Template calico.yaml and canal.yaml manifests

Signed-off-by: Spike Curtis <[email protected]>
projectcalico · Apr 18, 2018 · e67a23f · e67a23f
1 parent 613f8a5
commit e67a23f
Show file tree

Hide file tree

Showing 22 changed files with 935 additions and 3,352 deletions.
diff --git a/_includes/master/manifests/calico-config.yaml b/_includes/master/manifests/calico-config.yaml
@@ -0,0 +1,142 @@
+{% comment %}
+calico-config.yaml acccepts the following include flags:
+
+| Name         | Accepted Values          |
+|--------------|--------------------------|
+| datastore    | kdd, etcd                |
+| typha        | true, false              |
+| network      | calico, flannel, <unset> |
+| calico_ipam  | true, false              |
+| variant_name | Calico, Canal            |
+
+{% endcomment -%}
+# This ConfigMap is used to configure a self-hosted {{include.variant_name}} installation.
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: {{include.variant_name | downcase}}-config
+  namespace: kube-system
+data:
+{%- if include.datastore == "etcd" %}
+  # Configure this with the location of your etcd cluster.
+  etcd_endpoints: "http://127.0.0.1:2379"
+
+  # If you're using TLS enabled etcd uncomment the following.
+  # You must also populate the Secret below with these files.
+  etcd_ca: ""   # "/calico-secrets/etcd-ca"
+  etcd_cert: "" # "/calico-secrets/etcd-cert"
+  etcd_key: ""  # "/calico-secrets/etcd-key"
+{%- elsif include.datastore == "kdd" and include.typha == "true" %}
+  # To enable Typha, set this to "calico-typha" *and* set a non-zero value for Typha replicas
+  # below.  We recommend using Typha if you have more than 50 nodes. Above 100 nodes it is
+  # essential.
+  typha_service_name: "none"
+{%- endif %}
+{%- if include.network == "calico" %}
+  # Configure the {{site.prodname}} backend to use.
+  calico_backend: "bird"
+
+  # Configure the MTU to use
+  veth_mtu: "1440"
+{%- elsif include.network == "flannel" %}
+  # The interface used by canal for host <-> host communication.
+  # If left blank, then the interface is chosen using the node's
+  # default route.
+  canal_iface: ""
+
+  # Whether or not to masquerade traffic to destinations not within
+  # the pod network.
+  masquerade: "true"
+{%- endif %}
+  # The CNI network configuration to install on each node.  The special
+  # values in this config will be automatically populated.
+{%- if include.datastore == "etcd"  and include.network == "flannel" %}
+  cni_network_config: |-
+    {
+        "name": "canal",
+        "cniVersion": "0.3.0",
+        "plugins": [
+            {
+                "type": "flannel",
+                "delegate": {
+                    "type": "calico",
+                    "etcd_endpoints": "__ETCD_ENDPOINTS__",
+                    "etcd_key_file": "__ETCD_KEY_FILE__",
+                    "etcd_cert_file": "__ETCD_CERT_FILE__",
+                    "etcd_ca_cert_file": "__ETCD_CA_CERT_FILE__",
+                    "log_level": "info",
+                    "policy": {
+                        "type": "k8s",
+                        "k8s_api_root": "https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__",
+                        "k8s_auth_token": "__SERVICEACCOUNT_TOKEN__"
+                    },
+                    "kubernetes": {
+                        "kubeconfig": "/etc/cni/net.d/__KUBECONFIG_FILENAME__"
+                    }
+                }
+            },
+            {
+                "type": "portmap",
+                "capabilities": {"portMappings": true},
+                "snat": true
+            }
+        ]
+    }
+{%- else %}
+  cni_network_config: |-
+    {
+      "name": "k8s-pod-network",
+      "cniVersion": "0.3.0",
+      "plugins": [
+        {
+          "type": "calico",
+          "log_level": "info",
+  {%- if include.datastore == "etcd" %}
+          "etcd_endpoints": "__ETCD_ENDPOINTS__",
+          "etcd_key_file": "__ETCD_KEY_FILE__",
+          "etcd_cert_file": "__ETCD_CERT_FILE__",
+          "etcd_ca_cert_file": "__ETCD_CA_CERT_FILE__",
+  {%- elsif include.datastore == "kdd" %}
+          "datastore_type": "kubernetes",
+          "nodename": "__KUBERNETES_NODE_NAME__",
+  {%- endif %}
+  {%- if include.network == "calico" %}
+          "mtu": __CNI_MTU__,
+  {%- elsif include.network == null %}
+          "mtu": 1500,
+  {%- endif %}
+  {%- if include.calico_ipam == "true" %}
+          "ipam": {
+              "type": "calico-ipam"
+          },
+  {%- else %}
+          "ipam": {
+            "type": "host-local",
+            "subnet": "usePodCidr"
+          },
+  {%- endif %}
+          "policy": {
+              "type": "k8s"
+          },
+          "kubernetes": {
+              "kubeconfig": "__KUBECONFIG_FILEPATH__"
+          }
+        },
+        {
+          "type": "portmap",
+          "snat": true,
+          "capabilities": {"portMappings": true}
+        }
+      ]
+    }
+{%- endif %}
+{%- if include.network == "flannel" and include.datastore == "kdd" %}
+  # Flannel network configuration. Mounted into the flannel container.
+  net-conf.json: |
+    {
+      "Network": "10.244.0.0/16",
+      "Backend": {
+        "Type": "vxlan"
+      }
+    }
+{%- endif %}
diff --git a/_includes/master/manifests/calico-etcd-secrets.yaml b/_includes/master/manifests/calico-etcd-secrets.yaml
@@ -0,0 +1,16 @@
+# The following contains k8s Secrets for use with a TLS enabled etcd cluster.
+# For information on populating Secrets, see http://kubernetes.io/docs/user-guide/secrets/
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: calico-etcd-secrets
+  namespace: kube-system
+data:
+  # Populate the following files with etcd TLS configuration if desired, but leave blank if
+  # not using TLS for etcd.
+  # This self-hosted install expects three files with the following names.  The values
+  # should be base64 encoded strings of the entire contents of each file.
+  # etcd-key: null
+  # etcd-cert: null
+  # etcd-ca: null
diff --git a/_includes/master/manifests/calico-kube-controllers.yaml b/_includes/master/manifests/calico-kube-controllers.yaml
@@ -0,0 +1,91 @@
+{% comment %}
+calico-kube-controllers.yaml acccepts the following include flags:
+
+| Name             | Accepted Values |
+|------------------|-----------------|
+| variant_name     | Calico, Canal   |
+
+{% endcomment -%}
+# This manifest deploys the {{site.prodname}} Kubernetes controllers.
+# See https://github.com/projectcalico/kube-controllers
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: calico-kube-controllers
+  namespace: kube-system
+  labels:
+    k8s-app: calico-kube-controllers
+  annotations:
+    scheduler.alpha.kubernetes.io/critical-pod: ''
+spec:
+  # The controllers can only have a single active instance.
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      name: calico-kube-controllers
+      namespace: kube-system
+      labels:
+        k8s-app: calico-kube-controllers
+    spec:
+      # The controllers must run in the host network namespace so that
+      # it isn't governed by policy that would prevent it from working.
+      hostNetwork: true
+      tolerations:
+        # Mark the pod as a critical add-on for rescheduling.
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+      serviceAccountName: calico-kube-controllers
+      containers:
+        - name: calico-kube-controllers
+          image: {{site.imageNames["kubeControllers"]}}:{{site.data.versions[page.version].first.components["calico/kube-controllers"].version}}
+          env:
+            # The location of the {{site.prodname}} etcd cluster.
+            - name: ETCD_ENDPOINTS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{include.variant_name | downcase}}-config
+                  key: etcd_endpoints
+            # Location of the CA certificate for etcd.
+            - name: ETCD_CA_CERT_FILE
+              valueFrom:
+                configMapKeyRef:
+                  name: {{include.variant_name | downcase}}-config
+                  key: etcd_ca
+            # Location of the client key for etcd.
+            - name: ETCD_KEY_FILE
+              valueFrom:
+                configMapKeyRef:
+                  name: {{include.variant_name | downcase}}-config
+                  key: etcd_key
+            # Location of the client certificate for etcd.
+            - name: ETCD_CERT_FILE
+              valueFrom:
+                configMapKeyRef:
+                  name: {{include.variant_name | downcase}}-config
+                  key: etcd_cert
+            # Choose which controllers to run.
+            - name: ENABLED_CONTROLLERS
+              value: policy,profile,workloadendpoint,node
+          volumeMounts:
+            # Mount in the etcd TLS secrets.
+            - mountPath: /calico-secrets
+              name: etcd-certs
+      volumes:
+        # Mount in the etcd TLS secrets with mode 400.
+        # See https://kubernetes.io/docs/concepts/configuration/secret/
+        - name: etcd-certs
+          secret:
+            secretName: calico-etcd-secrets
+            defaultMode: 0400
+
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: calico-kube-controllers
+  namespace: kube-system