calico.yaml
# etcd 证书 base64 地址 (执行里面的命令生成的证书 base64 码，填入里面),填入后记得把括号去除 data: etcd-key: (cat /opt/etcd/ssl/etcd-key.pem | base64 | tr -d '\n') etcd-cert: (cat /opt/etcd/ssl/etcd.pem | base64 | tr -d '\n') etcd-ca: (cat /opt/etcd/ssl/ca.pem | base64 | tr -d '\n')
echo etcd-key: `cat /opt/etcd/ssl/etcd-key.pem| base64 -w 0`
echo etcd-cert: `cat /opt/etcd/ssl/etcd.pem | base64 -w 0`
echo etcd-ca: `cat /opt/etcd/ssl/ca.pem | base64 -w 0`
https://blog.csdn.net/Cui_Cui_666/article/details/102460555
cat calico.yaml
--- # Source: calico/templates/calico-etcd-secrets.yaml # The following contains k8s Secrets for use with a TLS enabled etcd cluster. # For information on populating Secrets, see http://kubernetes.io/docs/user-guide/secrets/ apiVersion: v1 kind: Secret type: Opaque metadata: name: calico-etcd-secrets namespace: kube-system data: # Populate the following with etcd TLS configuration if desired, but leave blank if # not using TLS for etcd. # The keys below should be uncommented and the values populated with the base64 # encoded contents of each file that would be associated with the TLS data. # Example command for encoding a file contents: cat <file> | base64 -w 0 etcd-key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBM1E3WlgwbFNuZ21oa3FYMjM5bnRXdkMrbmg1eXVzaVd2b2dSMmd2Q3lkWjR6MkVzCkxzeko0dlFuUkU1RjJUakdnVGg1Mzlpb0VTVlkrM3pkR2NNaE15cnRKS3lZSXZrSTVxcXRkMy8yOGRBT3R1bCsKdWRmazJWS2Z0Q1pQa2lJMmRNN0dQWk9lczV6Zzl0MjhuRFVSRjlyOENMUXVFdXFFSXJ3WE1yMm1kNnl6aE85MQoremp6QzZEcnI4VHdsWlV4cWJDTHZqLzIydEV5SGNNTmR6VUxPNnZoMUFFYVR3ZCtsR0VTaW80dnZBUlVpdXB4CmJ3WVlWVWFTbTJaOFlHb2lPeGpYWDZGT0g5VWN2eWlLYWJ1VG0zaTREYU84UUdEcURMS0pncVNPU2RWYUZzQ2sKb0tCakFTNTFlUTBlUlV2NktjWnRObjlvblovdGcxK3Q2WWlaaHdJREFRQUJBb0lCQUQrbFI5YVVjTklKcWRoawpLbGszRUl5dlplSjJsOGZKZXdWdWZkMU9wNDJmVDNjOTNnKzNiS1VJY01uTTAzV0FVRDdpT016SFAxUjRjVTh2Ckd5V1F0ZDFhalo2U2h0Y0M1cG9ySi9pUkFsT0srTUdYSnFKeFUzVnl3WUtIeVQ4azFKTDYrYjYrNHVHSjJJZWIKUGZPbm43MURrbThiR1d6ZTBwNkJreGhMM0VMMkVGVEFHTzJPR05LVzVhRHU0TWlWakdxS3RRTzk1Y29uTG1uVwpyc1I4RS9nNVlWWVgwV3BWaHA4MkVCdldjd0FLWXdKRkVpM0hMRHJGU1I4SlpTOXlpVXdjR01ZczFFWjlFeEpLCjZVUGxuMElWU29QT3JYMXZzbmNEVUFmMlhyWGdkL0tCQ2p0QVpkZVFyckczK1VGdGRUbGFRL2J5c096c3dGYkEKQWhQRDlKRUNnWUVBNmU0ZVdqUklyeld1TUpUaGREanRLc2h2TFZrWWxFUy9pWC84ZEhHZXozS09DSFZ6SndMUgpEQnpIRlVEa3huZ1BpUERLVVVDUUlCNEVmMzNnNjZwMGc2YllETlNCY2tkUzdJRy9mV3FuVE1obXROV1A1RDRHCnJjeVJWR0RyTDl1dUhTcVkwd05MallnaW5yYzFBYlo5c1ZjcEQ0Yk1JeTFvRkpiWW16OGI1TjhDZ1lFQThlblgKcW5Sc0hYVlRnTUV6enIvYS9FRnJEYU1NZVYxcG9tcHpIRUZkdThMYmUvUGNGemkrbUVoWjVMdC9MYm5QT2h5ZApMcXhmbkZiZ1ZueGMrNUdDRWlMUDZkYmdLd2lJSXdpenNLa1QvVmt3UW1aNWphSFJzalU1aFBpY0prV3VCOS8vCjNlMytXdWd5QnZGTEZLRU92MERzVmlQYW5pL1JwRkVtcXFLaStGa0NnWUF5OVEvZmptd1czcGFuTm9jMkRnQjcKeFZXU2gwbjNZbEptM1Y1Yzd6TXM5VU5EVEhKZEdSdjRpM3hDZ1BSVTEycHE1aWpzTWlnekZ0YmIvc3UwQ2xsLwpKQ1VFQm5aOE1sVTU5N21DMUd6RktSSldhZjhDTlJDM1kweDFHUGVpWVRRNFhrTVVGQyt0RU82WnJFYjdySWtNCnpIUEJVaGU5d2ZKZUtjM2RZNDNyK1FLQmdRRGgveXpNZ0RFVW9Dd2ZaOTduY2xLNVFNQXJJRHlpRVFPRGlPRDYKNzVJS3UvSmg3U0theXhjN21yUG9QTVdHU1VUd0xCVW5xajgwQmZGVXVwLy9JU09ibjh3T3ovL2lFL2xpaVZtZApXNGRpTW5Va1F5bWhpQ0FuMVJOa1J3RlJ1OXptWEh4anIxZmxRM0NoRGNDdmgvc0g3elliRHluSWlESFl5VHRQClE5cnVHUUtCZ1FDSEtxb051dXU2TUU2T3FDNllmWXZMdGhkRXNnVjdyZi8rbmIwbHFZUGkya1hRWmplemRuTlcKdnpDZ2dUU1kyRkZzSXZlQ3hvL0dWaWpOVXBROW0yQzM5RHpjVmZtckVBV1pXVVF5Z1pRR25JZHJTbUJZblZWeApwby84eEE5SnlpdGZvS3gyeG5kbnRMaVZqdmxXdnFWMy9ycVF5WC96S3ZjUUlLV1E2UElXcUE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo= etcd-cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURyekNDQXBlZ0F3SUJBZ0lVQXp2Q1J5MlBrVStDUzdLSTBpSHNucGIvcjdzd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1F6RUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbAphV3BwYm1jeEVEQU9CZ05WQkFNVEIyVjBZMlFnUTBFd0hoY05Nakl3TWpFME1UUTBNVEF3V2hjTk16SXdNakV5Ck1UUTBNVEF3V2pCQU1Rc3dDUVlEVlFRR0V3SkRUakVRTUE0R0ExVUVDQk1IUW1WcFNtbHVaekVRTUE0R0ExVUUKQnhNSFFtVnBTbWx1WnpFTk1Bc0dBMVVFQXhNRVpYUmpaRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUApBRENDQVFvQ2dnRUJBTjBPMlY5SlVwNEpvWktsOXQvWjdWcnd2cDRlY3JySWxyNklFZG9Md3NuV2VNOWhMQzdNCnllTDBKMFJPUmRrNHhvRTRlZC9ZcUJFbFdQdDgzUm5ESVRNcTdTU3NtQ0w1Q09hcXJYZC85dkhRRHJicGZyblgKNU5sU243UW1UNUlpTm5UT3hqMlRuck9jNFBiZHZKdzFFUmZhL0FpMExoTHFoQ0s4RnpLOXBuZXNzNFR2ZGZzNAo4d3VnNjYvRThKV1ZNYW13aTc0Lzl0clJNaDNERFhjMUN6dXI0ZFFCR2s4SGZwUmhFb3FPTDd3RVZJcnFjVzhHCkdGVkdrcHRtZkdCcUlqc1kxMStoVGgvVkhMOG9pbW03azV0NHVBMmp2RUJnNmd5eWlZS2tqa25WV2hiQXBLQ2cKWXdFdWRYa05Ia1ZMK2luR2JUWi9hSjJmN1lOZnJlbUltWWNDQXdFQUFhT0JuVENCbWpBT0JnTlZIUThCQWY4RQpCQU1DQmFBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUNNQXdHQTFVZEV3RUIvd1FDCk1BQXdIUVlEVlIwT0JCWUVGTUFuZGEvRWxqOVBmK3BzejhwN01VaUphSkVyTUI4R0ExVWRJd1FZTUJhQUZKWmEKNHZsMDJoUy92R3gzOWMvSDBlaXBQZG5UTUJzR0ExVWRFUVFVTUJLSEJBcDNBb2FIQkFwM0F0V0hCQXAzQXJFdwpEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBRVBHNHNPR0dITXdpU2ZSSmhrRTc2STN6alJhS3FoZjVBSVNHOVZlCnFDZEtmQ0YzcGZHM3N6Z1o3QmlLQ2owdUhYSTRWY0FTN0d5WklmeDlmanZSOGRkb2VGZXRlaW1CV2cvTSsxbXMKM3FwVU93QnJ5cEZ2UEpQTGJMU0FQVFJndUNYMHN1eXZLVWk4Vm5tYnhXbUx3V2ZzcFptVWNkUVlVNnNyMXZDawpGNEQxR0dSZlZQRmhleFZVSG1FS0NtTXlWZHFkR0lCV3FoZ3orbHhXQzY4dEl4YnZTblRISSsxM1V0UXNDSmpRCk1xdzFOT3NLOVBnK0pzUHk4TnQ1eGF3dkl1V3ltYzBjZHEyYmFpY2FWTDhzOU01bVZXRTAxQkYyNzJtSVhnR0sKWG9lL2tVd2JWWHIzeUtrZ2x3QUFGQnVGTTFkYlFNdU5TSDhzTjd4QTZjWWVOMnM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K etcd-ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURlakNDQW1LZ0F3SUJBZ0lVY2VFWnRTY1BWSUZaendMMzF0azVlbXlLckhBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1F6RUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbAphV3BwYm1jeEVEQU9CZ05WQkFNVEIyVjBZMlFnUTBFd0hoY05Nakl3TWpFME1UUXpOekF3V2hjTk1qY3dNakV6Ck1UUXpOekF3V2pCRE1Rc3dDUVlEVlFRR0V3SkRUakVRTUE0R0ExVUVDQk1IUW1WcGFtbHVaekVRTUE0R0ExVUUKQnhNSFFtVnBhbWx1WnpFUU1BNEdBMVVFQXhNSFpYUmpaQ0JEUVRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRApnZ0VQQURDQ0FRb0NnZ0VCQU54WUZJMzFpdjBLeG1EOVpCWFAzcnlFdjJGcGpGaUtXSC83NHVXaG4zQ1Fxc1FTCmpjUWFBeVgvQVFFZnBTVktYMGwrbFlyNUw1cWllRzFhU1M3ZUVNT28zWlJHZi9QTU9RWEpNV1VsZ0lnSXFJRGQKdmZJWFdhNHR3V1dPaS9CV1B5T25qQW9lNGFMSVZFZjR2QXFkc3NNVUdqbUlLYjJxdVhuaDRKeTBGZGIva3JPQQpZVE9xSG93THdyQmlabGZQdWQ1VklpSEcyOWNyeFlsVTZFY3R0UkJ4NmRyckNPVytjbERPd0tRcS9JNW9ZLytjCjB4VldGc21wWVJhTjBYZFpLVlgvOGlpdmducm15eVJQUldhT09OOVMwWTV2WXFjZjd1cG41bktoOEZsSVNNbnkKUWRWbWtFYmRwQTJUcjc3NTJsS3ZZdnFUcHl4S2NJUE1TN0FCYmw4Q0F3RUFBYU5tTUdRd0RnWURWUjBQQVFILwpCQVFEQWdFR01CSUdBMVVkRXdFQi93UUlNQVlCQWY4Q0FRSXdIUVlEVlIwT0JCWUVGSlphNHZsMDJoUy92R3gzCjljL0gwZWlwUGRuVE1COEdBMVVkSXdRWU1CYUFGSlphNHZsMDJoUy92R3gzOWMvSDBlaXBQZG5UTUEwR0NTcUcKU0liM0RRRUJDd1VBQTRJQkFRRFNDOE02Rlo0TUE0QmtvRHRVOG1peXJKMWl2TTZGTWg4S0EvbWsvZkVhL1E0eAoxRExaM1lBNXU0WHh6aDZjdmVNTHlGajFrajFjaldtYmFPclRwaHdYRFMycWMvRnNUUnNXV3FuSGZnejZLdkNKCkQ3MWUvcDBpZFcwRXl0QzNocmpQWGUrR1g1Y1oyZDYvcFZ1aXNlVWNDa001d3NNTElxMnNmRm5DajdDd0tndlkKdW1aeHI4b2ZNNDBVOVczV2ZDUkpCN2o3VlJZbWx3RkszNkR3YUxOUWpDSEVLTklja0NSdlNsYWJVQjFGemVRbApiRFQya29WY0ZtVVFrNXBBMnZLcFRLbmJ6M080L0hubnpmTXJVZnh1K0VFMVJRSUxCZytWZXhidnV5Nzduc3dVCmwxSmxla2E2NmZCQ0NDSjlJQmdQRXV3emhFeC84SHdqVC8zTHlOVlUKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= --- # Source: calico/templates/calico-config.yaml # This ConfigMap is used to configure a self-hosted Calico installation. kind: ConfigMap apiVersion: v1 metadata: name: calico-config namespace: kube-system data: # Configure this with the location of your etcd cluster. etcd_endpoints: "https://10.119.2.134:2379,https://10.119.2.213:2379,https://10.119.2.177:2379" # If you're using TLS enabled etcd uncomment the following. # You must also populate the Secret below with these files. etcd_ca: "/calico-secrets/etcd-ca" etcd_cert: "/calico-secrets/etcd-cert" etcd_key: "/calico-secrets/etcd-key" # Typha is disabled. typha_service_name: "none" # Configure the backend to use. calico_backend: "bird" # Configure the MTU to use for workload interfaces and tunnels. # By default, MTU is auto-detected, and explicitly setting this field should not be required. # You can override auto-detection by providing a non-zero value. veth_mtu: "1430" # The CNI network configuration to install on each node. The special # values in this config will be automatically populated. cni_network_config: |- { "name": "k8s-pod-network", "cniVersion": "0.3.1", "plugins": [ { "type": "calico", "log_level": "info", "log_file_path": "/var/log/calico/cni/cni.log", "etcd_endpoints": "__ETCD_ENDPOINTS__", "etcd_key_file": "__ETCD_KEY_FILE__", "etcd_cert_file": "__ETCD_CERT_FILE__", "etcd_ca_cert_file": "__ETCD_CA_CERT_FILE__", "mtu": __CNI_MTU__, "ipam": { "type": "calico-ipam" }, "policy": { "type": "k8s" }, "kubernetes": { "kubeconfig": "__KUBECONFIG_FILEPATH__" } }, { "type": "portmap", "snat": true, "capabilities": {"portMappings": true} }, { "type": "bandwidth", "capabilities": {"bandwidth": true} } ] } --- # Source: calico/templates/calico-kube-controllers-rbac.yaml # Include a clusterrole for the kube-controllers component, # and bind it to the calico-kube-controllers serviceaccount. kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: calico-kube-controllers rules: # Pods are monitored for changing labels. # The node controller monitors Kubernetes nodes. # Namespace and serviceaccount labels are used for policy. - apiGroups: [""] resources: - pods - nodes - namespaces - serviceaccounts verbs: - watch - list - get # Watch for changes to Kubernetes NetworkPolicies. - apiGroups: ["networking.k8s.io"] resources: - networkpolicies verbs: - watch - list --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: calico-kube-controllers roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: calico-kube-controllers subjects: - kind: ServiceAccount name: calico-kube-controllers namespace: kube-system --- --- # Source: calico/templates/calico-node-rbac.yaml # Include a clusterrole for the calico-node DaemonSet, # and bind it to the calico-node serviceaccount. kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: calico-node rules: # The CNI plugin needs to get pods, nodes, and namespaces. - apiGroups: [""] resources: - pods - nodes - namespaces verbs: - get - apiGroups: [""] resources: - endpoints - services verbs: # Used to discover service IPs for advertisement. - watch - list # Pod CIDR auto-detection on kubeadm needs access to config maps. - apiGroups: [""] resources: - configmaps verbs: - get - apiGroups: [""] resources: - nodes/status verbs: # Needed for clearing NodeNetworkUnavailable flag. - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: calico-node roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: calico-node subjects: - kind: ServiceAccount name: calico-node namespace: kube-system --- # Source: calico/templates/calico-node.yaml # This manifest installs the calico-node container, as well # as the CNI plugins and network config on # each master and worker node in a Kubernetes cluster. kind: DaemonSet apiVersion: apps/v1 metadata: name: calico-node namespace: kube-system labels: k8s-app: calico-node spec: selector: matchLabels: k8s-app: calico-node updateStrategy: type: RollingUpdate rollingUpdate: maxUnavailable: 1 template: metadata: labels: k8s-app: calico-node spec: nodeSelector: kubernetes.io/os: linux hostNetwork: true tolerations: # Make sure calico-node gets scheduled on all nodes. - effect: NoSchedule operator: Exists # Mark the pod as a critical add-on for rescheduling. - key: CriticalAddonsOnly operator: Exists - effect: NoExecute operator: Exists serviceAccountName: calico-node # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. terminationGracePeriodSeconds: 0 priorityClassName: system-node-critical initContainers: # This container installs the CNI binaries # and CNI network config file on each node. - name: install-cni image: docker.io/calico/cni:v3.19.1 command: ["/opt/cni/bin/install"] envFrom: - configMapRef: # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode. name: kubernetes-services-endpoint optional: true env: # Name of the CNI config file to create. - name: CNI_CONF_NAME value: "10-calico.conflist" # The CNI network config to install on each node. - name: CNI_NETWORK_CONFIG valueFrom: configMapKeyRef: name: calico-config key: cni_network_config # The location of the etcd cluster. - name: ETCD_ENDPOINTS valueFrom: configMapKeyRef: name: calico-config key: etcd_endpoints # CNI MTU Config variable - name: CNI_MTU valueFrom: configMapKeyRef: name: calico-config key: veth_mtu # Prevents the container from sleeping forever. - name: SLEEP value: "false" volumeMounts: - mountPath: /host/opt/cni/bin name: cni-bin-dir - mountPath: /host/etc/cni/net.d name: cni-net-dir - mountPath: /calico-secrets name: etcd-certs securityContext: privileged: true # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes # to communicate with Felix over the Policy Sync API. - name: flexvol-driver image: docker.io/calico/pod2daemon-flexvol:v3.19.1 volumeMounts: - name: flexvol-driver-host mountPath: /host/driver securityContext: privileged: true containers: # Runs calico-node container on each Kubernetes node. This # container programs network policy and routes on each # host. - name: calico-node image: docker.io/calico/node:v3.19.1 envFrom: - configMapRef: # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode. name: kubernetes-services-endpoint optional: true env: # The location of the etcd cluster. - name: ETCD_ENDPOINTS valueFrom: configMapKeyRef: name: calico-config key: etcd_endpoints # Location of the CA certificate for etcd. - name: ETCD_CA_CERT_FILE valueFrom: configMapKeyRef: name: calico-config key: etcd_ca # Location of the client key for etcd. - name: ETCD_KEY_FILE valueFrom: configMapKeyRef: name: calico-config key: etcd_key # Location of the client certificate for etcd. - name: ETCD_CERT_FILE valueFrom: configMapKeyRef: name: calico-config key: etcd_cert # Set noderef for node controller. - name: CALICO_K8S_NODE_REF valueFrom: fieldRef: fieldPath: spec.nodeName # Choose the backend to use. - name: CALICO_NETWORKING_BACKEND valueFrom: configMapKeyRef: name: calico-config key: calico_backend # Cluster type to identify the deployment type - name: CLUSTER_TYPE value: "k8s,bgp" - name: IP_AUTODETECTION_METHOD value: "interface=eth0" # Auto-detect the BGP IP address. - name: IP value: "autodetect" # Enable IPIP - name: CALICO_IPV4POOL_IPIP value: "Always" # Enable or Disable VXLAN on the default IP pool. - name: CALICO_IPV4POOL_VXLAN value: "Never" # Set MTU for tunnel device used if ipip is enabled - name: FELIX_IPINIPMTU valueFrom: configMapKeyRef: name: calico-config key: veth_mtu # Set MTU for the VXLAN tunnel device. - name: FELIX_VXLANMTU valueFrom: configMapKeyRef: name: calico-config key: veth_mtu # Set MTU for the Wireguard tunnel device. - name: FELIX_WIREGUARDMTU valueFrom: configMapKeyRef: name: calico-config key: veth_mtu # The default IPv4 pool to create on startup if none exists. Pod IPs will be # chosen from this range. Changing this value after installation will have # no effect. This should fall within `--cluster-cidr`. - name: CALICO_IPV4POOL_CIDR value: "10.244.0.0/16" # Disable file logging so `kubectl logs` works. - name: CALICO_DISABLE_FILE_LOGGING value: "true" # Set Felix endpoint to host default action to ACCEPT. - name: FELIX_DEFAULTENDPOINTTOHOSTACTION value: "ACCEPT" # Disable IPv6 on Kubernetes. - name: FELIX_IPV6SUPPORT value: "false" - name: FELIX_HEALTHENABLED value: "true" securityContext: privileged: true resources: requests: cpu: 250m livenessProbe: exec: command: - /bin/calico-node - -felix-live - -bird-live periodSeconds: 10 initialDelaySeconds: 10 failureThreshold: 6 readinessProbe: exec: command: - /bin/calico-node - -felix-ready - -bird-ready periodSeconds: 10 volumeMounts: - mountPath: /lib/modules name: lib-modules readOnly: true - mountPath: /run/xtables.lock name: xtables-lock readOnly: false - mountPath: /var/run/calico name: var-run-calico readOnly: false - mountPath: /var/lib/calico name: var-lib-calico readOnly: false - mountPath: /calico-secrets name: etcd-certs - name: policysync mountPath: /var/run/nodeagent # For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the # parent directory. - name: sysfs mountPath: /sys/fs/ # Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host. # If the host is known to mount that filesystem already then Bidirectional can be omitted. mountPropagation: Bidirectional - name: cni-log-dir mountPath: /var/log/calico/cni readOnly: true volumes: # Used by calico-node. - name: lib-modules hostPath: path: /lib/modules - name: var-run-calico hostPath: path: /var/run/calico - name: var-lib-calico hostPath: path: /var/lib/calico - name: xtables-lock hostPath: path: /run/xtables.lock type: FileOrCreate - name: sysfs hostPath: path: /sys/fs/ type: DirectoryOrCreate # Used to install CNI. - name: cni-bin-dir hostPath: path: /opt/cni/bin - name: cni-net-dir hostPath: path: /etc/cni/net.d # Used to access CNI logs. - name: cni-log-dir hostPath: path: /var/log/calico/cni # Mount in the etcd TLS secrets with mode 400. # See https://kubernetes.io/docs/concepts/configuration/secret/ - name: etcd-certs secret: secretName: calico-etcd-secrets defaultMode: 0400 # Used to create per-pod Unix Domain Sockets - name: policysync hostPath: type: DirectoryOrCreate path: /var/run/nodeagent # Used to install Flex Volume Driver - name: flexvol-driver-host hostPath: type: DirectoryOrCreate path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds --- apiVersion: v1 kind: ServiceAccount metadata: name: calico-node namespace: kube-system --- # Source: calico/templates/calico-kube-controllers.yaml # See https://github.com/projectcalico/kube-controllers apiVersion: apps/v1 kind: Deployment metadata: name: calico-kube-controllers namespace: kube-system labels: k8s-app: calico-kube-controllers spec: # The controllers can only have a single active instance. replicas: 1 selector: matchLabels: k8s-app: calico-kube-controllers strategy: type: Recreate template: metadata: name: calico-kube-controllers namespace: kube-system labels: k8s-app: calico-kube-controllers spec: nodeSelector: kubernetes.io/os: linux tolerations: # Mark the pod as a critical add-on for rescheduling. - key: CriticalAddonsOnly operator: Exists - key: node-role.kubernetes.io/master effect: NoSchedule serviceAccountName: calico-kube-controllers priorityClassName: system-cluster-critical # The controllers must run in the host network namespace so that # it isn't governed by policy that would prevent it from working. hostNetwork: true containers: - name: calico-kube-controllers image: docker.io/calico/kube-controllers:v3.19.1 env: # The location of the etcd cluster. - name: ETCD_ENDPOINTS valueFrom: configMapKeyRef: name: calico-config key: etcd_endpoints # Location of the CA certificate for etcd. - name: ETCD_CA_CERT_FILE valueFrom: configMapKeyRef: name: calico-config key: etcd_ca # Location of the client key for etcd. - name: ETCD_KEY_FILE valueFrom: configMapKeyRef: name: calico-config key: etcd_key # Location of the client certificate for etcd. - name: ETCD_CERT_FILE valueFrom: configMapKeyRef: name: calico-config key: etcd_cert # Choose which controllers to run. - name: ENABLED_CONTROLLERS value: policy,namespace,serviceaccount,workloadendpoint,node volumeMounts: # Mount in the etcd TLS secrets. - mountPath: /calico-secrets name: etcd-certs livenessProbe: exec: command: - /usr/bin/check-status - -l periodSeconds: 10 initialDelaySeconds: 10 failureThreshold: 6 readinessProbe: exec: command: - /usr/bin/check-status - -r periodSeconds: 10 volumes: # Mount in the etcd TLS secrets with mode 400. # See https://kubernetes.io/docs/concepts/configuration/secret/ - name: etcd-certs secret: secretName: calico-etcd-secrets defaultMode: 0440 --- apiVersion: v1 kind: ServiceAccount metadata: name: calico-kube-controllers namespace: kube-system --- # This manifest creates a Pod Disruption Budget for Controller to allow K8s Cluster Autoscaler to evict apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: calico-kube-controllers namespace: kube-system labels: k8s-app: calico-kube-controllers spec: maxUnavailable: 1 selector: matchLabels: k8s-app: calico-kube-controllers --- # Source: calico/templates/calico-typha.yaml --- # Source: calico/templates/configure-canal.yaml --- # Source: calico/templates/kdd-crds.yaml
