src/foundation/scripts/cni/cilium/quick-install.yaml

   1 # yamllint disable rule:hyphens rule:commas rule:indentation rule:line-length rule:comments rule:comments-indentation
   2 ---
   3 # Source: cilium/charts/config/templates/configmap.yaml
   4 apiVersion: v1
   5 kind: ConfigMap
   6 metadata:
   7   name: cilium-config
   8   namespace: kube-system
   9 data:
  10
  11   # Identity allocation mode selects how identities are shared between cilium
  12   # nodes by setting how they are stored. The options are "crd" or "kvstore".
  13   # - "crd" stores identities in kubernetes as CRDs (custom resource definition).
  14   #   These can be queried with:
  15   #     kubectl get ciliumid
  16   # - "kvstore" stores identities in a kvstore, etcd or consul, that is
  17   #   configured below. Cilium versions before 1.6 supported only the kvstore
  18   #   backend. Upgrades from these older cilium versions should continue using
  19   #   the kvstore by commenting out the identity-allocation-mode below, or
  20   #   setting it to "kvstore".
  21   identity-allocation-mode: crd
  22
  23   # If you want to run cilium in debug mode change this value to true
  24   debug: "true"
  25
  26   # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
  27   # address.
  28   enable-ipv4: "true"
  29
  30   # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
  31   # address.
  32   enable-ipv6: "false"
  33
  34   # If you want cilium monitor to aggregate tracing for packets, set this level
  35   # to "low", "medium", or "maximum". The higher the level, the less packets
  36   # that will be seen in monitor output.
  37   monitor-aggregation: medium
  38
  39   # ct-global-max-entries-* specifies the maximum number of connections
  40   # supported across all endpoints, split by protocol: tcp or other. One pair
  41   # of maps uses these values for IPv4 connections, and another pair of maps
  42   # use these values for IPv6 connections.
  43   #
  44   # If these values are modified, then during the next Cilium startup the
  45   # tracking of ongoing connections may be disrupted. This may lead to brief
  46   # policy drops or a change in loadbalancing decisions for a connection.
  47   #
  48   # For users upgrading from Cilium 1.2 or earlier, to minimize disruption
  49   # during the upgrade process, comment out these options.
  50   bpf-ct-global-tcp-max: "524288"
  51   bpf-ct-global-any-max: "262144"
  52
  53   # Pre-allocation of map entries allows per-packet latency to be reduced, at
  54   # the expense of up-front memory allocation for the entries in the maps. The
  55   # default value below will minimize memory usage in the default installation;
  56   # users who are sensitive to latency may consider setting this to "true".
  57   #
  58   # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
  59   # this option and behave as though it is set to "true".
  60   #
  61   # If this value is modified, then during the next Cilium startup the restore
  62   # of existing endpoints and tracking of ongoing connections may be disrupted.
  63   # This may lead to policy drops or a change in loadbalancing decisions for a
  64   # connection for some time. Endpoints may need to be recreated to restore
  65   # connectivity.
  66   #
  67   # If this option is set to "false" during an upgrade from 1.3 or earlier to
  68   # 1.4 or later, then it may cause one-time disruptions during the upgrade.
  69   preallocate-bpf-maps: "false"
  70
  71   # Regular expression matching compatible Istio sidecar istio-proxy
  72   # container image names
  73   sidecar-istio-proxy-image: "cilium/istio_proxy"
  74
  75   # Encapsulation mode for communication between nodes
  76   # Possible values:
  77   #   - disabled
  78   #   - vxlan (default)
  79   #   - geneve
  80   tunnel: vxlan
  81
  82   # Name of the cluster. Only relevant when building a mesh of clusters.
  83   cluster-name: default
  84
  85   # DNS Polling periodically issues a DNS lookup for each `matchName` from
  86   # cilium-agent. The result is used to regenerate endpoint policy.
  87   # DNS lookups are repeated with an interval of 5 seconds, and are made for
  88   # A(IPv4) and AAAA(IPv6) addresses. Should a lookup fail, the most recent IP
  89   # data is used instead. An IP change will trigger a regeneration of the Cilium
  90   # policy for each endpoint and increment the per cilium-agent policy
  91   # repository revision.
  92   #
  93   # This option is disabled by default starting from version 1.4.x in favor
  94   # of a more powerful DNS proxy-based implementation, see [0] for details.
  95   # Enable this option if you want to use FQDN policies but do not want to use
  96   # the DNS proxy.
  97   #
  98   # To ease upgrade, users may opt to set this option to "true".
  99   # Otherwise please refer to the Upgrade Guide [1] which explains how to
 100   # prepare policy rules for upgrade.
 101   #
 102   # [0] http://docs.cilium.io/en/stable/policy/language/#dns-based
 103   # [1] http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action
 104   tofqdns-enable-poller: "false"
 105
 106   # wait-bpf-mount makes init container wait until bpf filesystem is mounted
 107   wait-bpf-mount: "false"
 108
 109   # Enable fetching of container-runtime specific metadata
 110   #
 111   # By default, the Kubernetes pod and namespace labels are retrieved and
 112   # associated with endpoints for identification purposes. By integrating
 113   # with the container runtime, container runtime specific labels can be
 114   # retrieved, such labels will be prefixed with container:
 115   #
 116   # CAUTION: The container runtime labels can include information such as pod
 117   # annotations which may result in each pod being associated a unique set of
 118   # labels which can result in excessive security identities being allocated.
 119   # Please review the labels filter when enabling container runtime labels.
 120   #
 121   # Supported values:
 122   # - containerd
 123   # - crio
 124   # - docker
 125   # - none
 126   # - auto (automatically detect the container runtime)
 127   #
 128   container-runtime: none
 129
 130   masquerade: "true"
 131
 132   install-iptables-rules: "true"
 133   auto-direct-node-routes: "false"
 134   enable-node-port: "false"
 135
 136 ---
 137 # Source: cilium/charts/agent/templates/serviceaccount.yaml
 138 apiVersion: v1
 139 kind: ServiceAccount
 140 metadata:
 141   name: cilium
 142   namespace: kube-system
 143
 144 ---
 145 # Source: cilium/charts/operator/templates/serviceaccount.yaml
 146 apiVersion: v1
 147 kind: ServiceAccount
 148 metadata:
 149   name: cilium-operator
 150   namespace: kube-system
 151
 152 ---
 153 # Source: cilium/charts/agent/templates/clusterrole.yaml
 154 apiVersion: rbac.authorization.k8s.io/v1
 155 kind: ClusterRole
 156 metadata:
 157   name: cilium
 158 rules:
 159 - apiGroups:
 160   - networking.k8s.io
 161   resources:
 162   - networkpolicies
 163   verbs:
 164   - get
 165   - list
 166   - watch
 167 - apiGroups:
 168   - ""
 169   resources:
 170   - namespaces
 171   - services
 172   - nodes
 173   - endpoints
 174   verbs:
 175   - get
 176   - list
 177   - watch
 178 - apiGroups:
 179   - ""
 180   resources:
 181   - pods
 182   - nodes
 183   verbs:
 184   - get
 185   - list
 186   - watch
 187   - update
 188 - apiGroups:
 189   - ""
 190   resources:
 191   - nodes
 192   - nodes/status
 193   verbs:
 194   - patch
 195 - apiGroups:
 196   - extensions
 197   resources:
 198   - ingresses
 199   verbs:
 200   - create
 201   - get
 202   - list
 203   - watch
 204 - apiGroups:
 205   - apiextensions.k8s.io
 206   resources:
 207   - customresourcedefinitions
 208   verbs:
 209   - create
 210   - get
 211   - list
 212   - watch
 213   - update
 214 - apiGroups:
 215   - cilium.io
 216   resources:
 217   - ciliumnetworkpolicies
 218   - ciliumnetworkpolicies/status
 219   - ciliumendpoints
 220   - ciliumendpoints/status
 221   - ciliumnodes
 222   - ciliumnodes/status
 223   - ciliumidentities
 224   - ciliumidentities/status
 225   verbs:
 226   - '*'
 227
 228 ---
 229 # Source: cilium/charts/operator/templates/clusterrole.yaml
 230 apiVersion: rbac.authorization.k8s.io/v1
 231 kind: ClusterRole
 232 metadata:
 233   name: cilium-operator
 234 rules:
 235 - apiGroups:
 236   - ""
 237   resources:
 238   # to automatically delete [core|kube]dns pods so that are starting to being
 239   # managed by Cilium
 240   - pods
 241   verbs:
 242   - get
 243   - list
 244   - watch
 245   - delete
 246 - apiGroups:
 247   - ""
 248   resources:
 249   # to automatically read from k8s and import the node's pod CIDR to cilium's
 250   # etcd so all nodes know how to reach another pod running in in a different
 251   # node.
 252   - nodes
 253   # to perform the translation of a CNP that contains `ToGroup` to its endpoints
 254   - services
 255   - endpoints
 256   # to check apiserver connectivity
 257   - namespaces
 258   verbs:
 259   - get
 260   - list
 261   - watch
 262 - apiGroups:
 263   - cilium.io
 264   resources:
 265   - ciliumnetworkpolicies
 266   - ciliumnetworkpolicies/status
 267   - ciliumendpoints
 268   - ciliumendpoints/status
 269   - ciliumnodes
 270   - ciliumnodes/status
 271   - ciliumidentities
 272   - ciliumidentities/status
 273   verbs:
 274   - '*'
 275
 276 ---
 277 # Source: cilium/charts/agent/templates/clusterrolebinding.yaml
 278 apiVersion: rbac.authorization.k8s.io/v1
 279 kind: ClusterRoleBinding
 280 metadata:
 281   name: cilium
 282 roleRef:
 283   apiGroup: rbac.authorization.k8s.io
 284   kind: ClusterRole
 285   name: cilium
 286 subjects:
 287 - kind: ServiceAccount
 288   name: cilium
 289   namespace: kube-system
 290
 291 ---
 292 # Source: cilium/charts/operator/templates/clusterrolebinding.yaml
 293 apiVersion: rbac.authorization.k8s.io/v1
 294 kind: ClusterRoleBinding
 295 metadata:
 296   name: cilium-operator
 297 roleRef:
 298   apiGroup: rbac.authorization.k8s.io
 299   kind: ClusterRole
 300   name: cilium-operator
 301 subjects:
 302 - kind: ServiceAccount
 303   name: cilium-operator
 304   namespace: kube-system
 305
 306 ---
 307 # Source: cilium/charts/agent/templates/daemonset.yaml
 308 apiVersion: apps/v1
 309 kind: DaemonSet
 310 metadata:
 311   labels:
 312     k8s-app: cilium
 313     kubernetes.io/cluster-service: "true"
 314   name: cilium
 315   namespace: kube-system
 316 spec:
 317   selector:
 318     matchLabels:
 319       k8s-app: cilium
 320       kubernetes.io/cluster-service: "true"
 321   template:
 322     metadata:
 323       annotations:
 324         # This annotation plus the CriticalAddonsOnly toleration makes
 325         # cilium to be a critical pod in the cluster, which ensures cilium
 326         # gets priority scheduling.
 327         # https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
 328         scheduler.alpha.kubernetes.io/critical-pod: ""
 329         scheduler.alpha.kubernetes.io/tolerations: '[{"key":"dedicated","operator":"Equal","value":"master","effect":"NoSchedule"}]'
 330       labels:
 331         k8s-app: cilium
 332         kubernetes.io/cluster-service: "true"
 333     spec:
 334       containers:
 335       - args:
 336         - --config-dir=/tmp/cilium/config-map
 337         command:
 338         - cilium-agent
 339         env:
 340         - name: K8S_NODE_NAME
 341           valueFrom:
 342             fieldRef:
 343               apiVersion: v1
 344               fieldPath: spec.nodeName
 345         - name: CILIUM_K8S_NAMESPACE
 346           valueFrom:
 347             fieldRef:
 348               apiVersion: v1
 349               fieldPath: metadata.namespace
 350         - name: CILIUM_FLANNEL_MASTER_DEVICE
 351           valueFrom:
 352             configMapKeyRef:
 353               key: flannel-master-device
 354               name: cilium-config
 355               optional: true
 356         - name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT
 357           valueFrom:
 358             configMapKeyRef:
 359               key: flannel-uninstall-on-exit
 360               name: cilium-config
 361               optional: true
 362         - name: CILIUM_CLUSTERMESH_CONFIG
 363           value: /var/lib/cilium/clustermesh/
 364         - name: CILIUM_CNI_CHAINING_MODE
 365           valueFrom:
 366             configMapKeyRef:
 367               key: cni-chaining-mode
 368               name: cilium-config
 369               optional: true
 370         - name: CILIUM_CUSTOM_CNI_CONF
 371           valueFrom:
 372             configMapKeyRef:
 373               key: custom-cni-conf
 374               name: cilium-config
 375               optional: true
 376         image: "iecedge/cilium:latest"
 377         imagePullPolicy: IfNotPresent
 378         lifecycle:
 379           postStart:
 380             exec:
 381               command:
 382               - /cni-install.sh
 383           preStop:
 384             exec:
 385               command:
 386               - /cni-uninstall.sh
 387         livenessProbe:
 388           exec:
 389             command:
 390             - cilium
 391             - status
 392             - --brief
 393           failureThreshold: 10
 394           # The initial delay for the liveness probe is intentionally large to
 395           # avoid an endless kill & restart cycle if in the event that the initial
 396           # bootstrapping takes longer than expected.
 397           initialDelaySeconds: 120
 398           periodSeconds: 30
 399           successThreshold: 1
 400           timeoutSeconds: 5
 401         name: cilium-agent
 402         readinessProbe:
 403           exec:
 404             command:
 405             - cilium
 406             - status
 407             - --brief
 408           failureThreshold: 3
 409           initialDelaySeconds: 5
 410           periodSeconds: 30
 411           successThreshold: 1
 412           timeoutSeconds: 5
 413         securityContext:
 414           capabilities:
 415             add:
 416             - NET_ADMIN
 417             - SYS_MODULE
 418           privileged: true
 419         volumeMounts:
 420         - mountPath: /sys/fs/bpf
 421           name: bpf-maps
 422         - mountPath: /var/run/cilium
 423           name: cilium-run
 424         - mountPath: /host/opt/cni/bin
 425           name: cni-path
 426         - mountPath: /host/etc/cni/net.d
 427           name: etc-cni-netd
 428         - mountPath: /var/lib/cilium/clustermesh
 429           name: clustermesh-secrets
 430           readOnly: true
 431         - mountPath: /tmp/cilium/config-map
 432           name: cilium-config-path
 433           readOnly: true
 434           # Needed to be able to load kernel modules
 435         - mountPath: /lib/modules
 436           name: lib-modules
 437           readOnly: true
 438         - mountPath: /run/xtables.lock
 439           name: xtables-lock
 440       hostNetwork: true
 441       initContainers:
 442       - command:
 443         - /init-container.sh
 444         env:
 445         - name: CILIUM_ALL_STATE
 446           valueFrom:
 447             configMapKeyRef:
 448               key: clean-cilium-state
 449               name: cilium-config
 450               optional: true
 451         - name: CILIUM_BPF_STATE
 452           valueFrom:
 453             configMapKeyRef:
 454               key: clean-cilium-bpf-state
 455               name: cilium-config
 456               optional: true
 457         - name: CILIUM_WAIT_BPF_MOUNT
 458           valueFrom:
 459             configMapKeyRef:
 460               key: wait-bpf-mount
 461               name: cilium-config
 462               optional: true
 463         image: "iecedge/cilium:latest"
 464         imagePullPolicy: IfNotPresent
 465         name: clean-cilium-state
 466         securityContext:
 467           capabilities:
 468             add:
 469             - NET_ADMIN
 470           privileged: true
 471         volumeMounts:
 472         - mountPath: /sys/fs/bpf
 473           name: bpf-maps
 474         - mountPath: /var/run/cilium
 475           name: cilium-run
 476       restartPolicy: Always
 477       serviceAccount: cilium
 478       serviceAccountName: cilium
 479       terminationGracePeriodSeconds: 1
 480       tolerations:
 481       - operator: Exists
 482       volumes:
 483         # To keep state between restarts / upgrades
 484       - hostPath:
 485           path: /var/run/cilium
 486           type: DirectoryOrCreate
 487         name: cilium-run
 488         # To keep state between restarts / upgrades for bpf maps
 489       - hostPath:
 490           path: /sys/fs/bpf
 491           type: DirectoryOrCreate
 492         name: bpf-maps
 493       # To install cilium cni plugin in the host
 494       - hostPath:
 495           path: /opt/cni/bin
 496           type: DirectoryOrCreate
 497         name: cni-path
 498         # To install cilium cni configuration in the host
 499       - hostPath:
 500           path: /etc/cni/net.d
 501           type: DirectoryOrCreate
 502         name: etc-cni-netd
 503         # To be able to load kernel modules
 504       - hostPath:
 505           path: /lib/modules
 506         name: lib-modules
 507         # To access iptables concurrently with other processes (e.g. kube-proxy)
 508       - hostPath:
 509           path: /run/xtables.lock
 510           type: FileOrCreate
 511         name: xtables-lock
 512         # To read the clustermesh configuration
 513       - name: clustermesh-secrets
 514         secret:
 515           defaultMode: 420
 516           optional: true
 517           secretName: cilium-clustermesh
 518         # To read the configuration from the config map
 519       - configMap:
 520           name: cilium-config
 521         name: cilium-config-path
 522   updateStrategy:
 523     rollingUpdate:
 524       maxUnavailable: 2
 525     type: RollingUpdate
 526
 527 ---
 528 # Source: cilium/charts/operator/templates/deployment.yaml
 529 apiVersion: apps/v1
 530 kind: Deployment
 531 metadata:
 532   labels:
 533     io.cilium/app: operator
 534     name: cilium-operator
 535   name: cilium-operator
 536   namespace: kube-system
 537 spec:
 538   replicas: 1
 539   selector:
 540     matchLabels:
 541       io.cilium/app: operator
 542       name: cilium-operator
 543   strategy:
 544     rollingUpdate:
 545       maxSurge: 1
 546       maxUnavailable: 1
 547     type: RollingUpdate
 548   template:
 549     metadata:
 550       annotations:
 551       labels:
 552         io.cilium/app: operator
 553         name: cilium-operator
 554     spec:
 555       containers:
 556       - args:
 557         - --debug=$(CILIUM_DEBUG)
 558         - --identity-allocation-mode=$(CILIUM_IDENTITY_ALLOCATION_MODE)
 559         command:
 560         - cilium-operator
 561         env:
 562         - name: CILIUM_K8S_NAMESPACE
 563           valueFrom:
 564             fieldRef:
 565               apiVersion: v1
 566               fieldPath: metadata.namespace
 567         - name: K8S_NODE_NAME
 568           valueFrom:
 569             fieldRef:
 570               apiVersion: v1
 571               fieldPath: spec.nodeName
 572         - name: CILIUM_DEBUG
 573           valueFrom:
 574             configMapKeyRef:
 575               key: debug
 576               name: cilium-config
 577               optional: true
 578         - name: CILIUM_CLUSTER_NAME
 579           valueFrom:
 580             configMapKeyRef:
 581               key: cluster-name
 582               name: cilium-config
 583               optional: true
 584         - name: CILIUM_CLUSTER_ID
 585           valueFrom:
 586             configMapKeyRef:
 587               key: cluster-id
 588               name: cilium-config
 589               optional: true
 590         - name: CILIUM_IPAM
 591           valueFrom:
 592             configMapKeyRef:
 593               key: ipam
 594               name: cilium-config
 595               optional: true
 596         - name: CILIUM_DISABLE_ENDPOINT_CRD
 597           valueFrom:
 598             configMapKeyRef:
 599               key: disable-endpoint-crd
 600               name: cilium-config
 601               optional: true
 602         - name: CILIUM_KVSTORE
 603           valueFrom:
 604             configMapKeyRef:
 605               key: kvstore
 606               name: cilium-config
 607               optional: true
 608         - name: CILIUM_KVSTORE_OPT
 609           valueFrom:
 610             configMapKeyRef:
 611               key: kvstore-opt
 612               name: cilium-config
 613               optional: true
 614         - name: AWS_ACCESS_KEY_ID
 615           valueFrom:
 616             secretKeyRef:
 617               key: AWS_ACCESS_KEY_ID
 618               name: cilium-aws
 619               optional: true
 620         - name: AWS_SECRET_ACCESS_KEY
 621           valueFrom:
 622             secretKeyRef:
 623               key: AWS_SECRET_ACCESS_KEY
 624               name: cilium-aws
 625               optional: true
 626         - name: AWS_DEFAULT_REGION
 627           valueFrom:
 628             secretKeyRef:
 629               key: AWS_DEFAULT_REGION
 630               name: cilium-aws
 631               optional: true
 632         - name: CILIUM_IDENTITY_ALLOCATION_MODE
 633           valueFrom:
 634             configMapKeyRef:
 635               key: identity-allocation-mode
 636               name: cilium-config
 637               optional: true
 638         image: "iecedge/operator:latest"
 639         imagePullPolicy: IfNotPresent
 640         name: cilium-operator
 641         livenessProbe:
 642           httpGet:
 643             path: /healthz
 644             port: 9234
 645             scheme: HTTP
 646           initialDelaySeconds: 60
 647           periodSeconds: 10
 648           timeoutSeconds: 3
 649
 650       hostNetwork: true
 651       restartPolicy: Always
 652       serviceAccount: cilium-operator
 653       serviceAccountName: cilium-operator
 654
 655 ---
 656 # Source: cilium/charts/agent/templates/servicemonitor.yaml
 657
 658 ---
 659 # Source: cilium/charts/agent/templates/svc.yaml
 660
 661 ---
 662 # Source: cilium/charts/operator/templates/servicemonitor.yaml
 663
 664 ---
 665 # Source: cilium/charts/operator/templates/svc.yaml