             services:
2972                               description: "Services is an optional field that contains
2973                                 options for matching Kubernetes Services. If specified,
2974                                 only traffic that originates from or terminates at endpoints
2975                                 within the selected service(s) will be matched, and only
2976                                 to/from each endpoint's port. \n Services cannot be specified
2977                                 on the same rule as Selector, NotSelector, NamespaceSelector,
2978                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
2979                                 can only be specified with Services on ingress rules."
2980                               properties:
2981                                 name:
2982                                   description: Name specifies the name of a Kubernetes
2983                                     Service to match.
2984                                   type: string
2985                                 namespace:
2986                                   description: Namespace specifies the namespace of the
2987                                     given Service. If left empty, the rule will match
2988                                     within this policy's namespace.
2989                                   type: string
2990                               type: object
2991                           type: object
2992                         http:
2993                           description: HTTP contains match criteria that apply to HTTP
2994                             requests.
2995                           properties:
2996                             methods:
2997                               description: Methods is an optional field that restricts
2998                                 the rule to apply only to HTTP requests that use one of
2999                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
3000                                 methods are OR'd together.
3001                               items:
3002                                 type: string
3003                               type: array
3004                             paths:
3005                               description: 'Paths is an optional field that restricts
3006                                 the rule to apply to HTTP requests that use one of the
3007                                 listed HTTP Paths. Multiple paths are OR''d together.
3008                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
3009                                 ONLY specify either a `exact` or a `prefix` match. The
3010                                 validator will check for it.'
3011                               items:
3012                                 description: 'HTTPPath specifies an HTTP path to match.
3013                                   It may be either of the form: exact: <path>: which matches
3014                                   the path exactly or prefix: <path-prefix>: which matches
3015                                   the path prefix'
3016                                 properties:
3017                                   exact:
3018                                     type: string
3019                                   prefix:
3020                                     type: string
3021                                 type: object
3022                               type: array
3023                           type: object
3024                         icmp:
3025                           description: ICMP is an optional field that restricts the rule
3026                             to apply to a specific type and code of ICMP traffic.  This
3027                             should only be specified if the Protocol field is set to "ICMP"
3028                             or "ICMPv6".
3029                           properties:
3030                             code:
3031                               description: Match on a specific ICMP code.  If specified,
3032                                 the Type value must also be specified. This is a technical
3033                                 limitation imposed by the kernel's iptables firewall,
3034                                 which Calico uses to enforce the rule.
3035                               type: integer
3036                             type:
3037                               description: Match on a specific ICMP type.  For example
3038                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
3039                               type: integer
3040                           type: object
3041                         ipVersion:
3042                           description: IPVersion is an optional field that restricts the
3043                             rule to only match a specific IP version.
3044                           type: integer
3045                         metadata:
3046                           description: Metadata contains additional information for this
3047                             rule
3048                           properties:
3049                             annotations:
3050                               additionalProperties:
3051                                 type: string
3052                               description: Annotations is a set of key value pairs that
3053                                 give extra information about the rule
3054                               type: object
3055                           type: object
3056                         notICMP:
3057                           description: NotICMP is the negated version of the ICMP field.
3058                           properties:
3059                             code:
3060                               description: Match on a specific ICMP code.  If specified,
3061                                 the Type value must also be specified. This is a technical
3062                                 limitation imposed by the kernel's iptables firewall,
3063                                 which Calico uses to enforce the rule.
3064                               type: integer
3065                             type:
3066                               description: Match on a specific ICMP type.  For example
3067                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
3068                               type: integer
3069                           type: object
3070                         notProtocol:
3071                           anyOf:
3072                           - type: integer
3073                           - type: string
3074                           description: NotProtocol is the negated version of the Protocol
3075                             field.
3076                           pattern: ^.*
3077                           x-kubernetes-int-or-string: true
3078                         protocol:
3079                           anyOf:
3080                           - type: integer
3081                           - type: string
3082                           description: "Protocol is an optional field that restricts the
3083                             rule to only apply to traffic of a specific IP protocol. Required
3084                             if any of the EntityRules contain Ports (because ports only
3085                             apply to certain protocols). \n Must be one of these string
3086                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
3087                             \"UDPLite\" or an integer in the range 1-255."
3088                           pattern: ^.*
3089                           x-kubernetes-int-or-string: true
3090                         source:
3091                           description: Source contains the match criteria that apply to
3092                             source entity.
3093                           properties:
3094                             namespaceSelector:
3095                               description: "NamespaceSelector is an optional field that
3096                                 contains a selector expression. Only traffic that originates
3097                                 from (or terminates at) endpoints within the selected
3098                                 namespaces will be matched. When both NamespaceSelector
3099                                 and another selector are defined on the same rule, then
3100                                 only workload endpoints that are matched by both selectors
3101                                 will be selected by the rule. \n For NetworkPolicy, an
3102                                 empty NamespaceSelector implies that the Selector is limited
3103                                 to selecting only workload endpoints in the same namespace
3104                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
3105                                 NamespaceSelector implies that the Selector is limited
3106                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
3107                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
3108                                 the Selector applies to workload endpoints across all
3109                                 namespaces."
3110                               type: string
3111                             nets:
3112                               description: Nets is an optional field that restricts the
3113                                 rule to only apply to traffic that originates from (or
3114                                 terminates at) IP addresses in any of the given subnets.
3115                               items:
3116                                 type: string
3117                               type: array
3118                             notNets:
3119                               description: NotNets is the negated version of the Nets
3120                                 field.
3121                               items:
3122                                 type: string
3123                               type: array
3124                             notPorts:
3125                               description: NotPorts is the negated version of the Ports
3126                                 field. Since only some protocols have ports, if any ports
3127                                 are specified it requires the Protocol match in the Rule
3128                                 to be set to "TCP" or "UDP".
3129                               items:
3130                                 anyOf:
3131                                 - type: integer
3132                                 - type: string
3133                                 pattern: ^.*
3134                                 x-kubernetes-int-or-string: true
3135                               type: array
3136                             notSelector:
3137                               description: NotSelector is the negated version of the Selector
3138                                 field.  See Selector field for subtleties with negated
3139                                 selectors.
3140                               type: string
3141                             ports:
3142                               description: "Ports is an optional field that restricts
3143                                 the rule to only apply to traffic that has a source (destination)
3144                                 port that matches one of these ranges/values. This value
3145                                 is a list of integers or strings that represent ranges
3146                                 of ports. \n Since only some protocols have ports, if
3147                                 any ports are specified it requires the Protocol match
3148                                 in the Rule to be set to \"TCP\" or \"UDP\"."
3149                               items:
3150                                 anyOf:
3151                                 - type: integer
3152                                 - type: string
3153                                 pattern: ^.*
3154                                 x-kubernetes-int-or-string: true
3155                               type: array
3156                             selector:
3157                               description: "Selector is an optional field that contains
3158                                 a selector expression (see Policy for sample syntax).
3159                                 \ Only traffic that originates from (terminates at) endpoints
3160                                 matching the selector will be matched. \n Note that: in
3161                                 addition to the negated version of the Selector (see NotSelector
3162                                 below), the selector expression syntax itself supports
3163                                 negation.  The two types of negation are subtly different.
3164                                 One negates the set of matched endpoints, the other negates
3165                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
3166                                 packets that are from other Calico-controlled \tendpoints
3167                                 that do not have the label \"my_label\". \n \tNotSelector
3168                                 = \"has(my_label)\" matches packets that are not from
3169                                 Calico-controlled \tendpoints that do have the label \"my_label\".
3170                                 \n The effect is that the latter will accept packets from
3171                                 non-Calico sources whereas the former is limited to packets
3172                                 from Calico-controlled endpoints."
3173                               type: string
3174                             serviceAccounts:
3175                               description: ServiceAccounts is an optional field that restricts
3176                                 the rule to only apply to traffic that originates from
3177                                 (or terminates at) a pod running as a matching service
3178                                 account.
3179                               properties:
3180                                 names:
3181                                   description: Names is an optional field that restricts
3182                                     the rule to only apply to traffic that originates
3183                                     from (or terminates at) a pod running as a service
3184                                     account whose name is in the list.
3185                                   items:
3186                                     type: string
3187                                   type: array
3188                                 selector:
3189                                   description: Selector is an optional field that restricts
3190                                     the rule to only apply to traffic that originates
3191                                     from (or terminates at) a pod running as a service
3192                                     account that matches the given label selector. If
3193                                     both Names and Selector are specified then they are
3194                                     AND'ed.
3195                                   type: string
3196                               type: object
3197                             services:
3198                               description: "Services is an optional field that contains
3199                                 options for matching Kubernetes Services. If specified,
3200                                 only traffic that originates from or terminates at endpoints
3201                                 within the selected service(s) will be matched, and only
3202                                 to/from each endpoint's port. \n Services cannot be specified
3203                                 on the same rule as Selector, NotSelector, NamespaceSelector,
3204                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
3205                                 can only be specified with Services on ingress rules."
3206                               properties:
3207                                 name:
3208                                   description: Name specifies the name of a Kubernetes
3209                                     Service to match.
3210                                   type: string
3211                                 namespace:
3212                                   description: Namespace specifies the namespace of the
3213                                     given Service. If left empty, the rule will match
3214                                     within this policy's namespace.
3215                                   type: string
3216                               type: object
3217                           type: object
3218                       required:
3219                       - action
3220                       type: object
3221                     type: array
3222                   ingress:
3223                     description: The ordered set of ingress rules.  Each rule contains
3224                       a set of packet match criteria and a corresponding action to apply.
3225                     items:
3226                       description: "A Rule encapsulates a set of match criteria and an
3227                         action.  Both selector-based security Policy and security Profiles
3228                         reference rules - separated out as a list of rules for both ingress
3229                         and egress packet matching. \n Each positive match criteria has
3230                         a negated version, prefixed with \"Not\". All the match criteria
3231                         within a rule must be satisfied for a packet to match. A single
3232                         rule can contain the positive and negative version of a match
3233                         and both must be satisfied for the rule to match."
3234                       properties:
3235                         action:
3236                           type: string
3237                         destination:
3238                           description: Destination contains the match criteria that apply
3239                             to destination entity.
3240                           properties:
3241                             namespaceSelector:
3242                               description: "NamespaceSelector is an optional field that
3243                                 contains a selector expression. Only traffic that originates
3244                                 from (or terminates at) endpoints within the selected
3245                                 namespaces will be matched. When both NamespaceSelector
3246                                 and another selector are defined on the same rule, then
3247                                 only workload endpoints that are matched by both selectors
3248                                 will be selected by the rule. \n For NetworkPolicy, an
3249                                 empty NamespaceSelector implies that the Selector is limited
3250                                 to selecting only workload endpoints in the same namespace
3251                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
3252                                 NamespaceSelector implies that the Selector is limited
3253                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
3254                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
3255                                 the Selector applies to workload endpoints across all
3256                                 namespaces."
3257                               type: string
3258                             nets:
3259                               description: Nets is an optional field that restricts the
3260                                 rule to only apply to traffic that originates from (or
3261                                 terminates at) IP addresses in any of the given subnets.
3262                               items:
3263                                 type: string
3264                               type: array
3265                             notNets:
3266                               description: NotNets is the negated version of the Nets
3267                                 field.
3268                               items:
3269                                 type: string
3270                               type: array
3271                             notPorts:
3272                               description: NotPorts is the negated version of the Ports
3273                                 field. Since only some protocols have ports, if any ports
3274                                 are specified it requires the Protocol match in the Rule
3275                                 to be set to "TCP" or "UDP".
3276                               items:
3277                                 anyOf:
3278                                 - type: integer
3279                                 - type: string
3280                                 pattern: ^.*
3281                                 x-kubernetes-int-or-string: true
3282                               type: array
3283                             notSelector:
3284                               description: NotSelector is the negated version of the Selector
3285                                 field.  See Selector field for subtleties with negated
3286                                 selectors.
3287                               type: string
3288                             ports:
3289                               description: "Ports is an optional field that restricts
3290                                 the rule to only apply to traffic that has a source (destination)
3291                                 port that matches one of these ranges/values. This value
3292                                 is a list of integers or strings that represent ranges
3293                                 of ports. \n Since only some protocols have ports, if
3294                                 any ports are specified it requires the Protocol match
3295                                 in the Rule to be set to \"TCP\" or \"UDP\"."
3296                               items:
3297                                 anyOf:
3298                                 - type: integer
3299                                 - type: string
3300                                 pattern: ^.*
3301                                 x-kubernetes-int-or-string: true
3302                               type: array
3303                             selector:
3304                               description: "Selector is an optional field that contains
3305                                 a selector expression (see Policy for sample syntax).
3306                                 \ Only traffic that originates from (terminates at) endpoints
3307                                 matching the selector will be matched. \n Note that: in
3308                                 addition to the negated version of the Selector (see NotSelector
3309                                 below), the selector expression syntax itself supports
3310                                 negation.  The two types of negation are subtly different.
3311                                 One negates the set of matched endpoints, the other negates
3312                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
3313                                 packets that are from other Calico-controlled \tendpoints
3314                                 that do not have the label \"my_label\". \n \tNotSelector
3315                                 = \"has(my_label)\" matches packets that are not from
3316                                 Calico-controlled \tendpoints that do have the label \"my_label\".
3317                                 \n The effect is that the latter will accept packets from
3318                                 non-Calico sources whereas the former is limited to packets
3319                                 from Calico-controlled endpoints."
3320                               type: string
3321                             serviceAccounts:
3322                               description: ServiceAccounts is an optional field that restricts
3323                                 the rule to only apply to traffic that originates from
3324                                 (or terminates at) a pod running as a matching service
3325                                 account.
3326                               properties:
3327                                 names:
3328                                   description: Names is an optional field that restricts
3329                                     the rule to only apply to traffic that originates
3330                                     from (or terminates at) a pod running as a service
3331                                     account whose name is in the list.
3332                                   items:
3333                                     type: string
3334                                   type: array
3335                                 selector:
3336                                   description: Selector is an optional field that restricts
3337                                     the rule to only apply to traffic that originates
3338                                     from (or terminates at) a pod running as a service
3339                                     account that matches the given label selector. If
3340                                     both Names and Selector are specified then they are
3341                                     AND'ed.
3342                                   type: string
3343                               type: object
3344                             services:
3345                               description: "Services is an optional field that contains
3346                                 options for matching Kubernetes Services. If specified,
3347                                 only traffic that originates from or terminates at endpoints
3348                                 within the selected service(s) will be matched, and only
3349                                 to/from each endpoint's port. \n Services cannot be specified
3350                                 on the same rule as Selector, NotSelector, NamespaceSelector,
3351                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
3352                                 can only be specified with Services on ingress rules."
3353                               properties:
3354                                 name:
3355                                   description: Name specifies the name of a Kubernetes
3356                                     Service to match.
3357                                   type: string
3358                                 namespace:
3359                                   description: Namespace specifies the namespace of the
3360                                     given Service. If left empty, the rule will match
3361                                     within this policy's namespace.
3362                                   type: string
3363                               type: object
3364                           type: object
3365                         http:
3366                           description: HTTP contains match criteria that apply to HTTP
3367                             requests.
3368                           properties:
3369                             methods:
3370                               description: Methods is an optional field that restricts
3371                                 the rule to apply only to HTTP requests that use one of
3372                                 the listed HTTP Methods (e.g. GET, PUT, etc.) Multiple
3373                                 methods are OR'd together.
3374                               items:
3375                                 type: string
3376                               type: array
3377                             paths:
3378                               description: 'Paths is an optional field that restricts
3379                                 the rule to apply to HTTP requests that use one of the
3380                                 listed HTTP Paths. Multiple paths are OR''d together.
3381                                 e.g: - exact: /foo - prefix: /bar NOTE: Each entry may
3382                                 ONLY specify either a `exact` or a `prefix` match. The
3383                                 validator will check for it.'
3384                               items:
3385                                 description: 'HTTPPath specifies an HTTP path to match.
3386                                   It may be either of the form: exact: <path>: which matches
3387                                   the path exactly or prefix: <path-prefix>: which matches
3388                                   the path prefix'
3389                                 properties:
3390                                   exact:
3391                                     type: string
3392                                   prefix:
3393                                     type: string
3394                                 type: object
3395                               type: array
3396                           type: object
3397                         icmp:
3398                           description: ICMP is an optional field that restricts the rule
3399                             to apply to a specific type and code of ICMP traffic.  This
3400                             should only be specified if the Protocol field is set to "ICMP"
3401                             or "ICMPv6".
3402                           properties:
3403                             code:
3404                               description: Match on a specific ICMP code.  If specified,
3405                                 the Type value must also be specified. This is a technical
3406                                 limitation imposed by the kernel's iptables firewall,
3407                                 which Calico uses to enforce the rule.
3408                               type: integer
3409                             type:
3410                               description: Match on a specific ICMP type.  For example
3411                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
3412                               type: integer
3413                           type: object
3414                         ipVersion:
3415                           description: IPVersion is an optional field that restricts the
3416                             rule to only match a specific IP version.
3417                           type: integer
3418                         metadata:
3419                           description: Metadata contains additional information for this
3420                             rule
3421                           properties:
3422                             annotations:
3423                               additionalProperties:
3424                                 type: string
3425                               description: Annotations is a set of key value pairs that
3426                                 give extra information about the rule
3427                               type: object
3428                           type: object
3429                         notICMP:
3430                           description: NotICMP is the negated version of the ICMP field.
3431                           properties:
3432                             code:
3433                               description: Match on a specific ICMP code.  If specified,
3434                                 the Type value must also be specified. This is a technical
3435                                 limitation imposed by the kernel's iptables firewall,
3436                                 which Calico uses to enforce the rule.
3437                               type: integer
3438                             type:
3439                               description: Match on a specific ICMP type.  For example
3440                                 a value of 8 refers to ICMP Echo Request (i.e. pings).
3441                               type: integer
3442                           type: object
3443                         notProtocol:
3444                           anyOf:
3445                           - type: integer
3446                           - type: string
3447                           description: NotProtocol is the negated version of the Protocol
3448                             field.
3449                           pattern: ^.*
3450                           x-kubernetes-int-or-string: true
3451                         protocol:
3452                           anyOf:
3453                           - type: integer
3454                           - type: string
3455                           description: "Protocol is an optional field that restricts the
3456                             rule to only apply to traffic of a specific IP protocol. Required
3457                             if any of the EntityRules contain Ports (because ports only
3458                             apply to certain protocols). \n Must be one of these string
3459                             values: \"TCP\", \"UDP\", \"ICMP\", \"ICMPv6\", \"SCTP\",
3460                             \"UDPLite\" or an integer in the range 1-255."
3461                           pattern: ^.*
3462                           x-kubernetes-int-or-string: true
3463                         source:
3464                           description: Source contains the match criteria that apply to
3465                             source entity.
3466                           properties:
3467                             namespaceSelector:
3468                               description: "NamespaceSelector is an optional field that
3469                                 contains a selector expression. Only traffic that originates
3470                                 from (or terminates at) endpoints within the selected
3471                                 namespaces will be matched. When both NamespaceSelector
3472                                 and another selector are defined on the same rule, then
3473                                 only workload endpoints that are matched by both selectors
3474                                 will be selected by the rule. \n For NetworkPolicy, an
3475                                 empty NamespaceSelector implies that the Selector is limited
3476                                 to selecting only workload endpoints in the same namespace
3477                                 as the NetworkPolicy. \n For NetworkPolicy, `global()`
3478                                 NamespaceSelector implies that the Selector is limited
3479                                 to selecting only GlobalNetworkSet or HostEndpoint. \n
3480                                 For GlobalNetworkPolicy, an empty NamespaceSelector implies
3481                                 the Selector applies to workload endpoints across all
3482                                 namespaces."
3483                               type: string
3484                             nets:
3485                               description: Nets is an optional field that restricts the
3486                                 rule to only apply to traffic that originates from (or
3487                                 terminates at) IP addresses in any of the given subnets.
3488                               items:
3489                                 type: string
3490                               type: array
3491                             notNets:
3492                               description: NotNets is the negated version of the Nets
3493                                 field.
3494                               items:
3495                                 type: string
3496                               type: array
3497                             notPorts:
3498                               description: NotPorts is the negated version of the Ports
3499                                 field. Since only some protocols have ports, if any ports
3500                                 are specified it requires the Protocol match in the Rule
3501                                 to be set to "TCP" or "UDP".
3502                               items:
3503                                 anyOf:
3504                                 - type: integer
3505                                 - type: string
3506                                 pattern: ^.*
3507                                 x-kubernetes-int-or-string: true
3508                               type: array
3509                             notSelector:
3510                               description: NotSelector is the negated version of the Selector
3511                                 field.  See Selector field for subtleties with negated
3512                                 selectors.
3513                               type: string
3514                             ports:
3515                               description: "Ports is an optional field that restricts
3516                                 the rule to only apply to traffic that has a source (destination)
3517                                 port that matches one of these ranges/values. This value
3518                                 is a list of integers or strings that represent ranges
3519                                 of ports. \n Since only some protocols have ports, if
3520                                 any ports are specified it requires the Protocol match
3521                                 in the Rule to be set to \"TCP\" or \"UDP\"."
3522                               items:
3523                                 anyOf:
3524                                 - type: integer
3525                                 - type: string
3526                                 pattern: ^.*
3527                                 x-kubernetes-int-or-string: true
3528                               type: array
3529                             selector:
3530                               description: "Selector is an optional field that contains
3531                                 a selector expression (see Policy for sample syntax).
3532                                 \ Only traffic that originates from (terminates at) endpoints
3533                                 matching the selector will be matched. \n Note that: in
3534                                 addition to the negated version of the Selector (see NotSelector
3535                                 below), the selector expression syntax itself supports
3536                                 negation.  The two types of negation are subtly different.
3537                                 One negates the set of matched endpoints, the other negates
3538                                 the whole match: \n \tSelector = \"!has(my_label)\" matches
3539                                 packets that are from other Calico-controlled \tendpoints
3540                                 that do not have the label \"my_label\". \n \tNotSelector
3541                                 = \"has(my_label)\" matches packets that are not from
3542                                 Calico-controlled \tendpoints that do have the label \"my_label\".
3543                                 \n The effect is that the latter will accept packets from
3544                                 non-Calico sources whereas the former is limited to packets
3545                                 from Calico-controlled endpoints."
3546                               type: string
3547                             serviceAccounts:
3548                               description: ServiceAccounts is an optional field that restricts
3549                                 the rule to only apply to traffic that originates from
3550                                 (or terminates at) a pod running as a matching service
3551                                 account.
3552                               properties:
3553                                 names:
3554                                   description: Names is an optional field that restricts
3555                                     the rule to only apply to traffic that originates
3556                                     from (or terminates at) a pod running as a service
3557                                     account whose name is in the list.
3558                                   items:
3559                                     type: string
3560                                   type: array
3561                                 selector:
3562                                   description: Selector is an optional field that restricts
3563                                     the rule to only apply to traffic that originates
3564                                     from (or terminates at) a pod running as a service
3565                                     account that matches the given label selector. If
3566                                     both Names and Selector are specified then they are
3567                                     AND'ed.
3568                                   type: string
3569                               type: object
3570                             services:
3571                               description: "Services is an optional field that contains
3572                                 options for matching Kubernetes Services. If specified,
3573                                 only traffic that originates from or terminates at endpoints
3574                                 within the selected service(s) will be matched, and only
3575                                 to/from each endpoint's port. \n Services cannot be specified
3576                                 on the same rule as Selector, NotSelector, NamespaceSelector,
3577                                 Nets, NotNets or ServiceAccounts. \n Ports and NotPorts
3578                                 can only be specified with Services on ingress rules."
3579                               properties:
3580                                 name:
3581                                   description: Name specifies the name of a Kubernetes
3582                                     Service to match.
3583                                   type: string
3584                                 namespace:
3585                                   description: Namespace specifies the namespace of the
3586                                     given Service. If left empty, the rule will match
3587                                     within this policy's namespace.
3588                                   type: string
3589                               type: object
3590                           type: object
3591                       required:
3592                       - action
3593                       type: object
3594                     type: array
3595                   order:
3596                     description: Order is an optional field that specifies the order in
3597                       which the policy is applied. Policies with higher "order" are applied
3598                       after those with lower order.  If the order is omitted, it may be
3599                       considered to be "infinite" - i.e. the policy will be applied last.  Policies
3600                       with identical order will be applied in alphanumerical order based
3601                       on the Policy "Name".
3602                     type: number
3603                   selector:
3604                     description: "The selector is an expression used to pick pick out
3605                       the endpoints that the policy should be applied to. \n Selector
3606                       expressions follow this syntax: \n \tlabel == \"string_literal\"
3607                       \ ->  comparison, e.g. my_label == \"foo bar\" \tlabel != \"string_literal\"
3608                       \  ->  not equal; also matches if label is not present \tlabel in
3609                       { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
3610                       one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
3611                       ... }  ->  true if the value of label X is not one of \"a\", \"b\",
3612                       \"c\" \thas(label_name)  -> True if that label is present \t! expr
3613                       -> negation of expr \texpr && expr  -> Short-circuit and \texpr
3614                       || expr  -> Short-circuit or \t( expr ) -> parens for grouping \tall()
3615                       or the empty selector -> matches all endpoints. \n Label names are
3616                       allowed to contain alphanumerics, -, _ and /. String literals are
3617                       more permissive but they do not support escape characters. \n Examples
3618                       (with made-up labels): \n \ttype == \"webserver\" && deployment
3619                       == \"prod\" \ttype in {\"frontend\", \"backend\"} \tdeployment !=
3620                       \"dev\" \t! has(label_name)"
3621                     type: string
3622                   serviceAccountSelector:
3623                     description: ServiceAccountSelector is an optional field for an expression
3624                       used to select a pod based on service accounts.
3625                     type: string
3626                   types:
3627                     description: "Types indicates whether this policy applies to ingress,
3628                       or to egress, or to both.  When not explicitly specified (and so
3629                       the value on creation is empty or nil), Calico defaults Types according
3630                       to what Ingress and Egress are present in the policy.  The default
3631                       is: \n - [ PolicyTypeIngress ], if there are no Egress rules (including
3632                       the case where there are   also no Ingress rules) \n - [ PolicyTypeEgress
3633                       ], if there are Egress rules but no Ingress rules \n - [ PolicyTypeIngress,
3634                       PolicyTypeEgress ], if there are both Ingress and Egress rules.
3635                       \n When the policy is read back again, Types will always be one
3636                       of these values, never empty or nil."
3637                     items:
3638                       description: PolicyType enumerates the possible values of the PolicySpec
3639                         Types field.
3640                       type: string
3641                     type: array
3642                 type: object
3643             type: object
3644         served: true
3645         storage: true
3646     status:
3647       acceptedNames:
3648         kind: ""
3649         plural: ""
3650       conditions: []
3651       storedVersions: []
3652     ---
3653     apiVersion: apiextensions.k8s.io/v1
3654     kind: CustomResourceDefinition
3655     metadata:
3656       name: networksets.crd.projectcalico.org
3657     spec:
3658       group: crd.projectcalico.org
3659       names:
3660         kind: NetworkSet
3661         listKind: NetworkSetList
3662         plural: networksets
3663         singular: networkset
3664       scope: Namespaced
3665       versions:
3666       - name: v1
3667         schema:
3668           openAPIV3Schema:
3669             description: NetworkSet is the Namespaced-equivalent of the GlobalNetworkSet.
3670             properties:
3671               apiVersion:
3672                 description: 'APIVersion defines the versioned schema of this representation
3673                   of an object. Servers should convert recognized schemas to the latest
3674                   internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
3675                 type: string
3676               kind:
3677                 description: 'Kind is a string value representing the REST resource this
3678                   object represents. Servers may infer this from the endpoint the client
3679                   submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
3680                 type: string
3681               metadata:
3682                 type: object
3683               spec:
3684                 description: NetworkSetSpec contains the specification for a NetworkSet
3685                   resource.
3686                 properties:
3687                   nets:
3688                     description: The list of IP networks that belong to this set.
3689                     items:
3690                       type: string
3691                     type: array
3692                 type: object
3693             type: object
3694         served: true
3695         storage: true
3696     status:
3697       acceptedNames:
3698         kind: ""
3699         plural: ""
3700       conditions: []
3701       storedVersions: []
3702     ---
3703     apiVersion: v1
3704     kind: ServiceAccount
3705     metadata:
3706       name: calico-kube-controllers
3707       namespace: kube-system
3708     ---
3709     apiVersion: v1
3710     kind: ServiceAccount
3711     metadata:
3712       name: calico-node
3713       namespace: kube-system
3714     ---
3715     apiVersion: rbac.authorization.k8s.io/v1
3716     kind: ClusterRole
3717     metadata:
3718       name: calico-kube-controllers
3719     rules:
3720     - apiGroups:
3721       - ""
3722       resources:
3723       - nodes
3724       verbs:
3725       - watch
3726       - list
3727       - get
3728     - apiGroups:
3729       - ""
3730       resources:
3731       - pods
3732       verbs:
3733       - get
3734       - list
3735       - watch
3736     - apiGroups:
3737       - crd.projectcalico.org
3738       resources:
3739       - ippools
3740       - ipreservations
3741       verbs:
3742       - list
3743     - apiGroups:
3744       - crd.projectcalico.org
3745       resources:
3746       - blockaffinities
3747       - ipamblocks
3748       - ipamhandles
3749       verbs:
3750       - get
3751       - list
3752       - create
3753       - update
3754       - delete
3755       - watch
3756     - apiGroups:
3757       - crd.projectcalico.org
3758       resources:
3759       - hostendpoints
3760       verbs:
3761       - get
3762       - list
3763       - create
3764       - update
3765       - delete
3766     - apiGroups:
3767       - crd.projectcalico.org
3768       resources:
3769       - clusterinformations
3770       verbs:
3771       - get
3772       - create
3773       - update
3774     - apiGroups:
3775       - crd.projectcalico.org
3776       resources:
3777       - kubecontrollersconfigurations
3778       verbs:
3779       - get
3780       - create
3781       - update
3782       - watch
3783     ---
3784     apiVersion: rbac.authorization.k8s.io/v1
3785     kind: ClusterRole
3786     metadata:
3787       name: calico-node
3788     rules:
3789     - apiGroups:
3790       - ""
3791       resources:
3792       - pods
3793       - nodes
3794       - namespaces
3795       verbs:
3796       - get
3797     - apiGroups:
3798       - discovery.k8s.io
3799       resources:
3800       - endpointslices
3801       verbs:
3802       - watch
3803       - list
3804     - apiGroups:
3805       - ""
3806       resources:
3807       - endpoints
3808       - services
3809       verbs:
3810       - watch
3811       - list
3812       - get
3813     - apiGroups:
3814       - ""
3815       resources:
3816       - configmaps
3817       verbs:
3818       - get
3819     - apiGroups:
3820       - ""
3821       resources:
3822       - nodes/status
3823       verbs:
3824       - patch
3825       - update
3826     - apiGroups:
3827       - networking.k8s.io
3828       resources:
3829       - networkpolicies
3830       verbs:
3831       - watch
3832       - list
3833     - apiGroups:
3834       - ""
3835       resources:
3836       - pods
3837       - namespaces
3838       - serviceaccounts
3839       verbs:
3840       - list
3841       - watch
3842     - apiGroups:
3843       - ""
3844       resources:
3845       - pods/status
3846       verbs:
3847       - patch
3848     - apiGroups:
3849       - crd.projectcalico.org
3850       resources:
3851       - globalfelixconfigs
3852       - felixconfigurations
3853       - bgppeers
3854       - globalbgpconfigs
3855       - bgpconfigurations
3856       - ippools
3857       - ipreservations
3858       - ipamblocks
3859       - globalnetworkpolicies
3860       - globalnetworksets
3861       - networkpolicies
3862       - networksets
3863       - clusterinformations
3864       - hostendpoints
3865       - blockaffinities
3866       - caliconodestatuses
3867       verbs:
3868       - get
3869       - list
3870       - watch
3871     - apiGroups:
3872       - crd.projectcalico.org
3873       resources:
3874       - ippools
3875       - felixconfigurations
3876       - clusterinformations
3877       verbs:
3878       - create
3879       - update
3880     - apiGroups:
3881       - crd.projectcalico.org
3882       resources:
3883       - caliconodestatuses
3884       verbs:
3885       - update
3886     - apiGroups:
3887       - ""
3888       resources:
3889       - nodes
3890       verbs:
3891       - get
3892       - list
3893       - watch
3894     - apiGroups:
3895       - crd.projectcalico.org
3896       resources:
3897       - bgpconfigurations
3898       - bgppeers
3899       verbs:
3900       - create
3901       - update
3902     - apiGroups:
3903       - crd.projectcalico.org
3904       resources:
3905       - blockaffinities
3906       - ipamblocks
3907       - ipamhandles
3908       verbs:
3909       - get
3910       - list
3911       - create
3912       - update
3913       - delete
3914     - apiGroups:
3915       - crd.projectcalico.org
3916       resources:
3917       - ipamconfigs
3918       verbs:
3919       - get
3920     - apiGroups:
3921       - crd.projectcalico.org
3922       resources:
3923       - blockaffinities
3924       verbs:
3925       - watch
3926     - apiGroups:
3927       - apps
3928       resources:
3929       - daemonsets
3930       verbs:
3931       - get
3932     ---
3933     apiVersion: rbac.authorization.k8s.io/v1
3934     kind: ClusterRoleBinding
3935     metadata:
3936       name: calico-kube-controllers
3937     roleRef:
3938       apiGroup: rbac.authorization.k8s.io
3939       kind: ClusterRole
3940       name: calico-kube-controllers
3941     subjects:
3942     - kind: ServiceAccount
3943       name: calico-kube-controllers
3944       namespace: kube-system
3945     ---
3946     apiVersion: rbac.authorization.k8s.io/v1
3947     kind: ClusterRoleBinding
3948     metadata:
3949       name: calico-node
3950     roleRef:
3951       apiGroup: rbac.authorization.k8s.io
3952       kind: ClusterRole
3953       name: calico-node
3954     subjects:
3955     - kind: ServiceAccount
3956       name: calico-node
3957       namespace: kube-system
3958     ---
3959     apiVersion: v1
3960     data:
3961       calico_backend: bird
3962       cni_network_config: |-
3963         {
3964           "name": "k8s-pod-network",
3965           "cniVersion": "0.3.1",
3966           "plugins": [
3967             {
3968               "type": "calico",
3969               "log_level": "info",
3970               "log_file_path": "/var/log/calico/cni/cni.log",
3971               "datastore_type": "kubernetes",
3972               "nodename": "__KUBERNETES_NODE_NAME__",
3973               "mtu": __CNI_MTU__,
3974               "ipam": {
3975                   "type": "calico-ipam"
3976               },
3977               "policy": {
3978                   "type": "k8s"
3979               },
3980               "kubernetes": {
3981                   "kubeconfig": "__KUBECONFIG_FILEPATH__"
3982               }
3983             },
3984             {
3985               "type": "portmap",
3986               "snat": true,
3987               "capabilities": {"portMappings": true}
3988             },
3989             {
3990               "type": "bandwidth",
3991               "capabilities": {"bandwidth": true}
3992             }
3993           ]
3994         }
3995       typha_service_name: none
3996       veth_mtu: "0"
3997     kind: ConfigMap
3998     metadata:
3999       name: calico-config
4000       namespace: kube-system
4001     ---
4002     apiVersion: apps/v1
4003     kind: Deployment
4004     metadata:
4005       labels:
4006         k8s-app: calico-kube-controllers
4007       name: calico-kube-controllers
4008       namespace: kube-system
4009     spec:
4010       replicas: 1
4011       selector:
4012         matchLabels:
4013           k8s-app: calico-kube-controllers
4014       strategy:
4015         type: Recreate
4016       template:
4017         metadata:
4018           labels:
4019             k8s-app: calico-kube-controllers
4020           name: calico-kube-controllers
4021           namespace: kube-system
4022         spec:
4023           containers:
4024           - env:
4025             - name: ENABLED_CONTROLLERS
4026               value: node
4027             - name: DATASTORE_TYPE
4028               value: kubernetes
4029             image: docker.io/calico/kube-controllers:v3.22.0
4030             livenessProbe:
4031               exec:
4032                 command:
4033                 - /usr/bin/check-status
4034                 - -l
4035               failureThreshold: 6
4036               initialDelaySeconds: 10
4037               periodSeconds: 10
4038               timeoutSeconds: 10
4039             name: calico-kube-controllers
4040             readinessProbe:
4041               exec:
4042                 command:
4043                 - /usr/bin/check-status
4044                 - -r
4045               periodSeconds: 10
4046           nodeSelector:
4047             kubernetes.io/os: linux
4048           priorityClassName: system-cluster-critical
4049           serviceAccountName: calico-kube-controllers
4050           tolerations:
4051           - key: CriticalAddonsOnly
4052             operator: Exists
4053           - effect: NoSchedule
4054             key: node-role.kubernetes.io/master
4055     ---
4056     apiVersion: policy/v1beta1
4057     kind: PodDisruptionBudget
4058     metadata:
4059       labels:
4060         k8s-app: calico-kube-controllers
4061       name: calico-kube-controllers
4062       namespace: kube-system
4063     spec:
4064       maxUnavailable: 1
4065       selector:
4066         matchLabels:
4067           k8s-app: calico-kube-controllers
4068     ---
4069     apiVersion: apps/v1
4070     kind: DaemonSet
4071     metadata:
4072       labels:
4073         k8s-app: calico-node
4074       name: calico-node
4075       namespace: kube-system
4076     spec:
4077       selector:
4078         matchLabels:
4079           k8s-app: calico-node
4080       template:
4081         metadata:
4082           labels:
4083             k8s-app: calico-node
4084         spec:
4085           containers:
4086           - env:
4087             - name: IP_AUTODETECTION_METHOD
4088               value: can-reach=www.google.com
4089             - name: DATASTORE_TYPE
4090               value: kubernetes
4091             - name: WAIT_FOR_DATASTORE
4092               value: "true"
4093             - name: NODENAME
4094               valueFrom:
4095                 fieldRef:
4096                   fieldPath: spec.nodeName
4097             - name: CALICO_NETWORKING_BACKEND
4098               valueFrom:
4099                 configMapKeyRef:
4100                   key: calico_backend
4101                   name: calico-config
4102             - name: CLUSTER_TYPE
4103               value: k8s,bgp
4104             - name: IP
4105               value: autodetect
4106             - name: CALICO_IPV4POOL_IPIP
4107               value: Always
4108             - name: CALICO_IPV4POOL_VXLAN
4109               value: Never
4110             - name: FELIX_IPINIPMTU
4111               valueFrom:
4112                 configMapKeyRef:
4113                   key: veth_mtu
4114                   name: calico-config
4115             - name: FELIX_VXLANMTU
4116               valueFrom:
4117                 configMapKeyRef:
4118                   key: veth_mtu
4119                   name: calico-config
4120             - name: FELIX_WIREGUARDMTU
4121               valueFrom:
4122                 configMapKeyRef:
4123                   key: veth_mtu
4124                   name: calico-config
4125             - name: CALICO_DISABLE_FILE_LOGGING
4126               value: "true"
4127             - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
4128               value: ACCEPT
4129             - name: FELIX_IPV6SUPPORT
4130               value: "false"
4131             - name: FELIX_HEALTHENABLED
4132               value: "true"
4133             envFrom:
4134             - configMapRef:
4135                 name: kubernetes-services-endpoint
4136                 optional: true
4137             image: docker.io/calico/node:v3.22.0
4138             lifecycle:
4139               preStop:
4140                 exec:
4141                   command:
4142                   - /bin/calico-node
4143                   - -shutdown
4144             livenessProbe:
4145               exec:
4146                 command:
4147                 - /bin/calico-node
4148                 - -felix-live
4149                 - -bird-live
4150               failureThreshold: 6
4151               initialDelaySeconds: 10
4152               periodSeconds: 10
4153               timeoutSeconds: 10
4154             name: calico-node
4155             readinessProbe:
4156               exec:
4157                 command:
4158                 - /bin/calico-node
4159                 - -felix-ready
4160                 - -bird-ready
4161               periodSeconds: 10
4162               timeoutSeconds: 10
4163             resources:
4164               requests:
4165                 cpu: 250m
4166             securityContext:
4167               privileged: true
4168             volumeMounts:
4169             - mountPath: /host/etc/cni/net.d
4170               name: cni-net-dir
4171               readOnly: false
4172             - mountPath: /lib/modules
4173               name: lib-modules
4174               readOnly: true
4175             - mountPath: /run/xtables.lock
4176               name: xtables-lock
4177               readOnly: false
4178             - mountPath: /var/run/calico
4179               name: var-run-calico
4180               readOnly: false
4181             - mountPath: /var/lib/calico
4182               name: var-lib-calico
4183               readOnly: false
4184             - mountPath: /var/run/nodeagent
4185               name: policysync
4186             - mountPath: /sys/fs/
4187               mountPropagation: Bidirectional
4188               name: sysfs
4189             - mountPath: /var/log/calico/cni
4190               name: cni-log-dir
4191               readOnly: true
4192           hostNetwork: true
4193           initContainers:
4194           - command:
4195             - /opt/cni/bin/calico-ipam
4196             - -upgrade
4197             env:
4198             - name: KUBERNETES_NODE_NAME
4199               valueFrom:
4200                 fieldRef:
4201                   fieldPath: spec.nodeName
4202             - name: CALICO_NETWORKING_BACKEND
4203               valueFrom:
4204                 configMapKeyRef:
4205                   key: calico_backend
4206                   name: calico-config
4207             envFrom:
4208             - configMapRef:
4209                 name: kubernetes-services-endpoint
4210                 optional: true
4211             image: docker.io/calico/cni:v3.22.0
4212             name: upgrade-ipam
4213             securityContext:
4214               privileged: true
4215             volumeMounts:
4216             - mountPath: /var/lib/cni/networks
4217               name: host-local-net-dir
4218             - mountPath: /host/opt/cni/bin
4219               name: cni-bin-dir
4220           - command:
4221             - /opt/cni/bin/install
4222             env:
4223             - name: CNI_CONF_NAME
4224               value: 10-calico.conflist
4225             - name: CNI_NETWORK_CONFIG
4226               valueFrom:
4227                 configMapKeyRef:
4228                   key: cni_network_config
4229                   name: calico-config
4230             - name: KUBERNETES_NODE_NAME
4231               valueFrom:
4232                 fieldRef:
4233                   fieldPath: spec.nodeName
4234             - name: CNI_MTU
4235               valueFrom:
4236                 configMapKeyRef:
4237                   key: veth_mtu
4238                   name: calico-config
4239             - name: SLEEP
4240               value: "false"
4241             envFrom:
4242             - configMapRef:
4243                 name: kubernetes-services-endpoint
4244                 optional: true
4245             image: docker.io/calico/cni:v3.22.0
4246             name: install-cni
4247             securityContext:
4248               privileged: true
4249             volumeMounts:
4250             - mountPath: /host/opt/cni/bin
4251               name: cni-bin-dir
4252             - mountPath: /host/etc/cni/net.d
4253               name: cni-net-dir
4254           - image: docker.io/calico/pod2daemon-flexvol:v3.22.0
4255             name: flexvol-driver
4256             securityContext:
4257               privileged: true
4258             volumeMounts:
4259             - mountPath: /host/driver
4260               name: flexvol-driver-host
4261           nodeSelector:
4262             kubernetes.io/os: linux
4263           priorityClassName: system-node-critical
4264           serviceAccountName: calico-node
4265           terminationGracePeriodSeconds: 0
4266           tolerations:
4267           - effect: NoSchedule
4268             operator: Exists
4269           - key: CriticalAddonsOnly
4270             operator: Exists
4271           - effect: NoExecute
4272             operator: Exists
4273           volumes:
4274           - hostPath:
4275               path: /lib/modules
4276             name: lib-modules
4277           - hostPath:
4278               path: /var/run/calico
4279             name: var-run-calico
4280           - hostPath:
4281               path: /var/lib/calico
4282             name: var-lib-calico
4283           - hostPath:
4284               path: /run/xtables.lock
4285               type: FileOrCreate
4286             name: xtables-lock
4287           - hostPath:
4288               path: /sys/fs/
4289               type: DirectoryOrCreate
4290             name: sysfs
4291           - hostPath:
4292               path: /opt/cni/bin
4293             name: cni-bin-dir
4294           - hostPath:
4295               path: /etc/cni/net.d
4296             name: cni-net-dir
4297           - hostPath:
4298               path: /var/log/calico/cni
4299             name: cni-log-dir
4300           - hostPath:
4301               path: /var/lib/cni/networks
4302             name: host-local-net-dir
4303           - hostPath:
4304               path: /var/run/nodeagent
4305               type: DirectoryOrCreate
4306             name: policysync
4307           - hostPath:
4308               path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
4309               type: DirectoryOrCreate
4310             name: flexvol-driver-host
4311       updateStrategy:
4312         rollingUpdate:
4313           maxUnavailable: 1
4314         type: RollingUpdate
4315 kind: ConfigMap
4316 metadata:
4317   creationTimestamp: null
4318   name: {{ .Values.clusterName }}-calico-addon
4319 {{- end }}