Last active
July 24, 2018 02:42
-
-
Save slene/eba38f8095c8ca014047bf6c2b1cbbb5 to your computer and use it in GitHub Desktop.
calico problem in OpenStack
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Calico Version v3.1.1 | |
# https://docs.projectcalico.org/v3.1/releases#v3.1.1 | |
# This manifest includes the following component versions: | |
# calico/node:v3.1.1 | |
# calico/cni:v3.1.1 | |
# calico/kube-controllers:v3.1.1 | |
# This ConfigMap is used to configure a self-hosted Calico installation. | |
kind: ConfigMap | |
apiVersion: v1 | |
metadata: | |
name: calico-config | |
namespace: kube-system | |
data: | |
# Configure this with the location of your etcd cluster. | |
etcd_endpoints: "https://172.16.30.103:2379,https://172.16.30.104:2379,https://172.16.30.105:2379" | |
# Configure the Calico backend to use. | |
calico_backend: "bird" | |
# The CNI network configuration to install on each node. | |
cni_network_config: |- | |
{ | |
"name": "k8s-pod-network", | |
"cniVersion": "0.3.0", | |
"plugins": [ | |
{ | |
"type": "calico", | |
"etcd_endpoints": "https://172.16.30.103:2379,https://172.16.30.104:2379,https://172.16.30.105:2379", | |
"etcd_key_file": "/etc/calico/ssl/calico-key.pem", | |
"etcd_cert_file": "/etc/calico/ssl/calico.pem", | |
"etcd_ca_cert_file": "/etc/calico/ssl/ca.pem", | |
"log_level": "warning", | |
"mtu": 1280, | |
"ipam": { | |
"type": "calico-ipam" | |
}, | |
"policy": { | |
"type": "k8s" | |
}, | |
"kubernetes": { | |
"kubeconfig": "/root/.kube/config" | |
} | |
}, | |
{ | |
"type": "portmap", | |
"snat": true, | |
"capabilities": {"portMappings": true} | |
} | |
] | |
} | |
# If you're using TLS enabled etcd uncomment the following. | |
# You must also populate the Secret below with these files. | |
etcd_ca: "/calico-secrets/etcd-ca" | |
etcd_cert: "/calico-secrets/etcd-cert" | |
etcd_key: "/calico-secrets/etcd-key" | |
--- | |
# This manifest installs the calico/node container, as well | |
# as the Calico CNI plugins and network config on | |
# each master and worker node in a Kubernetes cluster. | |
kind: DaemonSet | |
apiVersion: extensions/v1beta1 | |
metadata: | |
name: calico-node | |
namespace: kube-system | |
labels: | |
k8s-app: calico-node | |
spec: | |
selector: | |
matchLabels: | |
k8s-app: calico-node | |
updateStrategy: | |
type: RollingUpdate | |
rollingUpdate: | |
maxUnavailable: 1 | |
template: | |
metadata: | |
labels: | |
k8s-app: calico-node | |
annotations: | |
scheduler.alpha.kubernetes.io/critical-pod: '' | |
spec: | |
hostNetwork: true | |
tolerations: | |
# Make sure calico/node gets scheduled on all nodes. | |
- effect: NoSchedule | |
operator: Exists | |
# Mark the pod as a critical add-on for rescheduling. | |
- key: CriticalAddonsOnly | |
operator: Exists | |
- effect: NoExecute | |
operator: Exists | |
serviceAccountName: calico-node | |
# Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force | |
# deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. | |
terminationGracePeriodSeconds: 0 | |
containers: | |
# Runs calico/node container on each Kubernetes node. This | |
# container programs network policy and routes on each | |
# host. | |
- name: calico-node | |
image: "172.16.30.103:5000/calico/node:v3.1.1" | |
env: | |
# The location of the Calico etcd cluster. | |
- name: ETCD_ENDPOINTS | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_endpoints | |
# Choose the backend to use. | |
- name: CALICO_NETWORKING_BACKEND | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: calico_backend | |
# Cluster type to identify the deployment type | |
- name: CLUSTER_TYPE | |
value: "k8s,bgp" | |
# Disable file logging so `kubectl logs` works. | |
- name: CALICO_DISABLE_FILE_LOGGING | |
value: "true" | |
# Set noderef for node controller. | |
- name: CALICO_K8S_NODE_REF | |
valueFrom: | |
fieldRef: | |
fieldPath: spec.nodeName | |
# Set Felix endpoint to host default action to ACCEPT. | |
- name: FELIX_DEFAULTENDPOINTTOHOSTACTION | |
value: "ACCEPT" | |
# The default IPv4 pool to create on startup if none exists. Pod IPs will be | |
# chosen from this range. Changing this value after installation will have | |
# no effect. This should fall within `--cluster-cidr`. | |
- name: CALICO_IPV4POOL_CIDR | |
value: "192.168.0.0/16" | |
- name: CALICO_IPV4POOL_IPIP | |
value: "off" | |
# Disable IPv6 on Kubernetes. | |
- name: FELIX_IPV6SUPPORT | |
value: "false" | |
# Set Felix logging to "info" | |
- name: FELIX_LOGSEVERITYSCREEN | |
value: "info" | |
# Set MTU for tunnel device used if ipip is enabled | |
- name: FELIX_IPINIPMTU | |
value: "1440" | |
# Location of the CA certificate for etcd. | |
- name: ETCD_CA_CERT_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_ca | |
# Location of the client key for etcd. | |
- name: ETCD_KEY_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_key | |
# Location of the client certificate for etcd. | |
- name: ETCD_CERT_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_cert | |
# Auto-detect the BGP IP address. | |
- name: IP | |
value: "autodetect" | |
- name: IP_AUTODETECTION_METHOD | |
value: "interface=eth0" | |
- name: FELIX_HEALTHENABLED | |
value: "true" | |
- name: FELIX_DISABLECONNTRACKINVALIDCHECK | |
value: "true" | |
securityContext: | |
privileged: true | |
resources: | |
requests: | |
cpu: 250m | |
livenessProbe: | |
httpGet: | |
path: /liveness | |
port: 9099 | |
periodSeconds: 10 | |
initialDelaySeconds: 10 | |
failureThreshold: 6 | |
readinessProbe: | |
httpGet: | |
path: /readiness | |
port: 9099 | |
periodSeconds: 10 | |
volumeMounts: | |
- mountPath: /lib/modules | |
name: lib-modules | |
readOnly: true | |
- mountPath: /var/run/calico | |
name: var-run-calico | |
readOnly: false | |
- mountPath: /var/lib/calico | |
name: var-lib-calico | |
readOnly: false | |
- mountPath: /calico-secrets | |
name: etcd-certs | |
# This container installs the Calico CNI binaries | |
# and CNI network config file on each node. | |
- name: install-cni | |
image: "172.16.30.103:5000/calico/cni:v3.1.1" | |
command: ["/install-cni.sh"] | |
env: | |
# Name of the CNI config file to create. | |
- name: CNI_CONF_NAME | |
value: "10-calico.conflist" | |
# The location of the Calico etcd cluster. | |
- name: ETCD_ENDPOINTS | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_endpoints | |
# The CNI network config to install on each node. | |
- name: CNI_NETWORK_CONFIG | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: cni_network_config | |
volumeMounts: | |
- mountPath: /host/opt/cni/bin | |
name: cni-bin-dir | |
- mountPath: /host/etc/cni/net.d | |
name: cni-net-dir | |
- mountPath: /calico-secrets | |
name: etcd-certs | |
volumes: | |
# Used by calico/node. | |
- name: lib-modules | |
hostPath: | |
path: /lib/modules | |
- name: var-run-calico | |
hostPath: | |
path: /var/run/calico | |
- name: var-lib-calico | |
hostPath: | |
path: /var/lib/calico | |
# Used to install CNI. | |
- name: cni-bin-dir | |
hostPath: | |
path: /usr/local/bin | |
- name: cni-net-dir | |
hostPath: | |
path: /etc/cni/net.d | |
# Mount in the etcd TLS secrets with mode 400. | |
# See https://kubernetes.io/docs/concepts/configuration/secret/ | |
- name: etcd-certs | |
hostPath: | |
path: /etc/calico/ssl | |
--- | |
# This manifest deploys the Calico Kubernetes controllers. | |
# See https://github.com/projectcalico/kube-controllers | |
apiVersion: extensions/v1beta1 | |
kind: Deployment | |
metadata: | |
name: calico-kube-controllers | |
namespace: kube-system | |
labels: | |
k8s-app: calico-kube-controllers | |
annotations: | |
scheduler.alpha.kubernetes.io/critical-pod: '' | |
spec: | |
# The controllers can only have a single active instance. | |
replicas: 1 | |
strategy: | |
type: Recreate | |
template: | |
metadata: | |
name: calico-kube-controllers | |
namespace: kube-system | |
labels: | |
k8s-app: calico-kube-controllers | |
spec: | |
# The controllers must run in the host network namespace so that | |
# it isn't governed by policy that would prevent it from working. | |
hostNetwork: true | |
tolerations: | |
# Mark the pod as a critical add-on for rescheduling. | |
- key: CriticalAddonsOnly | |
operator: Exists | |
- key: node-role.kubernetes.io/master | |
effect: NoSchedule | |
serviceAccountName: calico-kube-controllers | |
containers: | |
- name: calico-kube-controllers | |
image: "172.16.30.103:5000/calico/kube-controllers:v3.1.1" | |
env: | |
# The location of the Calico etcd cluster. | |
- name: ETCD_ENDPOINTS | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_endpoints | |
# Location of the CA certificate for etcd. | |
- name: ETCD_CA_CERT_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_ca | |
# Location of the client key for etcd. | |
- name: ETCD_KEY_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_key | |
# Location of the client certificate for etcd. | |
- name: ETCD_CERT_FILE | |
valueFrom: | |
configMapKeyRef: | |
name: calico-config | |
key: etcd_cert | |
# Choose which controllers to run. | |
- name: ENABLED_CONTROLLERS | |
value: policy,profile,workloadendpoint,node | |
- name: KUBERNETES_SERVICE_HOST | |
value: "172.16.30.103" | |
- name: KUBERNETES_SERVICE_PORT | |
value: "8443" | |
volumeMounts: | |
# Mount in the etcd TLS secrets. | |
- mountPath: /calico-secrets | |
name: etcd-certs | |
volumes: | |
# Mount in the etcd TLS secrets with mode 400. | |
# See https://kubernetes.io/docs/concepts/configuration/secret/ | |
- name: etcd-certs | |
hostPath: | |
path: /etc/calico/ssl | |
--- | |
apiVersion: v1 | |
kind: ServiceAccount | |
metadata: | |
name: calico-kube-controllers | |
namespace: kube-system | |
--- | |
apiVersion: v1 | |
kind: ServiceAccount | |
metadata: | |
name: calico-node | |
namespace: kube-system |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
calicoctl result