src/foundation/scripts/cni/cilium/quick-install.yaml

   1 # yamllint disable rule:hyphens rule:commas rule:indentation rule:line-length rule:comments rule:comments-indentation
   2 ---
   3 # Source: cilium/charts/config/templates/configmap.yaml
   4 apiVersion: v1
   5 kind: ConfigMap
   6 metadata:
   7   name: cilium-config
   8   namespace: kube-system
   9 data:
  10
  11   # Identity allocation mode selects how identities are shared between cilium
  12   # nodes by setting how they are stored. The options are "crd" or "kvstore".
  13   # - "crd" stores identities in kubernetes as CRDs (custom resource definition).
  14   #   These can be queried with:
  15   #     kubectl get ciliumid
  16   # - "kvstore" stores identities in a kvstore, etcd or consul, that is
  17   #   configured below. Cilium versions before 1.6 supported only the kvstore
  18   #   backend. Upgrades from these older cilium versions should continue using
  19   #   the kvstore by commenting out the identity-allocation-mode below, or
  20   #   setting it to "kvstore".
  21   identity-allocation-mode: crd
  22
  23   # If you want to run cilium in debug mode change this value to true
  24   debug: "true"
  25
  26   # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
  27   # address.
  28   enable-ipv4: "true"
  29
  30   # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
  31   # address.
  32   enable-ipv6: "false"
  33
  34   # If you want cilium monitor to aggregate tracing for packets, set this level
  35   # to "low", "medium", or "maximum". The higher the level, the less packets
  36   # that will be seen in monitor output.
  37   monitor-aggregation: medium
  38
  39   # ct-global-max-entries-* specifies the maximum number of connections
  40   # supported across all endpoints, split by protocol: tcp or other. One pair
  41   # of maps uses these values for IPv4 connections, and another pair of maps
  42   # use these values for IPv6 connections.
  43   #
  44   # If these values are modified, then during the next Cilium startup the
  45   # tracking of ongoing connections may be disrupted. This may lead to brief
  46   # policy drops or a change in loadbalancing decisions for a connection.
  47   #
  48   # For users upgrading from Cilium 1.2 or earlier, to minimize disruption
  49   # during the upgrade process, comment out these options.
  50   bpf-ct-global-tcp-max: "524288"
  51   bpf-ct-global-any-max: "262144"
  52
  53   # Pre-allocation of map entries allows per-packet latency to be reduced, at
  54   # the expense of up-front memory allocation for the entries in the maps. The
  55   # default value below will minimize memory usage in the default installation;
  56   # users who are sensitive to latency may consider setting this to "true".
  57   #
  58   # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
  59   # this option and behave as though it is set to "true".
  60   #
  61   # If this value is modified, then during the next Cilium startup the restore
  62   # of existing endpoints and tracking of ongoing connections may be disrupted.
  63   # This may lead to policy drops or a change in loadbalancing decisions for a
  64   # connection for some time. Endpoints may need to be recreated to restore
  65   # connectivity.
  66   #
  67   # If this option is set to "false" during an upgrade from 1.3 or earlier to
  68   # 1.4 or later, then it may cause one-time disruptions during the upgrade.
  69   preallocate-bpf-maps: "false"
  70
  71   # Regular expression matching compatible Istio sidecar istio-proxy
  72   # container image names
  73   sidecar-istio-proxy-image: "cilium/istio_proxy"
  74
  75   # Encapsulation mode for communication between nodes
  76   # Possible values:
  77   #   - disabled
  78   #   - vxlan (default)
  79   #   - geneve
  80   tunnel: vxlan
  81
  82   # Name of the cluster. Only relevant when building a mesh of clusters.
  83   cluster-name: default
  84
  85   # DNS Polling periodically issues a DNS lookup for each `matchName` from
  86   # cilium-agent. The result is used to regenerate endpoint policy.
  87   # DNS lookups are repeated with an interval of 5 seconds, and are made for
  88   # A(IPv4) and AAAA(IPv6) addresses. Should a lookup fail, the most recent IP
  89   # data is used instead. An IP change will trigger a regeneration of the Cilium
  90   # policy for each endpoint and increment the per cilium-agent policy
  91   # repository revision.
  92   #
  93   # This option is disabled by default starting from version 1.4.x in favor
  94   # of a more powerful DNS proxy-based implementation, see [0] for details.
  95   # Enable this option if you want to use FQDN policies but do not want to use
  96   # the DNS proxy.
  97   #
  98   # To ease upgrade, users may opt to set this option to "true".
  99   # Otherwise please refer to the Upgrade Guide [1] which explains how to
 100   # prepare policy rules for upgrade.
 101   #
 102   # [0] http://docs.cilium.io/en/stable/policy/language/#dns-based
 103   # [1] http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action
 104   tofqdns-enable-poller: "false"
 105
 106   # wait-bpf-mount makes init container wait until bpf filesystem is mounted
 107   wait-bpf-mount: "false"
 108
 109   # Enable fetching of container-runtime specific metadata
 110   #
 111   # By default, the Kubernetes pod and namespace labels are retrieved and
 112   # associated with endpoints for identification purposes. By integrating
 113   # with the container runtime, container runtime specific labels can be
 114   # retrieved, such labels will be prefixed with container:
 115   #
 116   # CAUTION: The container runtime labels can include information such as pod
 117   # annotations which may result in each pod being associated a unique set of
 118   # labels which can result in excessive security identities being allocated.
 119   # Please review the labels filter when enabling container runtime labels.
 120   #
 121   # Supported values:
 122   # - containerd
 123   # - crio
 124   # - docker
 125   # - none
 126   # - auto (automatically detect the container runtime)
 127   #
 128   container-runtime: none
 129
 130   masquerade: "true"
 131
 132   install-iptables-rules: "true"
 133   auto-direct-node-routes: "false"
 134   enable-node-port: "false"
 135
 136 ---
 137 # Source: cilium/charts/agent/templates/serviceaccount.yaml
 138 apiVersion: v1
 139 kind: ServiceAccount
 140 metadata:
 141   name: cilium
 142   namespace: kube-system
 143
 144 ---
 145 # Source: cilium/charts/operator/templates/serviceaccount.yaml
 146 apiVersion: v1
 147 kind: ServiceAccount
 148 metadata:
 149   name: cilium-operator
 150   namespace: kube-system
 151
 152 ---
 153 # Source: cilium/charts/agent/templates/clusterrole.yaml
 154 apiVersion: rbac.authorization.k8s.io/v1
 155 kind: ClusterRole
 156 metadata:
 157   name: cilium
 158 rules:
 159 - apiGroups:
 160   - networking.k8s.io
 161   resources:
 162   - networkpolicies
 163   verbs:
 164   - get
 165   - list
 166   - watch
 167 - apiGroups:
 168   - ""
 169   resources:
 170   - namespaces
 171   - services
 172   - nodes
 173   - endpoints
 174   verbs:
 175   - get
 176   - list
 177   - watch
 178 - apiGroups:
 179   - ""
 180   resources:
 181   - pods
 182   - nodes
 183   verbs:
 184   - get
 185   - list
 186   - watch
 187   - update
 188 - apiGroups:
 189   - ""
 190   resources:
 191   - nodes
 192   - nodes/status
 193   verbs:
 194   - patch
 195 - apiGroups:
 196   - extensions
 197   resources:
 198   - ingresses
 199   verbs:
 200   - create
 201   - get
 202   - list
 203   - watch
 204 - apiGroups:
 205   - apiextensions.k8s.io
 206   resources:
 207   - customresourcedefinitions
 208   verbs:
 209   - create
 210   - get
 211   - list
 212   - watch
 213   - update
 214 - apiGroups:
 215   - cilium.io
 216   resources:
 217   - ciliumnetworkpolicies
 218   - ciliumnetworkpolicies/status
 219   - ciliumclusterwidenetworkpolicies
 220   - ciliumclusterwidenetworkpolicies/status
 221   - ciliumendpoints
 222   - ciliumendpoints/status
 223   - ciliumnodes
 224   - ciliumnodes/status
 225   - ciliumidentities
 226   - ciliumidentities/status
 227   verbs:
 228   - '*'
 229
 230 ---
 231 # Source: cilium/charts/operator/templates/clusterrole.yaml
 232 apiVersion: rbac.authorization.k8s.io/v1
 233 kind: ClusterRole
 234 metadata:
 235   name: cilium-operator
 236 rules:
 237 - apiGroups:
 238   - ""
 239   resources:
 240   # to automatically delete [core|kube]dns pods so that are starting to being
 241   # managed by Cilium
 242   - pods
 243   verbs:
 244   - get
 245   - list
 246   - watch
 247   - delete
 248 - apiGroups:
 249   - ""
 250   resources:
 251   # to automatically read from k8s and import the node's pod CIDR to cilium's
 252   # etcd so all nodes know how to reach another pod running in in a different
 253   # node.
 254   - nodes
 255   # to perform the translation of a CNP that contains `ToGroup` to its endpoints
 256   - services
 257   - endpoints
 258   # to check apiserver connectivity
 259   - namespaces
 260   verbs:
 261   - get
 262   - list
 263   - watch
 264 - apiGroups:
 265   - cilium.io
 266   resources:
 267   - ciliumnetworkpolicies
 268   - ciliumnetworkpolicies/status
 269   - ciliumclusterwidenetworkpolicies
 270   - ciliumclusterwidenetworkpolicies/status
 271   - ciliumendpoints
 272   - ciliumendpoints/status
 273   - ciliumnodes
 274   - ciliumnodes/status
 275   - ciliumidentities
 276   - ciliumidentities/status
 277   verbs:
 278   - '*'
 279
 280 ---
 281 # Source: cilium/charts/agent/templates/clusterrolebinding.yaml
 282 apiVersion: rbac.authorization.k8s.io/v1
 283 kind: ClusterRoleBinding
 284 metadata:
 285   name: cilium
 286 roleRef:
 287   apiGroup: rbac.authorization.k8s.io
 288   kind: ClusterRole
 289   name: cilium
 290 subjects:
 291 - kind: ServiceAccount
 292   name: cilium
 293   namespace: kube-system
 294
 295 ---
 296 # Source: cilium/charts/operator/templates/clusterrolebinding.yaml
 297 apiVersion: rbac.authorization.k8s.io/v1
 298 kind: ClusterRoleBinding
 299 metadata:
 300   name: cilium-operator
 301 roleRef:
 302   apiGroup: rbac.authorization.k8s.io
 303   kind: ClusterRole
 304   name: cilium-operator
 305 subjects:
 306 - kind: ServiceAccount
 307   name: cilium-operator
 308   namespace: kube-system
 309
 310 ---
 311 # Source: cilium/charts/agent/templates/daemonset.yaml
 312 apiVersion: apps/v1
 313 kind: DaemonSet
 314 metadata:
 315   labels:
 316     k8s-app: cilium
 317     kubernetes.io/cluster-service: "true"
 318   name: cilium
 319   namespace: kube-system
 320 spec:
 321   selector:
 322     matchLabels:
 323       k8s-app: cilium
 324       kubernetes.io/cluster-service: "true"
 325   template:
 326     metadata:
 327       annotations:
 328         # This annotation plus the CriticalAddonsOnly toleration makes
 329         # cilium to be a critical pod in the cluster, which ensures cilium
 330         # gets priority scheduling.
 331         # https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
 332         scheduler.alpha.kubernetes.io/critical-pod: ""
 333         scheduler.alpha.kubernetes.io/tolerations: '[{"key":"dedicated","operator":"Equal","value":"master","effect":"NoSchedule"}]'
 334       labels:
 335         k8s-app: cilium
 336         kubernetes.io/cluster-service: "true"
 337     spec:
 338       containers:
 339       - args:
 340         - --config-dir=/tmp/cilium/config-map
 341         command:
 342         - cilium-agent
 343         env:
 344         - name: K8S_NODE_NAME
 345           valueFrom:
 346             fieldRef:
 347               apiVersion: v1
 348               fieldPath: spec.nodeName
 349         - name: CILIUM_K8S_NAMESPACE
 350           valueFrom:
 351             fieldRef:
 352               apiVersion: v1
 353               fieldPath: metadata.namespace
 354         - name: CILIUM_FLANNEL_MASTER_DEVICE
 355           valueFrom:
 356             configMapKeyRef:
 357               key: flannel-master-device
 358               name: cilium-config
 359               optional: true
 360         - name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT
 361           valueFrom:
 362             configMapKeyRef:
 363               key: flannel-uninstall-on-exit
 364               name: cilium-config
 365               optional: true
 366         - name: CILIUM_CLUSTERMESH_CONFIG
 367           value: /var/lib/cilium/clustermesh/
 368         - name: CILIUM_CNI_CHAINING_MODE
 369           valueFrom:
 370             configMapKeyRef:
 371               key: cni-chaining-mode
 372               name: cilium-config
 373               optional: true
 374         - name: CILIUM_CUSTOM_CNI_CONF
 375           valueFrom:
 376             configMapKeyRef:
 377               key: custom-cni-conf
 378               name: cilium-config
 379               optional: true
 380         image: "iecedge/cilium:latest"
 381         imagePullPolicy: IfNotPresent
 382         lifecycle:
 383           postStart:
 384             exec:
 385               command:
 386               - /cni-install.sh
 387           preStop:
 388             exec:
 389               command:
 390               - /cni-uninstall.sh
 391         livenessProbe:
 392           exec:
 393             command:
 394             - cilium
 395             - status
 396             - --brief
 397           failureThreshold: 10
 398           # The initial delay for the liveness probe is intentionally large to
 399           # avoid an endless kill & restart cycle if in the event that the initial
 400           # bootstrapping takes longer than expected.
 401           initialDelaySeconds: 120
 402           periodSeconds: 30
 403           successThreshold: 1
 404           timeoutSeconds: 5
 405         name: cilium-agent
 406         readinessProbe:
 407           exec:
 408             command:
 409             - cilium
 410             - status
 411             - --brief
 412           failureThreshold: 3
 413           initialDelaySeconds: 5
 414           periodSeconds: 30
 415           successThreshold: 1
 416           timeoutSeconds: 5
 417         securityContext:
 418           capabilities:
 419             add:
 420             - NET_ADMIN
 421             - SYS_MODULE
 422           privileged: true
 423         volumeMounts:
 424         - mountPath: /sys/fs/bpf
 425           name: bpf-maps
 426         - mountPath: /var/run/cilium
 427           name: cilium-run
 428         - mountPath: /host/opt/cni/bin
 429           name: cni-path
 430         - mountPath: /host/etc/cni/net.d
 431           name: etc-cni-netd
 432         - mountPath: /var/lib/cilium/clustermesh
 433           name: clustermesh-secrets
 434           readOnly: true
 435         - mountPath: /tmp/cilium/config-map
 436           name: cilium-config-path
 437           readOnly: true
 438           # Needed to be able to load kernel modules
 439         - mountPath: /lib/modules
 440           name: lib-modules
 441           readOnly: true
 442         - mountPath: /run/xtables.lock
 443           name: xtables-lock
 444       hostNetwork: true
 445       initContainers:
 446       - command:
 447         - /init-container.sh
 448         env:
 449         - name: CILIUM_ALL_STATE
 450           valueFrom:
 451             configMapKeyRef:
 452               key: clean-cilium-state
 453               name: cilium-config
 454               optional: true
 455         - name: CILIUM_BPF_STATE
 456           valueFrom:
 457             configMapKeyRef:
 458               key: clean-cilium-bpf-state
 459               name: cilium-config
 460               optional: true
 461         - name: CILIUM_WAIT_BPF_MOUNT
 462           valueFrom:
 463             configMapKeyRef:
 464               key: wait-bpf-mount
 465               name: cilium-config
 466               optional: true
 467         image: "iecedge/cilium:latest"
 468         imagePullPolicy: IfNotPresent
 469         name: clean-cilium-state
 470         securityContext:
 471           capabilities:
 472             add:
 473             - NET_ADMIN
 474           privileged: true
 475         volumeMounts:
 476         - mountPath: /sys/fs/bpf
 477           name: bpf-maps
 478         - mountPath: /var/run/cilium
 479           name: cilium-run
 480       restartPolicy: Always
 481       serviceAccount: cilium
 482       serviceAccountName: cilium
 483       terminationGracePeriodSeconds: 1
 484       tolerations:
 485       - operator: Exists
 486       volumes:
 487         # To keep state between restarts / upgrades
 488       - hostPath:
 489           path: /var/run/cilium
 490           type: DirectoryOrCreate
 491         name: cilium-run
 492         # To keep state between restarts / upgrades for bpf maps
 493       - hostPath:
 494           path: /sys/fs/bpf
 495           type: DirectoryOrCreate
 496         name: bpf-maps
 497       # To install cilium cni plugin in the host
 498       - hostPath:
 499           path: /opt/cni/bin
 500           type: DirectoryOrCreate
 501         name: cni-path
 502         # To install cilium cni configuration in the host
 503       - hostPath:
 504           path: /etc/cni/net.d
 505           type: DirectoryOrCreate
 506         name: etc-cni-netd
 507         # To be able to load kernel modules
 508       - hostPath:
 509           path: /lib/modules
 510         name: lib-modules
 511         # To access iptables concurrently with other processes (e.g. kube-proxy)
 512       - hostPath:
 513           path: /run/xtables.lock
 514           type: FileOrCreate
 515         name: xtables-lock
 516         # To read the clustermesh configuration
 517       - name: clustermesh-secrets
 518         secret:
 519           defaultMode: 420
 520           optional: true
 521           secretName: cilium-clustermesh
 522         # To read the configuration from the config map
 523       - configMap:
 524           name: cilium-config
 525         name: cilium-config-path
 526   updateStrategy:
 527     rollingUpdate:
 528       maxUnavailable: 2
 529     type: RollingUpdate
 530
 531 ---
 532 # Source: cilium/charts/operator/templates/deployment.yaml
 533 apiVersion: apps/v1
 534 kind: Deployment
 535 metadata:
 536   labels:
 537     io.cilium/app: operator
 538     name: cilium-operator
 539   name: cilium-operator
 540   namespace: kube-system
 541 spec:
 542   replicas: 1
 543   selector:
 544     matchLabels:
 545       io.cilium/app: operator
 546       name: cilium-operator
 547   strategy:
 548     rollingUpdate:
 549       maxSurge: 1
 550       maxUnavailable: 1
 551     type: RollingUpdate
 552   template:
 553     metadata:
 554       annotations:
 555       labels:
 556         io.cilium/app: operator
 557         name: cilium-operator
 558     spec:
 559       containers:
 560       - args:
 561         - --debug=$(CILIUM_DEBUG)
 562         - --identity-allocation-mode=$(CILIUM_IDENTITY_ALLOCATION_MODE)
 563         command:
 564         - cilium-operator
 565         env:
 566         - name: CILIUM_K8S_NAMESPACE
 567           valueFrom:
 568             fieldRef:
 569               apiVersion: v1
 570               fieldPath: metadata.namespace
 571         - name: K8S_NODE_NAME
 572           valueFrom:
 573             fieldRef:
 574               apiVersion: v1
 575               fieldPath: spec.nodeName
 576         - name: CILIUM_DEBUG
 577           valueFrom:
 578             configMapKeyRef:
 579               key: debug
 580               name: cilium-config
 581               optional: true
 582         - name: CILIUM_CLUSTER_NAME
 583           valueFrom:
 584             configMapKeyRef:
 585               key: cluster-name
 586               name: cilium-config
 587               optional: true
 588         - name: CILIUM_CLUSTER_ID
 589           valueFrom:
 590             configMapKeyRef:
 591               key: cluster-id
 592               name: cilium-config
 593               optional: true
 594         - name: CILIUM_IPAM
 595           valueFrom:
 596             configMapKeyRef:
 597               key: ipam
 598               name: cilium-config
 599               optional: true
 600         - name: CILIUM_DISABLE_ENDPOINT_CRD
 601           valueFrom:
 602             configMapKeyRef:
 603               key: disable-endpoint-crd
 604               name: cilium-config
 605               optional: true
 606         - name: CILIUM_KVSTORE
 607           valueFrom:
 608             configMapKeyRef:
 609               key: kvstore
 610               name: cilium-config
 611               optional: true
 612         - name: CILIUM_KVSTORE_OPT
 613           valueFrom:
 614             configMapKeyRef:
 615               key: kvstore-opt
 616               name: cilium-config
 617               optional: true
 618         - name: AWS_ACCESS_KEY_ID
 619           valueFrom:
 620             secretKeyRef:
 621               key: AWS_ACCESS_KEY_ID
 622               name: cilium-aws
 623               optional: true
 624         - name: AWS_SECRET_ACCESS_KEY
 625           valueFrom:
 626             secretKeyRef:
 627               key: AWS_SECRET_ACCESS_KEY
 628               name: cilium-aws
 629               optional: true
 630         - name: AWS_DEFAULT_REGION
 631           valueFrom:
 632             secretKeyRef:
 633               key: AWS_DEFAULT_REGION
 634               name: cilium-aws
 635               optional: true
 636         - name: CILIUM_IDENTITY_ALLOCATION_MODE
 637           valueFrom:
 638             configMapKeyRef:
 639               key: identity-allocation-mode
 640               name: cilium-config
 641               optional: true
 642         image: "iecedge/operator:latest"
 643         imagePullPolicy: IfNotPresent
 644         name: cilium-operator
 645         livenessProbe:
 646           httpGet:
 647             path: /healthz
 648             port: 9234
 649             scheme: HTTP
 650           initialDelaySeconds: 60
 651           periodSeconds: 10
 652           timeoutSeconds: 3
 653
 654       hostNetwork: true
 655       restartPolicy: Always
 656       serviceAccount: cilium-operator
 657       serviceAccountName: cilium-operator
 658
 659 ---
 660 # Source: cilium/charts/agent/templates/servicemonitor.yaml
 661
 662 ---
 663 # Source: cilium/charts/agent/templates/svc.yaml
 664
 665 ---
 666 # Source: cilium/charts/operator/templates/servicemonitor.yaml
 667
 668 ---
 669 # Source: cilium/charts/operator/templates/svc.yaml