starlingx
/
config
Code Issues Proposed changes

Merge "downgrade calico to v3.1.4 and add IP autodetect"

This commit is contained in:
Zuul 2018-11-27 04:25:24 +00:00 committed by Gerrit Code Review
parent 6aa28434d4 9d238984ca
commit f17aa108b0
3 changed files with 74 additions and 106 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
puppet-manifests/centos/build_srpm.data
View File

@ -1,2 +1,2 @@
SRC_DIR="src" SRC_DIR="src"
TIS_PATCH_VER=72 TIS_PATCH_VER=73

173
puppet-manifests/src/modules/platform/templates/calico.yaml.erb
View File

@ -1,8 +1,8 @@
# Calico Version v3.2.3 # Calico Version v3.1.4
# https://docs.projectcalico.org/v3.2/releases#v3.2.3 # https://docs.projectcalico.org/v3.1/releases#v3.1.4
# This manifest includes the following component versions: # This manifest includes the following component versions:
# calico/node:v3.2.3 # calico/node:v3.1.4
# calico/cni:v3.2.3 # calico/cni:v3.1.4
# This ConfigMap is used to configure a self-hosted Calico installation. # This ConfigMap is used to configure a self-hosted Calico installation.
kind: ConfigMap kind: ConfigMap
@ -15,14 +15,8 @@ data:
# below. We recommend using Typha if you have more than 50 nodes. Above 100 nodes it is # below. We recommend using Typha if you have more than 50 nodes. Above 100 nodes it is
# essential. # essential.
typha_service_name: "none" typha_service_name: "none"
# Configure the Calico backend to use.
calico_backend: "bird"
# Configure the MTU to use # The CNI network configuration to install on each node.
veth_mtu: "1440"
# The CNI network configuration to install on each node. The special
# values in this config will be automatically populated.
cni_network_config: |- cni_network_config: |-
{ {
"name": "k8s-pod-network", "name": "k8s-pod-network",
@ -33,16 +27,16 @@ data:
"log_level": "info", "log_level": "info",
"datastore_type": "kubernetes", "datastore_type": "kubernetes",
"nodename": "__KUBERNETES_NODE_NAME__", "nodename": "__KUBERNETES_NODE_NAME__",
"mtu": __CNI_MTU__, "mtu": 1500,
"ipam": { "ipam": {
"type": "host-local", "type": "host-local",
"subnet": "usePodCidr" "subnet": "usePodCidr"
}, },
"policy": { "policy": {
"type": "k8s" "type": "k8s"
}, },
"kubernetes": { "kubernetes": {
"kubeconfig": "__KUBECONFIG_FILEPATH__" "kubeconfig": "__KUBECONFIG_FILEPATH__"
} }
}, },
{ {
@ -55,7 +49,6 @@ data:
--- ---
# This manifest creates a Service, which will be backed by Calico's Typha daemon. # This manifest creates a Service, which will be backed by Calico's Typha daemon.
# Typha sits in between Felix and the API server, reducing Calico's load on the API server. # Typha sits in between Felix and the API server, reducing Calico's load on the API server.
@ -105,8 +98,6 @@ spec:
# if it ever gets evicted. # if it ever gets evicted.
scheduler.alpha.kubernetes.io/critical-pod: '' scheduler.alpha.kubernetes.io/critical-pod: ''
spec: spec:
nodeSelector:
beta.kubernetes.io/os: linux
hostNetwork: true hostNetwork: true
tolerations: tolerations:
# Mark the pod as a critical add-on for rescheduling. # Mark the pod as a critical add-on for rescheduling.
@ -116,7 +107,7 @@ spec:
# as a host-networked pod. # as a host-networked pod.
serviceAccountName: calico-node serviceAccountName: calico-node
containers: containers:
- image: quay.io/calico/typha:v3.2.3 - image: quay.io/calico/typha:v3.1.4
name: calico-typha name: calico-typha
ports: ports:
- containerPort: 5473 - containerPort: 5473
@ -146,19 +137,15 @@ spec:
#- name: TYPHA_PROMETHEUSMETRICSPORT #- name: TYPHA_PROMETHEUSMETRICSPORT
# value: "9093" # value: "9093"
livenessProbe: livenessProbe:
exec: httpGet:
command: path: /liveness
- calico-typha port: 9098
- check
- liveness
periodSeconds: 30 periodSeconds: 30
initialDelaySeconds: 30 initialDelaySeconds: 30
readinessProbe: readinessProbe:
exec: httpGet:
command: path: /readiness
- calico-typha port: 9098
- check
- readiness
periodSeconds: 10 periodSeconds: 10
--- ---
@ -192,11 +179,9 @@ spec:
# if it ever gets evicted. # if it ever gets evicted.
scheduler.alpha.kubernetes.io/critical-pod: '' scheduler.alpha.kubernetes.io/critical-pod: ''
spec: spec:
nodeSelector:
beta.kubernetes.io/os: linux
hostNetwork: true hostNetwork: true
tolerations: tolerations:
# Make sure calico-node gets scheduled on all nodes. # Make sure calico/node gets scheduled on all nodes.
- effect: NoSchedule - effect: NoSchedule
operator: Exists operator: Exists
# Mark the pod as a critical add-on for rescheduling. # Mark the pod as a critical add-on for rescheduling.
@ -213,66 +198,59 @@ spec:
# container programs network policy and routes on each # container programs network policy and routes on each
# host. # host.
- name: calico-node - name: calico-node
image: quay.io/calico/node:v3.2.3 image: quay.io/calico/node:v3.1.4
env: env:
# Use Kubernetes API as the backing datastore. # Use Kubernetes API as the backing datastore.
- name: DATASTORE_TYPE - name: DATASTORE_TYPE
value: "kubernetes" value: "kubernetes"
# Typha support: controlled by the ConfigMap. # Enable felix info logging.
- name: FELIX_TYPHAK8SSERVICENAME - name: FELIX_LOGSEVERITYSCREEN
valueFrom: value: "info"
configMapKeyRef:
name: calico-config
key: typha_service_name
# Wait for the datastore.
- name: WAIT_FOR_DATASTORE
value: "true"
# Set based on the k8s node name.
- name: NODENAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
# Choose the backend to use.
- name: CALICO_NETWORKING_BACKEND
valueFrom:
configMapKeyRef:
name: calico-config
key: calico_backend
# Cluster type to identify the deployment type # Cluster type to identify the deployment type
- name: CLUSTER_TYPE - name: CLUSTER_TYPE
value: "k8s,bgp" value: "k8s,bgp"
# Auto-detect the BGP IP address.
- name: IP
value: "autodetect"
# Enable IPIP
- name: CALICO_IPV4POOL_IPIP
value: "Always"
# Enable IP-in-IP within Felix.
- name: FELIX_IPINIPENABLED
value: "true"
# Set MTU for tunnel device used if ipip is enabled
- name: FELIX_IPINIPMTU
valueFrom:
configMapKeyRef:
name: calico-config
key: veth_mtu
# The default IPv4 pool to create on startup if none exists. Pod IPs will be
# chosen from this range. Changing this value after installation will have
# no effect. This should fall within `--cluster-cidr`.
- name: CALICO_IPV4POOL_CIDR
value: "<%= @pod_network_cidr %>"
# Disable file logging so `kubectl logs` works. # Disable file logging so `kubectl logs` works.
- name: CALICO_DISABLE_FILE_LOGGING - name: CALICO_DISABLE_FILE_LOGGING
value: "true" value: "true"
# Set Felix endpoint to host default action to ACCEPT. # Set Felix endpoint to host default action to ACCEPT.
- name: FELIX_DEFAULTENDPOINTTOHOSTACTION - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
value: "ACCEPT" value: "ACCEPT"
# Disable IPv6 on Kubernetes. # Disable IPV6 on Kubernetes.
- name: FELIX_IPV6SUPPORT - name: FELIX_IPV6SUPPORT
value: "false" value: "false"
# Set Felix logging to "info" # Set MTU for tunnel device used if ipip is enabled
- name: FELIX_LOGSEVERITYSCREEN - name: FELIX_IPINIPMTU
value: "info" value: "1440"
# Wait for the datastore.
- name: WAIT_FOR_DATASTORE
value: "true"
# The default IPv4 pool to create on startup if none exists. Pod IPs will be
# chosen from this range. Changing this value after installation will have
# no effect. This should fall within `--cluster-cidr`.
- name: CALICO_IPV4POOL_CIDR
value: "<%= @pod_network_cidr %>"
# Enable IPIP
- name: CALICO_IPV4POOL_IPIP
value: "Always"
# Enable IP-in-IP within Felix.
- name: FELIX_IPINIPENABLED
value: "true"
# Typha support: controlled by the ConfigMap.
- name: FELIX_TYPHAK8SSERVICENAME
valueFrom:
configMapKeyRef:
name: calico-config
key: typha_service_name
# Set based on the k8s node name.
- name: NODENAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
# Auto-detect the BGP IP address.
- name: IP
value: "autodetect"
- name: IP_AUTODETECTION_METHOD
value: "can-reach=<%= @apiserver_advertise_address %>"
- name: FELIX_HEALTHENABLED - name: FELIX_HEALTHENABLED
value: "true" value: "true"
securityContext: securityContext:
@ -284,16 +262,13 @@ spec:
httpGet: httpGet:
path: /liveness path: /liveness
port: 9099 port: 9099
host: localhost
periodSeconds: 10 periodSeconds: 10
initialDelaySeconds: 10 initialDelaySeconds: 10
failureThreshold: 6 failureThreshold: 6
readinessProbe: readinessProbe:
exec: httpGet:
command: path: /readiness
- /bin/calico-node port: 9099
- -bird-ready
- -felix-ready
periodSeconds: 10 periodSeconds: 10
volumeMounts: volumeMounts:
- mountPath: /lib/modules - mountPath: /lib/modules
@ -308,29 +283,23 @@ spec:
# This container installs the Calico CNI binaries # This container installs the Calico CNI binaries
# and CNI network config file on each node. # and CNI network config file on each node.
- name: install-cni - name: install-cni
image: quay.io/calico/cni:v3.2.3 image: quay.io/calico/cni:v3.1.4
command: ["/install-cni.sh"] command: ["/install-cni.sh"]
env: env:
# Name of the CNI config file to create. # Name of the CNI config file to create.
- name: CNI_CONF_NAME - name: CNI_CONF_NAME
value: "10-calico.conflist" value: "10-calico.conflist"
# Set the hostname based on the k8s node name.
- name: KUBERNETES_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
# The CNI network config to install on each node. # The CNI network config to install on each node.
- name: CNI_NETWORK_CONFIG - name: CNI_NETWORK_CONFIG
valueFrom: valueFrom:
configMapKeyRef: configMapKeyRef:
name: calico-config name: calico-config
key: cni_network_config key: cni_network_config
# CNI MTU Config variable # Set the hostname based on the k8s node name.
- name: CNI_MTU - name: KUBERNETES_NODE_NAME
valueFrom: valueFrom:
configMapKeyRef: fieldRef:
name: calico-config fieldPath: spec.nodeName
key: veth_mtu
volumeMounts: volumeMounts:
- mountPath: /host/opt/cni/bin - mountPath: /host/opt/cni/bin
name: cni-bin-dir name: cni-bin-dir
@ -354,18 +323,10 @@ spec:
- name: cni-net-dir - name: cni-net-dir
hostPath: hostPath:
path: /etc/cni/net.d path: /etc/cni/net.d
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: calico-node
namespace: kube-system
---
# Create all the CustomResourceDefinitions needed for # Create all the CustomResourceDefinitions needed for
# Calico policy and networking mode. # Calico policy and networking mode.
---
apiVersion: apiextensions.k8s.io/v1beta1 apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition kind: CustomResourceDefinition
@ -379,6 +340,7 @@ spec:
kind: FelixConfiguration kind: FelixConfiguration
plural: felixconfigurations plural: felixconfigurations
singular: felixconfiguration singular: felixconfiguration
--- ---
apiVersion: apiextensions.k8s.io/v1beta1 apiVersion: apiextensions.k8s.io/v1beta1
@ -499,3 +461,10 @@ spec:
plural: networkpolicies plural: networkpolicies
singular: networkpolicy singular: networkpolicy
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: calico-node
namespace: kube-system

5
puppet-manifests/src/modules/platform/templates/rbac-kdd.yaml.erb
View File

@ -1,5 +1,5 @@
# Calico Version v3.2.3 # Calico Version v3.1.4
# https://docs.projectcalico.org/v3.2/releases#v3.2.3 # https://docs.projectcalico.org/v3.1/releases#v3.1.4
kind: ClusterRole kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1 apiVersion: rbac.authorization.k8s.io/v1beta1
metadata: metadata:
@ -8,7 +8,6 @@ rules:
- apiGroups: [""] - apiGroups: [""]
resources: resources:
- namespaces - namespaces
- serviceaccounts
verbs: verbs:
- get - get
- list - list