比较文本

查找两个文本文件之间的差异

实时编辑器

折叠未更改行

关闭换行

视图

比对精度

语法高亮

Diffchecker Desktop 运行Diffchecker最安全的方式。获取Diffchecker桌面应用：您的差异永远不会离开您的电脑！获取桌面版

HCloud Cilium Config Diff

创建于 6年前差异永不过期

501 删除

行
总计
删除

字符
总计
删除

要继续使用此功能，请升级到 Diffchecker Pro 查看价格

680 行

304 添加

行
总计
添加

字符
总计
添加

要继续使用此功能，请升级到 Diffchecker Pro 查看价格

690 行

---

# Source: cilium/charts/agent/templates/serviceaccount.yaml

# Source: cilium/templates/cilium-agent-serviceaccount.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

namespace: kube-system

---

# Source: cilium/charts/operator/templates/serviceaccount.yaml

# Source: cilium/templates/cilium-operator-serviceaccount.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

namespace: kube-system

---

# Source: cilium/charts/config/templates/configmap.yaml

# Source: cilium/templates/cilium-configmap.yaml

apiVersion: v1

kind: ConfigMap

metadata:

namespace: kube-system

data:

# Identity allocation mode selects how identities are shared between cilium

# nodes by setting how they are stored. The options are "crd" or "kvstore".

# - "crd" stores identities in kubernetes as CRDs (custom resource definition).

# These can be queried with:

# kubectl get ciliumid

# - "kvstore" stores identities in a kvstore, etcd or consul, that is

# configured below. Cilium versions before 1.6 supported only the kvstore

# backend. Upgrades from these older cilium versions should continue using

# the kvstore by commenting out the identity-allocation-mode below, or

# setting it to "kvstore".

identity-allocation-mode: crd

cilium-endpoint-gc-interval: "5m0s"

# If you want to run cilium in debug mode change this value to true

debug: "false"

# If you want metrics enabled in all of your Cilium agents, set the port for

# which the Cilium agents will have their metrics exposed.

# This option deprecates the "prometheus-serve-addr" in the

# "cilium-metrics-config" ConfigMap

# NOTE that this will open the port on ALL nodes where Cilium pods are

# scheduled.

prometheus-serve-addr: ":9100"

# Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4

# address.

enable-ipv4: "true"

# Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6

# address.

enable-ipv6: "false"

# Users who wish to specify their own custom CNI configuration file must set

# custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.

custom-cni-conf: "false"

enable-bpf-clock-probe: "true"

# If you want cilium monitor to aggregate tracing for packets, set this level

# to "low", "medium", or "maximum". The higher the level, the less packets

# that will be seen in monitor output.

monitor-aggregation: medium

# The monitor aggregation interval governs the typical time between monitor

# notification events for each allowed connection.

# Only effective when monitor aggregation is set to "medium" or higher.

monitor-aggregation-interval: 5s

# The monitor aggregation flags determine which TCP flags which, upon the

# first observation, cause monitor notifications to be generated.

# Only effective when monitor aggregation is set to "medium" or higher.

monitor-aggregation-flags: all

# Specifies the ratio (0.0-1.0) of total system memory to use for dynamic

# ct-global-max-entries-* specifies the maximum number of connections

# sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.

# supported across all endpoints, split by protocol: tcp or other. One pair

bpf-map-dynamic-size-ratio: "0.0025"

# of maps uses these values for IPv4 connections, and another pair of maps

# bpf-policy-map-max specifies the maximum number of entries in endpoint

# use these values for IPv6 connections.

# policy map (per endpoint)

bpf-policy-map-max: "16384"

# If these values are modified, then during the next Cilium startup the

# bpf-lb-map-max specifies the maximum number of entries in bpf lb service,

# tracking of ongoing connections may be disrupted. This may lead to brief

# backend and affinity maps.

# policy drops or a change in loadbalancing decisions for a connection.

bpf-lb-map-max: "65536"

# For users upgrading from Cilium 1.2 or earlier, to minimize disruption

# during the upgrade process, comment out these options.

bpf-ct-global-tcp-max: "524288"

bpf-ct-global-any-max: "262144"

# Pre-allocation of map entries allows per-packet latency to be reduced, at

# the expense of up-front memory allocation for the entries in the maps. The

# default value below will minimize memory usage in the default installation;

# users who are sensitive to latency may consider setting this to "true".

# This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore

# this option and behave as though it is set to "true".

# If this value is modified, then during the next Cilium startup the restore

# of existing endpoints and tracking of ongoing connections may be disrupted.

# This may lead to policy drops or a change in loadbalancing decisions for a

# As a result, reply packets may be dropped and the load-balancing decisions

# connection for some time. Endpoints may need to be recreated to restore

# for established connections may change.

# connectivity.

# If this option is set to "false" during an upgrade from 1.3 or earlier to

# 1.4 or later, then it may cause one-time disruptions during the upgrade.

preallocate-bpf-maps: "false"

# Regular expression matching compatible Istio sidecar istio-proxy

# container image names

sidecar-istio-proxy-image: "cilium/istio_proxy"

# Encapsulation mode for communication between nodes

# Possible values:

# - disabled

# - vxlan (default)

# - geneve

tunnel: disabled

# Name of the cluster. Only relevant when building a mesh of clusters.

cluster-name: default

# Enables L7 proxy for L7 policy enforcement and visibility

# DNS Polling periodically issues a DNS lookup for each `matchName` from

enable-l7-proxy: "true"

# cilium-agent. The result is used to regenerate endpoint policy.

# DNS lookups are repeated with an interval of 5 seconds, and are made for

# A(IPv4) and AAAA(IPv6) addresses. Should a lookup fail, the most recent IP

# data is used instead. An IP change will trigger a regeneration of the Cilium

# policy for each endpoint and increment the per cilium-agent policy

# repository revision.

# This option is disabled by default starting from version 1.4.x in favor

# of a more powerful DNS proxy-based implementation, see [0] for details.

# Enable this option if you want to use FQDN policies but do not want to use

# the DNS proxy.

# To ease upgrade, users may opt to set this option to "true".

# Otherwise please refer to the Upgrade Guide [1] which explains how to

# prepare policy rules for upgrade.

# [0] http://docs.cilium.io/en/stable/policy/language/#dns-based

# [1] http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action

tofqdns-enable-poller: "false"

# wait-bpf-mount makes init container wait until bpf filesystem is mounted

wait-bpf-mount: "false"

masquerade: "true"

enable-ipsec: "false"

enable-bpf-masquerade: "true"

ipsec-key-file: /etc/ipsec/keys

encrypt-interface: ens10

encrypt-node: "false"

enable-xt-socket-fallback: "true"

install-iptables-rules: "true"

auto-direct-node-routes: "false"

enable-bandwidth-manager: "false"

enable-local-redirect-policy: "false"

kube-proxy-replacement: "probe"

enable-host-reachable-services: "false"

kube-proxy-replacement-healthz-bind-address: ""

enable-external-ips: "false"

enable-health-check-nodeport: "true"

enable-node-port: "false"

node-port-bind-protection: "true"

enable-auto-protect-node-port-range: "true"

enable-session-affinity: "true"

enable-endpoint-health-checking: "true"

enable-health-checking: "true"

enable-well-known-identities: "false"

enable-remote-node-identity: "true"

operator-api-serve-addr: "127.0.0.1:9234"

# Enable Hubble gRPC service.

enable-hubble: "true"

# UNIX domain socket for Hubble server to listen to.

hubble-socket-path: "/var/run/cilium/hubble.sock"

ipam: "cluster-pool"

cluster-pool-ipv4-cidr: 10.224.0.0/16

cluster-pool-ipv4-mask-size: "24"

disable-cnp-status-updates: "true"

blacklist-conflicting-routes: "false"

#Inserted Configuration

native-routing-cidr: 10.0.0.0/8

enable-endpoint-routes: "true"

---

# Source: cilium/charts/agent/templates/clusterrole.yaml

# Source: cilium/templates/cilium-agent-clusterrole.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

rules:

- apiGroups:

- networking.k8s.io

resources:

- networkpolicies

verbs:

- get

- list

- watch

- apiGroups:

- discovery.k8s.io

resources:

- endpointslices

verbs:

- get

- list

- watch

- apiGroups:

- ""

resources:

- namespaces

- services

- nodes

- endpoints

verbs:

- get

- list

- watch

- apiGroups:

- ""

resources:

- pods

- nodes

- pods/finalizers

verbs:

- get

- list

- watch

- update

- apiGroups:

- delete

- ""

- apiGroups:

resources:

- ""

- nodes

resources:

- nodes/status

- nodes

verbs:

- patch

- get

- apiGroups:

- list

- apiextensions.k8s.io

- watch

resources:

- update

- customresourcedefinitions

- apiGroups:

verbs:

- ""

- create

resources:

- get

- nodes

- list

- nodes/status

- watch

verbs:

- update

- patch

- apiGroups:

- cilium.io

- apiextensions.k8s.io

resources:

- ciliumnetworkpolicies

- customresourcedefinitions

- ciliumnetworkpolicies/status

verbs:

- ciliumclusterwidenetworkpolicies

# Deprecated for removal in v1.10

- ciliumclusterwidenetworkpolicies/status

- create

- ciliumendpoints

- list

- ciliumendpoints/status

- watch

- ciliumnodes

- update

- ciliumnodes/status

- ciliumidentities

# This is used when validating policies in preflight. This will need to stay

- ciliumidentities/status

# until we figure out how to avoid "get" inside the preflight, and then

verbs:

# should be removed ideally.

- "*"

- get

- apiGroups:

- cilium.io

resources:

- ciliumnetworkpolicies

- ciliumnetworkpolicies/status

- ciliumnetworkpolicies/finalizers

- ciliumclusterwidenetworkpolicies

- ciliumclusterwidenetworkpolicies/status

- ciliumclusterwidenetworkpolicies/finalizers

- ciliumendpoints

- ciliumendpoints/status

- ciliumendpoints/finalizers

- ciliumnodes

- ciliumnodes/status

- ciliumnodes/finalizers

- ciliumidentities

- ciliumidentities/finalizers

- ciliumlocalredirectpolicies

- ciliumlocalredirectpolicies/status

- ciliumlocalredirectpolicies/finalizers

verbs:

- '*'

---

# Source: cilium/charts/operator/templates/clusterrole.yaml

# Source: cilium/templates/cilium-operator-clusterrole.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

rules:

- apiGroups:

- ""

resources:

# to automatically delete [core|kube]dns pods so that are starting to being

# managed by Cilium

- pods

verbs:

- get

- list

- watch

- delete

- apiGroups:

- discovery.k8s.io

resources:

- endpointslices

verbs:

- get

- list

- watch

- apiGroups:

- ""

resources:

# to automatically read from k8s and import the node"s pod CIDR to cilium"s

# to perform the translation of a CNP that contains `ToGroup` to its endpoints

# etcd so all nodes know how to reach another pod running in in a different

- services

# node.

- endpoints

- nodes

# to check apiserver connectivity

# to perform the translation of a CNP that contains `ToGroup` to its endpoints

- namespaces

- services

verbs:

- endpoints

- get

# to check apiserver connectivity

- list

- namespaces

- watch

verbs:

- apiGroups:

- get

- cilium.io

- list

resources:

- watch

- ciliumnetworkpolicies

- apiGroups:

- ciliumnetworkpolicies/status

- cilium.io

- ciliumnetworkpolicies/finalizers

resources:

- ciliumclusterwidenetworkpolicies

- ciliumnetworkpolicies

- ciliumclusterwidenetworkpolicies/status

- ciliumnetworkpolicies/status

- ciliumclusterwidenetworkpolicies/finalizers

- ciliumclusterwidenetworkpolicies

- ciliumendpoints

- ciliumclusterwidenetworkpolicies/status

- ciliumendpoints/status

- ciliumendpoints

- ciliumendpoints/finalizers

- ciliumendpoints/status

- ciliumnodes

- ciliumnodes/status

- ciliumnodes/finalizers

- ciliumidentities

- ciliumidentities/status

verbs:

- ciliumidentities/finalizers

- "*"

- ciliumlocalredirectpolicies

- ciliumlocalredirectpolicies/status

- ciliumlocalredirectpolicies/finalizers

verbs:

- '*'

- apiGroups:

- apiextensions.k8s.io

resources:

- customresourcedefinitions

verbs:

- create

- get

- list

- update

- watch

# For cilium-operator running in HA mode.

# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election

# between mulitple running instances.

# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less

# common and fewer objects in the cluster watch "all Leases".

# The support for leases was introduced in coordination.k8s.io/v1 during Kubernetes 1.14 release.

# In Cilium we currently don't support HA mode for K8s version < 1.14. This condition make sure

# that we only authorize access to leases resources in supported K8s versions.

- apiGroups:

- coordination.k8s.io

resources:

- leases

verbs:

- create

- get

- update

---

# Source: cilium/charts/agent/templates/clusterrolebinding.yaml

# Source: cilium/templates/cilium-agent-clusterrolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

subjects:

- kind: ServiceAccount

namespace: kube-system

---

# Source: cilium/charts/operator/templates/clusterrolebinding.yaml

# Source: cilium/templates/cilium-operator-clusterrolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

subjects:

- kind: ServiceAccount

namespace: kube-system

---

# Source: cilium/charts/agent/templates/daemonset.yaml

# Source: cilium/templates/cilium-agent-daemonset.yaml

apiVersion: apps/v1

kind: DaemonSet

metadata:

labels:

k8s-app: cilium

namespace: kube-system

spec:

selector:

matchLabels:

k8s-app: cilium

Text moved from lines 540-543

updateStrategy:

rollingUpdate:

maxUnavailable: 2

type: RollingUpdate

template:

metadata:

annotations:

prometheus.io/port: "9100"

prometheus.io/scrape: "true"

# This annotation plus the CriticalAddonsOnly toleration makes

# cilium to be a critical pod in the cluster, which ensures cilium

# gets priority scheduling.

# https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/

scheduler.alpha.kubernetes.io/critical-pod: ""

labels:

k8s-app: cilium

spec:

affinity:

podAntiAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

- labelSelector:

matchExpressions:

- key: k8s-app

operator: In

values:

- cilium

topologyKey: kubernetes.io/hostname

containers:

- args:

- --config-dir=/tmp/cilium/config-map

command:

- cilium-agent

livenessProbe:

httpGet:

host: '127.0.0.1'

path: /healthz

port: 9876

scheme: HTTP

httpHeaders:

- name: "brief"

value: "true"

failureThreshold: 10

# The initial delay for the liveness probe is intentionally large to

# avoid an endless kill & restart cycle if in the event that the initial

# bootstrapping takes longer than expected.

initialDelaySeconds: 120

periodSeconds: 30

successThreshold: 1

timeoutSeconds: 5

readinessProbe:

httpGet:

host: '127.0.0.1'

path: /healthz

port: 9876

scheme: HTTP

httpHeaders:

- name: "brief"

value: "true"

failureThreshold: 3

initialDelaySeconds: 5

periodSeconds: 30

successThreshold: 1

timeoutSeconds: 5

env:

- name: K8S_NODE_NAME

valueFrom:

fieldRef:

apiVersion: v1

fieldPath: spec.nodeName

- name: CILIUM_K8S_NAMESPACE

valueFrom:

fieldRef:

apiVersion: v1

fieldPath: metadata.namespace

- name: CILIUM_FLANNEL_MASTER_DEVICE

valueFrom:

configMapKeyRef:

key: flannel-master-device

optional: true

- name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT

valueFrom:

configMapKeyRef:

key: flannel-uninstall-on-exit

optional: true

- name: CILIUM_CLUSTERMESH_CONFIG

value: /var/lib/cilium/clustermesh/

- name: CILIUM_CNI_CHAINING_MODE

valueFrom:

configMapKeyRef:

key: cni-chaining-mode

optional: true

- name: CILIUM_CUSTOM_CNI_CONF

valueFrom:

configMapKeyRef:

key: custom-cni-conf

optional: true

image: quay.io/cilium/cilium:v1.9.0

imagePullPolicy: IfNotPresent

lifecycle:

postStart:

exec:

command:

- cilium

- "/cni-install.sh"

- status

- "--enable-debug=false"

- --brief

preStop:

failureThreshold: 10

# The initial delay for the liveness probe is intentionally large to

# avoid an endless kill & restart cycle if in the event that the initial

# bootstrapping takes longer than expected.

initialDelaySeconds: 120

periodSeconds: 30

successThreshold: 1

timeoutSeconds: 5

readinessProbe:

exec:

command:

- cilium

- /cni-uninstall.sh

- status

- --brief

securityContext:

failureThreshold: 3

capabilities:

initialDelaySeconds: 5

add:

periodSeconds: 30

- NET_ADMIN

successThreshold: 1

- SYS_MODULE

timeoutSeconds: 5

privileged: true

env:

volumeMounts:

- name: K8S_NODE_NAME

- mountPath: /sys/fs/bpf

valueFrom:

fieldRef:

- mountPath: /var/run/cilium

apiVersion: v1

fieldPath: spec.nodeName

- mountPath: /host/opt/cni/bin

- name: CILIUM_K8S_NAMESPACE

valueFrom:

- mountPath: /host/etc/cni/net.d

fieldRef:

apiVersion: v1

- mountPath: /var/lib/cilium/clustermesh

fieldPath: metadata.namespace

- name: CILIUM_FLANNEL_MASTER_DEVICE

readOnly: true

valueFrom:

- mountPath: /tmp/cilium/config-map

configMapKeyRef:

key: flannel-master-device

readOnly: true

# Needed to be able to load kernel modules

optional: true

- mountPath: /lib/modules

- name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT

valueFrom:

readOnly: true

configMapKeyRef:

- mountPath: /run/xtables.lock

key: flannel-uninstall-on-exit

optional: true

- name: CILIUM_CLUSTERMESH_CONFIG

value: /var/lib/cilium/clustermesh/

- name: CILIUM_CNI_CHAINING_MODE

valueFrom:

configMapKeyRef:

key: cni-chaining-mode

optional: true

- name: CILIUM_CUSTOM_CNI_CONF

valueFrom:

configMapKeyRef:

key: custom-cni-conf

optional: true

image: "docker.io/cilium/cilium:v1.7.1"

imagePullPolicy: IfNotPresent

lifecycle:

postStart:

exec:

command:

- "/cni-install.sh"

- "--enable-debug=false"

preStop:

exec:

command:

- /cni-uninstall.sh

ports:

- containerPort: 9100

hostPort: 9100

protocol: TCP

securityContext:

capabilities:

add:

- NET_ADMIN

- SYS_MODULE

privileged: true

volumeMounts:

- mountPath: /sys/fs/bpf

- mountPath: /var/run/cilium

- mountPath: /host/opt/cni/bin

- mountPath: /host/etc/cni/net.d

- mountPath: /var/lib/cilium/clustermesh

readOnly: true

- mountPath: /tmp/cilium/config-map

readOnly: true

# Needed to be able to load kernel modules

- mountPath: /lib/modules

readOnly: true

- mountPath: /run/xtables.lock

hostNetwork: true

initContainers:

- command:

- /init-container.sh

env:

- name: CILIUM_ALL_STATE

valueFrom:

configMapKeyRef:

key: clean-cilium-state

optional: true

- name: CILIUM_BPF_STATE

valueFrom:

configMapKeyRef:

key: clean-cilium-bpf-state

optional: true

- name: CILIUM_WAIT_BPF_MOUNT

valueFrom:

configMapKeyRef:

key: wait-bpf-mount

optional: true

image: "docker.io/cilium/cilium:v1.7.1"

image: quay.io/cilium/cilium:v1.9.0

imagePullPolicy: IfNotPresent

securityContext:

capabilities:

add:

- NET_ADMIN

privileged: true

volumeMounts:

- mountPath: /sys/fs/bpf

mountPropagation: HostToContainer

- mountPath: /var/run/cilium

resources:

requests:

cpu: 100m

memory: 100Mi

restartPolicy: Always

priorityClassName: system-node-critical

serviceAccount: cilium

serviceAccountName: cilium

terminationGracePeriodSeconds: 1

tolerations:

- operator: Exists

volumes:

# To keep state between restarts / upgrades

- hostPath:

path: /var/run/cilium

type: DirectoryOrCreate

# To keep state between restarts / upgrades for bpf maps

- hostPath:

path: /sys/fs/bpf

type: DirectoryOrCreate

# To install cilium cni plugin in the host

- hostPath:

path: /opt/cni/bin

type: DirectoryOrCreate

# To install cilium cni configuration in the host

- hostPath:

path: /etc/cni/net.d

type: DirectoryOrCreate

# To be able to load kernel modules

- hostPath:

path: /lib/modules

# To access iptables concurrently with other processes (e.g. kube-proxy)

- hostPath:

path: /run/xtables.lock

type: FileOrCreate

# To read the clustermesh configuration

- name: clustermesh-secrets

secret:

defaultMode: 420

optional: true

secretName: cilium-clustermesh

# To read the configuration from the config map

- configMap:

Text moved to lines 371-374

updateStrategy:

rollingUpdate:

maxUnavailable: 2

type: RollingUpdate

---

# Source: cilium/charts/operator/templates/deployment.yaml

# Source: cilium/templates/cilium-operator-deployment.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

labels:

io.cilium/app: operator

namespace: kube-system

spec:

replicas: 1

# We support HA mode only for Kubernetes version > 1.14

# See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go

# for more details.

replicas: 2

selector:

matchLabels:

io.cilium/app: operator

strategy:

rollingUpdate:

maxSurge: 1

maxUnavailable: 1

type: RollingUpdate

template:

metadata:

annotations:

prometheus.io/port: "6942"

prometheus.io/scrape: "true"

labels:

io.cilium/app: operator

spec:

# In HA mode, cilium-operator pods must not be scheduled on the same

# node as they will clash with each other.

affinity:

podAntiAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

- labelSelector:

matchExpressions:

- key: io.cilium/app

operator: In

values:

- operator

topologyKey: kubernetes.io/hostname

containers:

- args:

- --debug=$(CILIUM_DEBUG)

- --config-dir=/tmp/cilium/config-map

- --identity-allocation-mode=$(CILIUM_IDENTITY_ALLOCATION_MODE)

- --debug=$(CILIUM_DEBUG)

- --enable-metrics

command:

- --synchronize-k8s-nodes=true

- cilium-operator-generic

command:

env:

- cilium-operator

- name: K8S_NODE_NAME

env:

valueFrom:

- name: CILIUM_K8S_NAMESPACE

fieldRef:

valueFrom:

apiVersion: v1

fieldRef:

fieldPath: spec.nodeName

apiVersion: v1

- name: CILIUM_K8S_NAMESPACE

fieldPath: metadata.namespace

valueFrom:

- name: K8S_NODE_NAME

fieldRef:

valueFrom:

apiVersion: v1

fieldRef:

fieldPath: metadata.namespace

apiVersion: v1

- name: CILIUM_DEBUG

fieldPath: spec.nodeName

valueFrom:

- name: CILIUM_DEBUG

configMapKeyRef:

valueFrom:

key: debug

configMapKeyRef:

key: debug

optional: true

image: quay.io/cilium/operator-generic:v1.9.0

optional: true

imagePullPolicy: IfNotPresent

- name: CILIUM_CLUSTER_NAME

valueFrom:

livenessProbe:

configMapKeyRef:

httpGet:

key: cluster-name

host: '127.0.0.1'

path: /healthz

optional: true

port: 9234

- name: CILIUM_CLUSTER_ID

scheme: HTTP

valueFrom:

initialDelaySeconds: 60

configMapKeyRef:

periodSeconds: 10

key: cluster-id

timeoutSeconds: 3

volumeMounts:

optional: true

- mountPath: /tmp/cilium/config-map

- name: CILIUM_IPAM

valueFrom:

readOnly: true

configMapKeyRef:

key: ipam

optional: true

- name: CILIUM_DISABLE_ENDPOINT_CRD

valueFrom:

configMapKeyRef:

key: disable-endpoint-crd

optional: true

- name: CILIUM_KVSTORE

valueFrom:

configMapKeyRef:

key: kvstore

optional: true

- name: CILIUM_KVSTORE_OPT

valueFrom:

configMapKeyRef:

key: kvstore-opt

optional: true

- name: AWS_ACCESS_KEY_ID

valueFrom:

secretKeyRef:

key: AWS_ACCESS_KEY_ID

optional: true

- name: AWS_SECRET_ACCESS_KEY

valueFrom:

secretKeyRef:

key: AWS_SECRET_ACCESS_KEY

optional: true

- name: AWS_DEFAULT_REGION

valueFrom:

secretKeyRef:

key: AWS_DEFAULT_REGION

optional: true

- name: CILIUM_IDENTITY_ALLOCATION_MODE

valueFrom:

configMapKeyRef:

key: identity-allocation-mode

optional: true

image: "docker.io/cilium/operator:v1.7.1"

imagePullPolicy: IfNotPresent

ports:

- containerPort: 6942

hostPort: 6942

protocol: TCP

livenessProbe:

httpGet:

host: "127.0.0.1"

path: /healthz

port: 9234

scheme: HTTP

initialDelaySeconds: 60

periodSeconds: 10

timeoutSeconds: 3

hostNetwork: true

restartPolicy: Always

priorityClassName: system-cluster-critical

serviceAccount: cilium-operator

serviceAccountName: cilium-operator

tolerations:

- operator: Exists

volumes:

# To read the configuration from the config map

- configMap:

已保存差异

原始文本

打开文件

---
# Source: cilium/charts/agent/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium
  namespace: kube-system
---
# Source: cilium/charts/operator/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium-operator
  namespace: kube-system
---
# Source: cilium/charts/config/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:

# Identity allocation mode selects how identities are shared between cilium
  # nodes by setting how they are stored. The options are "crd" or "kvstore".
  # - "crd" stores identities in kubernetes as CRDs (custom resource definition).
  #   These can be queried with:
  #     kubectl get ciliumid
  # - "kvstore" stores identities in a kvstore, etcd or consul, that is
  #   configured below. Cilium versions before 1.6 supported only the kvstore
  #   backend. Upgrades from these older cilium versions should continue using
  #   the kvstore by commenting out the identity-allocation-mode below, or
  #   setting it to "kvstore".
  identity-allocation-mode: crd

# If you want to run cilium in debug mode change this value to true
  debug: "false"
  # If you want metrics enabled in all of your Cilium agents, set the port for
  # which the Cilium agents will have their metrics exposed.
  # This option deprecates the "prometheus-serve-addr" in the
  # "cilium-metrics-config" ConfigMap
  # NOTE that this will open the port on ALL nodes where Cilium pods are
  # scheduled.
  prometheus-serve-addr: ":9100"

# Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
  # address.
  enable-ipv4: "true"

# Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
  # address.
  enable-ipv6: "false"

# If you want cilium monitor to aggregate tracing for packets, set this level
  # to "low", "medium", or "maximum". The higher the level, the less packets
  # that will be seen in monitor output.
  monitor-aggregation: medium

# The monitor aggregation interval governs the typical time between monitor
  # notification events for each allowed connection.
  #
  # Only effective when monitor aggregation is set to "medium" or higher.
  monitor-aggregation-interval: 5s

# ct-global-max-entries-* specifies the maximum number of connections
  # supported across all endpoints, split by protocol: tcp or other. One pair
  # of maps uses these values for IPv4 connections, and another pair of maps
  # use these values for IPv6 connections.
  #
  # If these values are modified, then during the next Cilium startup the
  # tracking of ongoing connections may be disrupted. This may lead to brief
  # policy drops or a change in loadbalancing decisions for a connection.
  #
  # For users upgrading from Cilium 1.2 or earlier, to minimize disruption
  # during the upgrade process, comment out these options.
  bpf-ct-global-tcp-max: "524288"
  bpf-ct-global-any-max: "262144"

# Pre-allocation of map entries allows per-packet latency to be reduced, at
  # the expense of up-front memory allocation for the entries in the maps. The
  # default value below will minimize memory usage in the default installation;
  # users who are sensitive to latency may consider setting this to "true".
  #
  # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
  # this option and behave as though it is set to "true".
  #
  # If this value is modified, then during the next Cilium startup the restore
  # of existing endpoints and tracking of ongoing connections may be disrupted.
  # This may lead to policy drops or a change in loadbalancing decisions for a
  # connection for some time. Endpoints may need to be recreated to restore
  # connectivity.
  #
  # If this option is set to "false" during an upgrade from 1.3 or earlier to
  # 1.4 or later, then it may cause one-time disruptions during the upgrade.
  preallocate-bpf-maps: "false"

# Regular expression matching compatible Istio sidecar istio-proxy
  # container image names
  sidecar-istio-proxy-image: "cilium/istio_proxy"

# Encapsulation mode for communication between nodes
  # Possible values:
  #   - disabled
  #   - vxlan (default)
  #   - geneve
  tunnel: disabled

# Name of the cluster. Only relevant when building a mesh of clusters.
  cluster-name: default

# DNS Polling periodically issues a DNS lookup for each `matchName` from
  # cilium-agent. The result is used to regenerate endpoint policy.
  # DNS lookups are repeated with an interval of 5 seconds, and are made for
  # A(IPv4) and AAAA(IPv6) addresses. Should a lookup fail, the most recent IP
  # data is used instead. An IP change will trigger a regeneration of the Cilium
  # policy for each endpoint and increment the per cilium-agent policy
  # repository revision.
  #
  # This option is disabled by default starting from version 1.4.x in favor
  # of a more powerful DNS proxy-based implementation, see [0] for details.
  # Enable this option if you want to use FQDN policies but do not want to use
  # the DNS proxy.
  #
  # To ease upgrade, users may opt to set this option to "true".
  # Otherwise please refer to the Upgrade Guide [1] which explains how to
  # prepare policy rules for upgrade.
  #
  # [0] http://docs.cilium.io/en/stable/policy/language/#dns-based
  # [1] http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action
  tofqdns-enable-poller: "false"

# wait-bpf-mount makes init container wait until bpf filesystem is mounted
  wait-bpf-mount: "false"

masquerade: "true"
  enable-ipsec: "false"
  ipsec-key-file: /etc/ipsec/keys
  encrypt-interface: ens10
  encrypt-node: "false"
  enable-xt-socket-fallback: "true"
  install-iptables-rules: "true"
  auto-direct-node-routes: "false"
  kube-proxy-replacement:  "probe"
  enable-host-reachable-services: "false"
  enable-external-ips: "false"
  enable-node-port: "false"
  enable-well-known-identities: "false"
  enable-remote-node-identity: "true"

blacklist-conflicting-routes: "false"
---
# Source: cilium/charts/agent/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
rules:
  - apiGroups:
      - networking.k8s.io
    resources:
      - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - namespaces
      - services
      - nodes
      - endpoints
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - pods
      - nodes
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - ""
    resources:
      - nodes
      - nodes/status
    verbs:
      - patch
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - create
      - get
      - list
      - watch
      - update
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnetworkpolicies
      - ciliumnetworkpolicies/status
      - ciliumclusterwidenetworkpolicies
      - ciliumclusterwidenetworkpolicies/status
      - ciliumendpoints
      - ciliumendpoints/status
      - ciliumnodes
      - ciliumnodes/status
      - ciliumidentities
      - ciliumidentities/status
    verbs:
      - "*"
---
# Source: cilium/charts/operator/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium-operator
rules:
  - apiGroups:
      - ""
    resources:
      # to automatically delete [core|kube]dns pods so that are starting to being
      # managed by Cilium
      - pods
    verbs:
      - get
      - list
      - watch
      - delete
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      # to automatically read from k8s and import the node"s pod CIDR to cilium"s
      # etcd so all nodes know how to reach another pod running in in a different
      # node.
      - nodes
      # to perform the translation of a CNP that contains `ToGroup` to its endpoints
      - services
      - endpoints
      # to check apiserver connectivity
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnetworkpolicies
      - ciliumnetworkpolicies/status
      - ciliumclusterwidenetworkpolicies
      - ciliumclusterwidenetworkpolicies/status
      - ciliumendpoints
      - ciliumendpoints/status
      - ciliumnodes
      - ciliumnodes/status
      - ciliumidentities
      - ciliumidentities/status
    verbs:
      - "*"
---
# Source: cilium/charts/agent/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium
subjects:
  - kind: ServiceAccount
    name: cilium
    namespace: kube-system
---
# Source: cilium/charts/operator/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium-operator
subjects:
  - kind: ServiceAccount
    name: cilium-operator
    namespace: kube-system
---
# Source: cilium/charts/agent/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    k8s-app: cilium
  name: cilium
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: cilium
  template:
    metadata:
      annotations:
        prometheus.io/port: "9100"
        prometheus.io/scrape: "true"
        # This annotation plus the CriticalAddonsOnly toleration makes
        # cilium to be a critical pod in the cluster, which ensures cilium
        # gets priority scheduling.
        # https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
        scheduler.alpha.kubernetes.io/critical-pod: ""
      labels:
        k8s-app: cilium
    spec:
      containers:
        - args:
            - --config-dir=/tmp/cilium/config-map
          command:
            - cilium-agent
          livenessProbe:
            exec:
              command:
                - cilium
                - status
                - --brief
            failureThreshold: 10
            # The initial delay for the liveness probe is intentionally large to
            # avoid an endless kill & restart cycle if in the event that the initial
            # bootstrapping takes longer than expected.
            initialDelaySeconds: 120
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            exec:
              command:
                - cilium
                - status
                - --brief
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 5
          env:
            - name: K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: CILIUM_K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: CILIUM_FLANNEL_MASTER_DEVICE
              valueFrom:
                configMapKeyRef:
                  key: flannel-master-device
                  name: cilium-config
                  optional: true
            - name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT
              valueFrom:
                configMapKeyRef:
                  key: flannel-uninstall-on-exit
                  name: cilium-config
                  optional: true
            - name: CILIUM_CLUSTERMESH_CONFIG
              value: /var/lib/cilium/clustermesh/
            - name: CILIUM_CNI_CHAINING_MODE
              valueFrom:
                configMapKeyRef:
                  key: cni-chaining-mode
                  name: cilium-config
                  optional: true
            - name: CILIUM_CUSTOM_CNI_CONF
              valueFrom:
                configMapKeyRef:
                  key: custom-cni-conf
                  name: cilium-config
                  optional: true
          image: "docker.io/cilium/cilium:v1.7.1"
          imagePullPolicy: IfNotPresent
          lifecycle:
            postStart:
              exec:
                command:
                  - "/cni-install.sh"
                  - "--enable-debug=false"
            preStop:
              exec:
                command:
                  - /cni-uninstall.sh
          name: cilium-agent
          ports:
            - containerPort: 9100
              hostPort: 9100
              name: prometheus
              protocol: TCP
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
                - SYS_MODULE
            privileged: true
          volumeMounts:
            - mountPath: /sys/fs/bpf
              name: bpf-maps
            - mountPath: /var/run/cilium
              name: cilium-run
            - mountPath: /host/opt/cni/bin
              name: cni-path
            - mountPath: /host/etc/cni/net.d
              name: etc-cni-netd
            - mountPath: /var/lib/cilium/clustermesh
              name: clustermesh-secrets
              readOnly: true
            - mountPath: /tmp/cilium/config-map
              name: cilium-config-path
              readOnly: true
              # Needed to be able to load kernel modules
            - mountPath: /lib/modules
              name: lib-modules
              readOnly: true
            - mountPath: /run/xtables.lock
              name: xtables-lock
      hostNetwork: true
      initContainers:
        - command:
            - /init-container.sh
          env:
            - name: CILIUM_ALL_STATE
              valueFrom:
                configMapKeyRef:
                  key: clean-cilium-state
                  name: cilium-config
                  optional: true
            - name: CILIUM_BPF_STATE
              valueFrom:
                configMapKeyRef:
                  key: clean-cilium-bpf-state
                  name: cilium-config
                  optional: true
            - name: CILIUM_WAIT_BPF_MOUNT
              valueFrom:
                configMapKeyRef:
                  key: wait-bpf-mount
                  name: cilium-config
                  optional: true
          image: "docker.io/cilium/cilium:v1.7.1"
          imagePullPolicy: IfNotPresent
          name: clean-cilium-state
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
            privileged: true
          volumeMounts:
            - mountPath: /sys/fs/bpf
              name: bpf-maps
              mountPropagation: HostToContainer
            - mountPath: /var/run/cilium
              name: cilium-run
      restartPolicy: Always
      priorityClassName: system-node-critical
      serviceAccount: cilium
      serviceAccountName: cilium
      terminationGracePeriodSeconds: 1
      tolerations:
        - operator: Exists
      volumes:
        # To keep state between restarts / upgrades
        - hostPath:
            path: /var/run/cilium
            type: DirectoryOrCreate
          name: cilium-run
          # To keep state between restarts / upgrades for bpf maps
        - hostPath:
            path: /sys/fs/bpf
            type: DirectoryOrCreate
          name: bpf-maps
        # To install cilium cni plugin in the host
        - hostPath:
            path:  /opt/cni/bin
            type: DirectoryOrCreate
          name: cni-path
          # To install cilium cni configuration in the host
        - hostPath:
            path: /etc/cni/net.d
            type: DirectoryOrCreate
          name: etc-cni-netd
          # To be able to load kernel modules
        - hostPath:
            path: /lib/modules
          name: lib-modules
          # To access iptables concurrently with other processes (e.g. kube-proxy)
        - hostPath:
            path: /run/xtables.lock
            type: FileOrCreate
          name: xtables-lock
          # To read the clustermesh configuration
        - name: clustermesh-secrets
          secret:
            defaultMode: 420
            optional: true
            secretName: cilium-clustermesh
          # To read the configuration from the config map
        - configMap:
            name: cilium-config
          name: cilium-config-path
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
---
# Source: cilium/charts/operator/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    io.cilium/app: operator
    name: cilium-operator
  name: cilium-operator
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        prometheus.io/port: "6942"
        prometheus.io/scrape: "true"
      labels:
        io.cilium/app: operator
        name: cilium-operator
    spec:
      containers:
        - args:
            - --debug=$(CILIUM_DEBUG)
            - --identity-allocation-mode=$(CILIUM_IDENTITY_ALLOCATION_MODE)
            - --enable-metrics
            - --synchronize-k8s-nodes=true
          command:
            - cilium-operator
          env:
            - name: CILIUM_K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: CILIUM_DEBUG
              valueFrom:
                configMapKeyRef:
                  key: debug
                  name: cilium-config
                  optional: true
            - name: CILIUM_CLUSTER_NAME
              valueFrom:
                configMapKeyRef:
                  key: cluster-name
                  name: cilium-config
                  optional: true
            - name: CILIUM_CLUSTER_ID
              valueFrom:
                configMapKeyRef:
                  key: cluster-id
                  name: cilium-config
                  optional: true
            - name: CILIUM_IPAM
              valueFrom:
                configMapKeyRef:
                  key: ipam
                  name: cilium-config
                  optional: true
            - name: CILIUM_DISABLE_ENDPOINT_CRD
              valueFrom:
                configMapKeyRef:
                  key: disable-endpoint-crd
                  name: cilium-config
                  optional: true
            - name: CILIUM_KVSTORE
              valueFrom:
                configMapKeyRef:
                  key: kvstore
                  name: cilium-config
                  optional: true
            - name: CILIUM_KVSTORE_OPT
              valueFrom:
                configMapKeyRef:
                  key: kvstore-opt
                  name: cilium-config
                  optional: true
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  key: AWS_ACCESS_KEY_ID
                  name: cilium-aws
                  optional: true
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  key: AWS_SECRET_ACCESS_KEY
                  name: cilium-aws
                  optional: true
            - name: AWS_DEFAULT_REGION
              valueFrom:
                secretKeyRef:
                  key: AWS_DEFAULT_REGION
                  name: cilium-aws
                  optional: true
            - name: CILIUM_IDENTITY_ALLOCATION_MODE
              valueFrom:
                configMapKeyRef:
                  key: identity-allocation-mode
                  name: cilium-config
                  optional: true
          image: "docker.io/cilium/operator:v1.7.1"
          imagePullPolicy: IfNotPresent
          name: cilium-operator
          ports:
            - containerPort: 6942
              hostPort: 6942
              name: prometheus
              protocol: TCP
          livenessProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9234
              scheme: HTTP
            initialDelaySeconds: 60
            periodSeconds: 10
            timeoutSeconds: 3
      hostNetwork: true
      restartPolicy: Always
      serviceAccount: cilium-operator
      serviceAccountName: cilium-operator

更改后文本

打开文件

---
# Source: cilium/templates/cilium-agent-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium
  namespace: kube-system
---
# Source: cilium/templates/cilium-operator-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium-operator
  namespace: kube-system
---
# Source: cilium/templates/cilium-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:

# If you want to run cilium in debug mode change this value to true
  debug: "false"

# Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
  # address.
  enable-ipv4: "true"

# Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
  # address.
  enable-ipv6: "false"
  # Users who wish to specify their own custom CNI configuration file must set
  # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.
  custom-cni-conf: "false"
  enable-bpf-clock-probe: "true"
  # If you want cilium monitor to aggregate tracing for packets, set this level
  # to "low", "medium", or "maximum". The higher the level, the less packets
  # that will be seen in monitor output.
  monitor-aggregation: medium

# The monitor aggregation flags determine which TCP flags which, upon the
  # first observation, cause monitor notifications to be generated.
  #
  # Only effective when monitor aggregation is set to "medium" or higher.
  monitor-aggregation-flags: all
  # Specifies the ratio (0.0-1.0) of total system memory to use for dynamic
  # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
  bpf-map-dynamic-size-ratio: "0.0025"
  # bpf-policy-map-max specifies the maximum number of entries in endpoint
  # policy map (per endpoint)
  bpf-policy-map-max: "16384"
  # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,
  # backend and affinity maps.
  bpf-lb-map-max: "65536"
  # Pre-allocation of map entries allows per-packet latency to be reduced, at
  # the expense of up-front memory allocation for the entries in the maps. The
  # default value below will minimize memory usage in the default installation;
  # users who are sensitive to latency may consider setting this to "true".
  #
  # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
  # this option and behave as though it is set to "true".
  #
  # If this value is modified, then during the next Cilium startup the restore
  # of existing endpoints and tracking of ongoing connections may be disrupted.
  # As a result, reply packets may be dropped and the load-balancing decisions
  # for established connections may change.
  #
  # If this option is set to "false" during an upgrade from 1.3 or earlier to
  # 1.4 or later, then it may cause one-time disruptions during the upgrade.
  preallocate-bpf-maps: "false"

# Regular expression matching compatible Istio sidecar istio-proxy
  # container image names
  sidecar-istio-proxy-image: "cilium/istio_proxy"

# Encapsulation mode for communication between nodes
  # Possible values:
  #   - disabled
  #   - vxlan (default)
  #   - geneve
  tunnel: disabled

# Name of the cluster. Only relevant when building a mesh of clusters.
  cluster-name: default
  # Enables L7 proxy for L7 policy enforcement and visibility
  enable-l7-proxy: "true"

# wait-bpf-mount makes init container wait until bpf filesystem is mounted
  wait-bpf-mount: "false"

masquerade: "true"
  enable-bpf-masquerade: "true"

enable-xt-socket-fallback: "true"
  install-iptables-rules: "true"

auto-direct-node-routes: "false"
  enable-bandwidth-manager: "false"
  enable-local-redirect-policy: "false"
  kube-proxy-replacement:  "probe"
  kube-proxy-replacement-healthz-bind-address: ""
  enable-health-check-nodeport: "true"
  node-port-bind-protection: "true"
  enable-auto-protect-node-port-range: "true"
  enable-session-affinity: "true"
  enable-endpoint-health-checking: "true"
  enable-health-checking: "true"
  enable-well-known-identities: "false"
  enable-remote-node-identity: "true"
  operator-api-serve-addr: "127.0.0.1:9234"
  # Enable Hubble gRPC service.
  enable-hubble: "true"
  # UNIX domain socket for Hubble server to listen to.
  hubble-socket-path:  "/var/run/cilium/hubble.sock"
  ipam: "cluster-pool"
  cluster-pool-ipv4-cidr: 10.224.0.0/16
  cluster-pool-ipv4-mask-size: "24"
  disable-cnp-status-updates: "true"

#Inserted Configuration
  native-routing-cidr: 10.0.0.0/8
  enable-endpoint-routes: "true"
---
# Source: cilium/templates/cilium-agent-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
rules:
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  - services
  - nodes
  - endpoints
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  - pods/finalizers
  verbs:
  - get
  - list
  - watch
  - update
  - delete
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - ""
  resources:
  - nodes
  - nodes/status
  verbs:
  - patch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  # Deprecated for removal in v1.10
  - create
  - list
  - watch
  - update

# This is used when validating policies in preflight. This will need to stay
  # until we figure out how to avoid "get" inside the preflight, and then
  # should be removed ideally.
  - get
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies
  - ciliumnetworkpolicies/status
  - ciliumnetworkpolicies/finalizers
  - ciliumclusterwidenetworkpolicies
  - ciliumclusterwidenetworkpolicies/status
  - ciliumclusterwidenetworkpolicies/finalizers
  - ciliumendpoints
  - ciliumendpoints/status
  - ciliumendpoints/finalizers
  - ciliumnodes
  - ciliumnodes/status
  - ciliumnodes/finalizers
  - ciliumidentities
  - ciliumidentities/finalizers
  - ciliumlocalredirectpolicies
  - ciliumlocalredirectpolicies/status
  - ciliumlocalredirectpolicies/finalizers
  verbs:
  - '*'
---
# Source: cilium/templates/cilium-operator-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium-operator
rules:
- apiGroups:
  - ""
  resources:
  # to automatically delete [core|kube]dns pods so that are starting to being
  # managed by Cilium
  - pods
  verbs:
  - get
  - list
  - watch
  - delete
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  # to perform the translation of a CNP that contains `ToGroup` to its endpoints
  - services
  - endpoints
  # to check apiserver connectivity
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies
  - ciliumnetworkpolicies/status
  - ciliumnetworkpolicies/finalizers
  - ciliumclusterwidenetworkpolicies
  - ciliumclusterwidenetworkpolicies/status
  - ciliumclusterwidenetworkpolicies/finalizers
  - ciliumendpoints
  - ciliumendpoints/status
  - ciliumendpoints/finalizers
  - ciliumnodes
  - ciliumnodes/status
  - ciliumnodes/finalizers
  - ciliumidentities
  - ciliumidentities/status
  - ciliumidentities/finalizers
  - ciliumlocalredirectpolicies
  - ciliumlocalredirectpolicies/status
  - ciliumlocalredirectpolicies/finalizers
  verbs:
  - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - create
  - get
  - list
  - update
  - watch
# For cilium-operator running in HA mode.
#
# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election
# between mulitple running instances.
# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less
# common and fewer objects in the cluster watch "all Leases".
# The support for leases was introduced in coordination.k8s.io/v1 during Kubernetes 1.14 release.
# In Cilium we currently don't support HA mode for K8s version < 1.14. This condition make sure
# that we only authorize access to leases resources in supported K8s versions.
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - get
  - update
---
# Source: cilium/templates/cilium-agent-clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium
subjects:
- kind: ServiceAccount
  name: cilium
  namespace: kube-system
---
# Source: cilium/templates/cilium-operator-clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium-operator
subjects:
- kind: ServiceAccount
  name: cilium-operator
  namespace: kube-system
---
# Source: cilium/templates/cilium-agent-daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    k8s-app: cilium
  name: cilium
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: cilium
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
  template:
    metadata:
      annotations:
        # This annotation plus the CriticalAddonsOnly toleration makes
        # cilium to be a critical pod in the cluster, which ensures cilium
        # gets priority scheduling.
        # https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
        scheduler.alpha.kubernetes.io/critical-pod: ""
      labels:
        k8s-app: cilium
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: k8s-app
                operator: In
                values:
                - cilium
            topologyKey: kubernetes.io/hostname
      containers:
      - args:
        - --config-dir=/tmp/cilium/config-map
        command:
        - cilium-agent
        livenessProbe:
          httpGet:
            host: '127.0.0.1'
            path: /healthz
            port: 9876
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          failureThreshold: 10
          # The initial delay for the liveness probe is intentionally large to
          # avoid an endless kill & restart cycle if in the event that the initial
          # bootstrapping takes longer than expected.
          initialDelaySeconds: 120
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            host: '127.0.0.1'
            path: /healthz
            port: 9876
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          failureThreshold: 3
          initialDelaySeconds: 5
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 5
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_FLANNEL_MASTER_DEVICE
          valueFrom:
            configMapKeyRef:
              key: flannel-master-device
              name: cilium-config
              optional: true
        - name: CILIUM_FLANNEL_UNINSTALL_ON_EXIT
          valueFrom:
            configMapKeyRef:
              key: flannel-uninstall-on-exit
              name: cilium-config
              optional: true
        - name: CILIUM_CLUSTERMESH_CONFIG
          value: /var/lib/cilium/clustermesh/
        - name: CILIUM_CNI_CHAINING_MODE
          valueFrom:
            configMapKeyRef:
              key: cni-chaining-mode
              name: cilium-config
              optional: true
        - name: CILIUM_CUSTOM_CNI_CONF
          valueFrom:
            configMapKeyRef:
              key: custom-cni-conf
              name: cilium-config
              optional: true
        image: quay.io/cilium/cilium:v1.9.0
        imagePullPolicy: IfNotPresent
        lifecycle:
          postStart:
            exec:
              command:
              - "/cni-install.sh"
              - "--enable-debug=false"
          preStop:
            exec:
              command:
              - /cni-uninstall.sh
        name: cilium-agent
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
            - SYS_MODULE
          privileged: true
        volumeMounts:
        - mountPath: /sys/fs/bpf
          name: bpf-maps
        - mountPath: /var/run/cilium
          name: cilium-run
        - mountPath: /host/opt/cni/bin
          name: cni-path
        - mountPath: /host/etc/cni/net.d
          name: etc-cni-netd
        - mountPath: /var/lib/cilium/clustermesh
          name: clustermesh-secrets
          readOnly: true
        - mountPath: /tmp/cilium/config-map
          name: cilium-config-path
          readOnly: true
          # Needed to be able to load kernel modules
        - mountPath: /lib/modules
          name: lib-modules
          readOnly: true
        - mountPath: /run/xtables.lock
          name: xtables-lock
      hostNetwork: true
      initContainers:
      - command:
        - /init-container.sh
        env:
        - name: CILIUM_ALL_STATE
          valueFrom:
            configMapKeyRef:
              key: clean-cilium-state
              name: cilium-config
              optional: true
        - name: CILIUM_BPF_STATE
          valueFrom:
            configMapKeyRef:
              key: clean-cilium-bpf-state
              name: cilium-config
              optional: true
        - name: CILIUM_WAIT_BPF_MOUNT
          valueFrom:
            configMapKeyRef:
              key: wait-bpf-mount
              name: cilium-config
              optional: true
        image: quay.io/cilium/cilium:v1.9.0
        imagePullPolicy: IfNotPresent
        name: clean-cilium-state
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
          privileged: true
        volumeMounts:
        - mountPath: /sys/fs/bpf
          name: bpf-maps
          mountPropagation: HostToContainer
        - mountPath: /var/run/cilium
          name: cilium-run
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
      restartPolicy: Always
      priorityClassName: system-node-critical
      serviceAccount: cilium
      serviceAccountName: cilium
      terminationGracePeriodSeconds: 1
      tolerations:
      - operator: Exists
      volumes:
        # To keep state between restarts / upgrades
      - hostPath:
          path: /var/run/cilium
          type: DirectoryOrCreate
        name: cilium-run
        # To keep state between restarts / upgrades for bpf maps
      - hostPath:
          path: /sys/fs/bpf
          type: DirectoryOrCreate
        name: bpf-maps
      # To install cilium cni plugin in the host
      - hostPath:
          path:  /opt/cni/bin
          type: DirectoryOrCreate
        name: cni-path
        # To install cilium cni configuration in the host
      - hostPath:
          path: /etc/cni/net.d
          type: DirectoryOrCreate
        name: etc-cni-netd
        # To be able to load kernel modules
      - hostPath:
          path: /lib/modules
        name: lib-modules
        # To access iptables concurrently with other processes (e.g. kube-proxy)
      - hostPath:
          path: /run/xtables.lock
          type: FileOrCreate
        name: xtables-lock
        # To read the clustermesh configuration
      - name: clustermesh-secrets
        secret:
          defaultMode: 420
          optional: true
          secretName: cilium-clustermesh
        # To read the configuration from the config map
      - configMap:
          name: cilium-config
        name: cilium-config-path
---
# Source: cilium/templates/cilium-operator-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    io.cilium/app: operator
    name: cilium-operator
  name: cilium-operator
  namespace: kube-system
spec:
  # We support HA mode only for Kubernetes version > 1.14
  # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go
  # for more details.
  replicas: 2
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
      labels:
        io.cilium/app: operator
        name: cilium-operator
    spec:
      # In HA mode, cilium-operator pods must not be scheduled on the same
      # node as they will clash with each other.
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: io.cilium/app
                operator: In
                values:
                - operator
            topologyKey: kubernetes.io/hostname
      containers:
      - args:
        - --config-dir=/tmp/cilium/config-map
        - --debug=$(CILIUM_DEBUG)
        command:
        - cilium-operator-generic
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_DEBUG
          valueFrom:
            configMapKeyRef:
              key: debug
              name: cilium-config
              optional: true
        image: quay.io/cilium/operator-generic:v1.9.0
        imagePullPolicy: IfNotPresent
        name: cilium-operator
        livenessProbe:
          httpGet:
            host: '127.0.0.1'
            path: /healthz
            port: 9234
            scheme: HTTP
          initialDelaySeconds: 60
          periodSeconds: 10
          timeoutSeconds: 3
        volumeMounts:
        - mountPath: /tmp/cilium/config-map
          name: cilium-config-path
          readOnly: true
      hostNetwork: true
      restartPolicy: Always
      priorityClassName: system-cluster-critical
      serviceAccount: cilium-operator
      serviceAccountName: cilium-operator
      tolerations:
      - operator: Exists
      volumes:
        # To read the configuration from the config map
      - configMap:
          name: cilium-config
        name: cilium-config-path