Created
February 6, 2018 21:57
-
-
Save abhi/61375d2063f7b208b8ab1b26ac0c593b to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Calico Version v3.0.1 | |
# https://docs.projectcalico.org/v2.6/releases#v2.6.2 | |
# This manifest includes the following component versions: | |
# calico/node:v3.0.1 | |
# calico/cni:v1.11.0 | |
# calico/kube-controllers:v1.0.0 | |
# This ConfigMap is used to configure a self-hosted Calico installation. | |
kind: ConfigMap | |
apiVersion: v1 | |
metadata: | |
name: calico-config | |
namespace: kube-system | |
data: | |
# Configure this with the location of your etcd cluster. | |
etcd_endpoints: "https://proxy.local:12378" | |
# Configure the Calico backend to use. | |
calico_backend: "none" | |
# Configure the Calico IP address pool. | |
calico_pool: "172.16.11.0/24" | |
# The CNI network configuration to install on each node. | |
cni_network_config: |- | |
{ | |
"cniVersion": "0.3.1", | |
"name": "k8s-pod-network", | |
"plugins": [ | |
{ | |
"type": "calico", | |
"etcd_endpoints": "https://proxy.local:12378", | |
"etcd_key_file": "/var/lib/docker/ucp/ucp-node-certs/key.pem", | |
"etcd_cert_file": "/var/lib/docker/ucp/ucp-node-certs/cert.pem", | |
"etcd_ca_cert_file": "/var/lib/docker/ucp/ucp-node-certs/ca.pem", | |
"log_level": "info", | |
"mtu": 1500, | |
"ipam": { | |
"type": "azure-vnet-ipam", | |
"subnet": "172.16.11.0/24" | |
}, | |
"kubernetes": { | |
"kubeconfig": "/var/lib/docker/ucp/ucp-node-certs/kubeconfig" | |
}, | |
"policy": { | |
"type": "k8s" | |
} | |
}, | |
{ | |
"type": "portmap", | |
"snat": true, | |
"capabilities": {"portMappings": true} | |
} | |
] | |
} | |
# If you're using TLS enabled etcd uncomment the following. | |
# You must also populate the Secret below with these files. | |
etcd_ca: "/calico-secrets/etcd-ca" | |
etcd_cert: "/calico-secrets/etcd-cert" | |
etcd_key: "/calico-secrets/etcd-key" | |
--- | |
# The following contains k8s Secrets for use with a TLS enabled etcd cluster. | |
# For information on populating Secrets, see http://kubernetes.io/docs/user-guide/secrets/ | |
apiVersion: v1 | |
kind: Secret | |
type: Opaque | |
metadata: | |
name: calico-etcd-secrets | |
namespace: kube-system | |
data: | |
# Populate the following files with etcd TLS configuration if desired, but leave blank if | |
# not using TLS for etcd. | |
# This self-hosted install expects three files with the following names. The values | |
# should be base64 encoded strings of the entire contents of each file. | |
etcd-key: "=" | |
etcd-cert: "==" | |
etcd-ca: "==" | |
--- | |
# This manifest installs the calico/node container, as well | |
# as the Calico CNI plugins and network config on | |
# each master and worker node in a Kubernetes cluster. | |
kind: DaemonSet | |
apiVersion: extensions/v1beta1 | |
metadata: | |
name: calico-node | |
namespace: kube-system | |
labels: | |
k8s-app: calico-node | |
spec: | |
updateStrategy: | |
type: RollingUpdate | |
selector: | |
matchLabels: | |
k8s-app: calico-node | |
template: | |
metadata: | |
labels: | |
k8s-app: calico-node | |
annotations: | |
scheduler.alpha.kubernetes.io/critical-pod: '' | |
spec: | |
hostNetwork: true | |
tolerations: | |
# this taint is set by all kubelets running --cloud-provider=external | |
# so we should tolerate it to schedule the calico pods | |
- key: node.cloudprovider.kubernetes.io/uninitialized | |
value: "true" | |
effect: NoSchedule | |
- key: node-role.kubernetes.io/master | |
effect: NoSchedule | |
# Allow this pod to be rescheduled while the node is in "critical add-ons only" mode. | |
# This, along with the annotation above marks this pod as a critical add-on. | |
- key: CriticalAddonsOnly | |
operator: Exists | |
serviceAccountName: cni-plugin | |
# Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force | |
# deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. | |
terminationGracePeriodSeconds: 0 | |
containers: | |
# Runs calico/node container on each Kubernetes node. This | |
# container programs network policy and routes on each | |
# host. | |
- name: calico-node | |
image: docker/ucp-calico-node:3.0.0-dev | |
env: | |
# The location of the Calico etcd cluster. | |
- name: ETCD_ENDPOINTS | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_endpoints | |
# Choose the backend to use. | |
- name: CALICO_NETWORKING_BACKEND | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: calico_backend | |
# Cluster type to identify the deployment type | |
- name: CLUSTER_TYPE | |
value: "k8s,acse" | |
# Disable file logging so kubectl logs works. | |
- name: CALICO_DISABLE_FILE_LOGGING | |
value: "true" | |
- name: CALICO_IPV4POOL_IPIP | |
value: "off" | |
# Set Felix endpoint to host default action to ACCEPT. | |
- name: FELIX_IPINIPENABLED | |
value: "false" | |
- name: FELIX_DEFAULTENDPOINTTOHOSTACTION | |
value: "ACCEPT" | |
# Configure the IP Pool from which Pod IPs will be chosen. | |
- name: CALICO_IPV4POOL_CIDR | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: calico_pool | |
# Disable IPv6 on Kubernetes. | |
- name: FELIX_IPV6SUPPORT | |
value: "false" | |
# Set Felix logging to "info" | |
- name: FELIX_LOGSEVERITYSCREEN | |
value: "info" | |
# Set MTU for tunnel device used if ipip is enabled | |
- name: FELIX_IPINIPMTU | |
value: "1440" | |
# Location of the CA certificate for etcd. | |
- name: ETCD_CA_CERT_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_ca | |
# Location of the client key for etcd. | |
- name: ETCD_KEY_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_key # Location of the client certificate for etcd. | |
- name: ETCD_CERT_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_cert | |
- name: NODENAME | |
valueFrom: | |
fieldRef: | |
fieldPath: spec.nodeName | |
- name: IP | |
valueFrom: | |
fieldRef: | |
fieldPath: status.hostIP | |
- name: FELIX_HEALTHENABLED | |
value: "true" | |
securityContext: | |
privileged: true | |
resources: | |
requests: | |
cpu: 250m | |
livenessProbe: | |
httpGet: | |
path: /liveness | |
port: 9099 | |
periodSeconds: 10 | |
initialDelaySeconds: 10 | |
failureThreshold: 6 | |
readinessProbe: | |
httpGet: | |
path: /readiness | |
port: 9099 | |
periodSeconds: 10 | |
volumeMounts: | |
- mountPath: /lib/modules | |
name: lib-modules | |
readOnly: true | |
- mountPath: /var/run/calico | |
name: var-run-calico | |
readOnly: false | |
- mountPath: /calico-secrets | |
name: etcd-certs | |
# This container installs the Calico CNI binaries | |
# and CNI network config file on each node. | |
- name: install-cni | |
image: docker/ucp-calico-cni:3.0.0-dev | |
command: ["/install-cni.sh"] | |
securityContext: | |
privileged: true | |
env: | |
# Name of the CNI config file to create | |
- name: CNI_CONF_NAME | |
value: "10-calico.conflist" | |
# The location of the Calico etcd cluster. | |
- name: ETCD_ENDPOINTS | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_endpoints | |
# The CNI network config to install on each node. | |
- name: CNI_NETWORK_CONFIG | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: cni_network_config | |
volumeMounts: | |
- mountPath: /host/opt/cni/bin | |
name: cni-bin-dir | |
- mountPath: /host/etc/cni/net.d | |
name: cni-net-dir | |
- mountPath: /calico-secrets | |
name: etcd-certs | |
volumes: | |
# Used by calico/node. | |
- name: lib-modules | |
hostPath: | |
path: /lib/modules | |
- name: var-run-calico | |
hostPath: | |
path: /var/run/calico | |
# Used to install CNI. | |
- name: cni-bin-dir | |
hostPath: | |
path: /opt/cni/bin | |
- name: cni-net-dir | |
hostPath: | |
path: /etc/cni/net.d | |
- name: etcd-certs | |
secret: | |
secretName: calico-etcd-secrets | |
--- | |
# This manifest deploys the Calico Kubernetes controllers. | |
# See https://github.com/projectcalico/kube-controllers | |
apiVersion: extensions/v1beta1 | |
kind: Deployment | |
metadata: | |
name: calico-kube-controllers | |
namespace: kube-system | |
labels: | |
k8s-app: calico-kube-controllers | |
spec: | |
# The controllers can only have a single active instance. | |
replicas: 1 | |
strategy: | |
type: Recreate | |
template: | |
metadata: | |
name: calico-kube-controllers | |
namespace: kube-system | |
labels: | |
k8s-app: calico-kube-controllers | |
annotations: | |
# Mark this pod as a critical add-on; when enabled, the critical add-on scheduler | |
# reserves resources for critical add-on pods so that they can be rescheduled after | |
# a failure. This annotation works in tandem with the toleration below. | |
scheduler.alpha.kubernetes.io/critical-pod: '' | |
spec: | |
# The controllers must run in the host network namespace so that | |
# it isn't governed by policy that would prevent it from working. | |
hostNetwork: true | |
tolerations: | |
# this taint is set by all kubelets running --cloud-provider=external | |
# so we should tolerate it to schedule the calico pods | |
- key: node.cloudprovider.kubernetes.io/uninitialized | |
value: "true" | |
effect: NoSchedule | |
- key: node-role.kubernetes.io/master | |
effect: NoSchedule | |
# Allow this pod to be rescheduled while the node is in "critical add-ons only" mode. | |
# This, along with the annotation above marks this pod as a critical add-on. | |
- key: CriticalAddonsOnly | |
operator: Exists | |
# Controllers are system components so schedule on a manager | |
affinity: | |
nodeAffinity: | |
requiredDuringSchedulingIgnoredDuringExecution: | |
nodeSelectorTerms: | |
- matchExpressions: | |
- key: node-role.kubernetes.io/master | |
operator: Exists | |
serviceAccountName: cni-plugin | |
containers: | |
- name: calico-kube-controllers | |
image: docker/ucp-calico-kube-controllers:3.0.0-dev | |
env: | |
# The location of the Calico etcd cluster. | |
- name: ETCD_ENDPOINTS | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_endpoints | |
# Location of the CA certificate for etcd. | |
- name: ETCD_CA_CERT_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_ca | |
# Location of the client key for etcd. | |
- name: ETCD_KEY_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_key | |
# Location of the client certificate for etcd. | |
- name: ETCD_CERT_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_cert | |
volumeMounts: | |
# Mount in the etcd TLS secrets. | |
- mountPath: /calico-secrets | |
name: etcd-certs | |
volumes: | |
# Mount in the etcd TLS secrets. | |
- name: etcd-certs | |
secret: | |
secretName: calico-etcd-secrets |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment