比較文本

尋找兩個文字檔案之間的差異

即時編輯器
隱藏空白變更
摺疊未變更行
關閉換行
檢視
比對精度
文字樣式
語法突出顯示

Untitled diff

建立於 差異永不過期
5 刪除
470 行
76 新增
531 行
---
apiVersion: extensions/v1beta1
kind: PodSecurityPolicy
metadata:
name: psp.flannel.unprivileged
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
privileged: false
volumes:
- configMap
- secret
- emptyDir
- hostPath
allowedHostPaths:
- pathPrefix: "/etc/cni/net.d"
- pathPrefix: "/etc/kube-flannel"
- pathPrefix: "/run/flannel"
readOnlyRootFilesystem: false
# Users and groups
runAsUser:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
fsGroup:
rule: RunAsAny
# Privilege Escalation
allowPrivilegeEscalation: false
defaultAllowPrivilegeEscalation: false
# Capabilities
allowedCapabilities: ['NET_ADMIN']
defaultAddCapabilities: []
requiredDropCapabilities: []
# Host namespaces
hostPID: false
hostIPC: false
hostNetwork: true
hostPorts:
- min: 0
max: 65535
# SELinux
seLinux:
# SELinux is unsed in CaaSP
rule: 'RunAsAny'
---
---
kind: ClusterRole
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
metadata:
name: flannel
name: flannel
rules:
rules:
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: ['psp.flannel.unprivileged']
- apiGroups:
- apiGroups:
- ""
- ""
resources:
resources:
- pods
- pods
verbs:
verbs:
- get
- get
- apiGroups:
- apiGroups:
- ""
- ""
resources:
resources:
- nodes
- nodes
verbs:
verbs:
- list
- list
- watch
- watch
- apiGroups:
- apiGroups:
- ""
- ""
resources:
resources:
- nodes/status
- nodes/status
verbs:
verbs:
- patch
- patch
---
---
kind: ClusterRoleBinding
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
metadata:
name: flannel
name: flannel
roleRef:
roleRef:
apiGroup: rbac.authorization.k8s.io
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
kind: ClusterRole
name: flannel
name: flannel
subjects:
subjects:
- kind: ServiceAccount
- kind: ServiceAccount
name: flannel
name: flannel
namespace: kube-system
namespace: kube-system
---
---
apiVersion: v1
apiVersion: v1
kind: ServiceAccount
kind: ServiceAccount
metadata:
metadata:
name: flannel
name: flannel
namespace: kube-system
namespace: kube-system
---
---
kind: ConfigMap
kind: ConfigMap
apiVersion: v1
apiVersion: v1
metadata:
metadata:
name: kube-flannel-cfg
name: kube-flannel-cfg
namespace: kube-system
namespace: kube-system
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
data:
data:
cni-conf.json: |
cni-conf.json: |
{
{
"name": "cbr0",
"name": "cbr0",
"plugins": [
"plugins": [
{
{
"type": "flannel",
"type": "flannel",
"delegate": {
"delegate": {
"hairpinMode": true,
"hairpinMode": true,
"isDefaultGateway": true
"isDefaultGateway": true
}
}
},
},
{
{
"type": "portmap",
"type": "portmap",
"capabilities": {
"capabilities": {
"portMappings": true
"portMappings": true
}
}
}
}
]
]
}
}
net-conf.json: |
net-conf.json: |
{
{
"Network": "10.244.0.0/16",
"Network": "10.244.0.0/16",
"Backend": {
"Backend": {
"Type": "vxlan"
"Type": "vxlan"
}
}
}
}
---
---
apiVersion: extensions/v1beta1
apiVersion: extensions/v1beta1
kind: DaemonSet
kind: DaemonSet
metadata:
metadata:
name: kube-flannel-ds-amd64
name: kube-flannel-ds-amd64
namespace: kube-system
namespace: kube-system
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
template:
template:
metadata:
metadata:
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
hostNetwork: true
hostNetwork: true
nodeSelector:
nodeSelector:
beta.kubernetes.io/arch: amd64
beta.kubernetes.io/arch: amd64
tolerations:
tolerations:
- operator: Exists
- operator: Exists
effect: NoSchedule
effect: NoSchedule
serviceAccountName: flannel
serviceAccountName: flannel
initContainers:
initContainers:
- name: install-cni
- name: install-cni
image: quay.io/coreos/flannel:v0.11.0-amd64
image: quay.io/coreos/flannel:v0.11.0-amd64
command:
command:
- cp
- cp
args:
args:
- -f
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
volumeMounts:
- name: cni
- name: cni
mountPath: /etc/cni/net.d
mountPath: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
containers:
containers:
- name: kube-flannel
- name: kube-flannel
image: quay.io/coreos/flannel:v0.11.0-amd64
image: quay.io/coreos/flannel:v0.11.0-amd64
command:
command:
- /opt/bin/flanneld
- /opt/bin/flanneld
args:
args:
- --ip-masq
- --ip-masq
- --kube-subnet-mgr
- --kube-subnet-mgr
resources:
resources:
requests:
requests:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
limits:
limits:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
securityContext:
securityContext:
privileged: true
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
env:
- name: POD_NAME
- name: POD_NAME
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.name
fieldPath: metadata.name
- name: POD_NAMESPACE
- name: POD_NAMESPACE
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.namespace
fieldPath: metadata.namespace
volumeMounts:
volumeMounts:
- name: run
- name: run
mountPath: /run
mountPath: /run/flannel
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
volumes:
volumes:
- name: run
- name: run
hostPath:
hostPath:
path: /run
path: /run/flannel
- name: cni
- name: cni
hostPath:
hostPath:
path: /etc/cni/net.d
path: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
configMap:
configMap:
name: kube-flannel-cfg
name: kube-flannel-cfg
---
---
apiVersion: extensions/v1beta1
apiVersion: extensions/v1beta1
kind: DaemonSet
kind: DaemonSet
metadata:
metadata:
name: kube-flannel-ds-arm64
name: kube-flannel-ds-arm64
namespace: kube-system
namespace: kube-system
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
template:
template:
metadata:
metadata:
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
hostNetwork: true
hostNetwork: true
nodeSelector:
nodeSelector:
beta.kubernetes.io/arch: arm64
beta.kubernetes.io/arch: arm64
tolerations:
tolerations:
- operator: Exists
- operator: Exists
effect: NoSchedule
effect: NoSchedule
serviceAccountName: flannel
serviceAccountName: flannel
initContainers:
initContainers:
- name: install-cni
- name: install-cni
image: quay.io/coreos/flannel:v0.11.0-arm64
image: quay.io/coreos/flannel:v0.11.0-arm64
command:
command:
- cp
- cp
args:
args:
- -f
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
volumeMounts:
- name: cni
- name: cni
mountPath: /etc/cni/net.d
mountPath: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
containers:
containers:
- name: kube-flannel
- name: kube-flannel
image: quay.io/coreos/flannel:v0.11.0-arm64
image: quay.io/coreos/flannel:v0.11.0-arm64
command:
command:
- /opt/bin/flanneld
- /opt/bin/flanneld
args:
args:
- --ip-masq
- --ip-masq
- --kube-subnet-mgr
- --kube-subnet-mgr
resources:
resources:
requests:
requests:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
limits:
limits:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
securityContext:
securityContext:
privileged: true
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
env:
- name: POD_NAME
- name: POD_NAME
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.name
fieldPath: metadata.name
- name: POD_NAMESPACE
- name: POD_NAMESPACE
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.namespace
fieldPath: metadata.namespace
volumeMounts:
volumeMounts:
- name: run
- name: run
mountPath: /run
mountPath: /run/flannel
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
volumes:
volumes:
- name: run
- name: run
hostPath:
hostPath:
path: /run
path: /run/flannel
- name: cni
- name: cni
hostPath:
hostPath:
path: /etc/cni/net.d
path: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
configMap:
configMap:
name: kube-flannel-cfg
name: kube-flannel-cfg
---
---
apiVersion: extensions/v1beta1
apiVersion: extensions/v1beta1
kind: DaemonSet
kind: DaemonSet
metadata:
metadata:
name: kube-flannel-ds-arm
name: kube-flannel-ds-arm
namespace: kube-system
namespace: kube-system
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
template:
template:
metadata:
metadata:
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
hostNetwork: true
hostNetwork: true
nodeSelector:
nodeSelector:
beta.kubernetes.io/arch: arm
beta.kubernetes.io/arch: arm
tolerations:
tolerations:
- operator: Exists
- operator: Exists
effect: NoSchedule
effect: NoSchedule
serviceAccountName: flannel
serviceAccountName: flannel
initContainers:
initContainers:
- name: install-cni
- name: install-cni
image: quay.io/coreos/flannel:v0.11.0-arm
image: quay.io/coreos/flannel:v0.11.0-arm
command:
command:
- cp
- cp
args:
args:
- -f
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
volumeMounts:
- name: cni
- name: cni
mountPath: /etc/cni/net.d
mountPath: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
containers:
containers:
- name: kube-flannel
- name: kube-flannel
image: quay.io/coreos/flannel:v0.11.0-arm
image: quay.io/coreos/flannel:v0.11.0-arm
command:
command:
- /opt/bin/flanneld
- /opt/bin/flanneld
args:
args:
- --ip-masq
- --ip-masq
- --kube-subnet-mgr
- --kube-subnet-mgr
resources:
resources:
requests:
requests:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
limits:
limits:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
securityContext:
securityContext:
privileged: true
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
env:
- name: POD_NAME
- name: POD_NAME
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.name
fieldPath: metadata.name
- name: POD_NAMESPACE
- name: POD_NAMESPACE
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.namespace
fieldPath: metadata.namespace
volumeMounts:
volumeMounts:
- name: run
- name: run
mountPath: /run
mountPath: /run/flannel
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
volumes:
volumes:
- name: run
- name: run
hostPath:
hostPath:
path: /run
path: /run/flannel
- name: cni
- name: cni
hostPath:
hostPath:
path: /etc/cni/net.d
path: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
configMap:
configMap:
name: kube-flannel-cfg
name: kube-flannel-cfg
---
---
apiVersion: extensions/v1beta1
apiVersion: extensions/v1beta1
kind: DaemonSet
kind: DaemonSet
metadata:
metadata:
name: kube-flannel-ds-ppc64le
name: kube-flannel-ds-ppc64le
namespace: kube-system
namespace: kube-system
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
template:
template:
metadata:
metadata:
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
hostNetwork: true
hostNetwork: true
nodeSelector:
nodeSelector:
beta.kubernetes.io/arch: ppc64le
beta.kubernetes.io/arch: ppc64le
tolerations:
tolerations:
- operator: Exists
- operator: Exists
effect: NoSchedule
effect: NoSchedule
serviceAccountName: flannel
serviceAccountName: flannel
initContainers:
initContainers:
- name: install-cni
- name: install-cni
image: quay.io/coreos/flannel:v0.11.0-ppc64le
image: quay.io/coreos/flannel:v0.11.0-ppc64le
command:
command:
- cp
- cp
args:
args:
- -f
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
volumeMounts:
- name: cni
- name: cni
mountPath: /etc/cni/net.d
mountPath: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
containers:
containers:
- name: kube-flannel
- name: kube-flannel
image: quay.io/coreos/flannel:v0.11.0-ppc64le
image: quay.io/coreos/flannel:v0.11.0-ppc64le
command:
command:
- /opt/bin/flanneld
- /opt/bin/flanneld
args:
args:
- --ip-masq
- --ip-masq
- --kube-subnet-mgr
- --kube-subnet-mgr
resources:
resources:
requests:
requests:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
limits:
limits:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
securityContext:
securityContext:
privileged: true
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
env:
- name: POD_NAME
- name: POD_NAME
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.name
fieldPath: metadata.name
- name: POD_NAMESPACE
- name: POD_NAMESPACE
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.namespace
fieldPath: metadata.namespace
volumeMounts:
volumeMounts:
- name: run
- name: run
mountPath: /run
mountPath: /run/flannel
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
volumes:
volumes:
- name: run
- name: run
hostPath:
hostPath:
path: /run
path: /run/flannel
- name: cni
- name: cni
hostPath:
hostPath:
path: /etc/cni/net.d
path: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
configMap:
configMap:
name: kube-flannel-cfg
name: kube-flannel-cfg
---
---
apiVersion: extensions/v1beta1
apiVersion: extensions/v1beta1
kind: DaemonSet
kind: DaemonSet
metadata:
metadata:
name: kube-flannel-ds-s390x
name: kube-flannel-ds-s390x
namespace: kube-system
namespace: kube-system
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
template:
template:
metadata:
metadata:
labels:
labels:
tier: node
tier: node
app: flannel
app: flannel
spec:
spec:
hostNetwork: true
hostNetwork: true
nodeSelector:
nodeSelector:
beta.kubernetes.io/arch: s390x
beta.kubernetes.io/arch: s390x
tolerations:
tolerations:
- operator: Exists
- operator: Exists
effect: NoSchedule
effect: NoSchedule
serviceAccountName: flannel
serviceAccountName: flannel
initContainers:
initContainers:
- name: install-cni
- name: install-cni
image: quay.io/coreos/flannel:v0.11.0-s390x
image: quay.io/coreos/flannel:v0.11.0-s390x
command:
command:
- cp
- cp
args:
args:
- -f
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
volumeMounts:
- name: cni
- name: cni
mountPath: /etc/cni/net.d
mountPath: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
containers:
containers:
- name: kube-flannel
- name: kube-flannel
image: quay.io/coreos/flannel:v0.11.0-s390x
image: quay.io/coreos/flannel:v0.11.0-s390x
command:
command:
- /opt/bin/flanneld
- /opt/bin/flanneld
args:
args:
- --ip-masq
- --ip-masq
- --kube-subnet-mgr
- --kube-subnet-mgr
resources:
resources:
requests:
requests:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
limits:
limits:
cpu: "100m"
cpu: "100m"
memory: "50Mi"
memory: "50Mi"
securityContext:
securityContext:
privileged: true
privileged: false
capabilities:
add: ["NET_ADMIN"]
env:
env:
- name: POD_NAME
- name: POD_NAME
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.name
fieldPath: metadata.name
- name: POD_NAMESPACE
- name: POD_NAMESPACE
valueFrom:
valueFrom:
fieldRef:
fieldRef:
fieldPath: metadata.namespace
fieldPath: metadata.namespace
volumeMounts:
volumeMounts:
- name: run
- name: run
mountPath: /run
mountPath: /run/flannel
- name: flannel-cfg
- name: flannel-cfg
mountPath: /etc/kube-flannel/
mountPath: /etc/kube-flannel/
volumes:
volumes:
- name: run
- name: run
hostPath:
hostPath:
path: /run
path: /run/flannel
- name: cni
- name: cni
hostPath:
hostPath:
path: /etc/cni/net.d
path: /etc/cni/net.d
- name: flannel-cfg
- name: flannel-cfg
configMap:
configMap:
name: kube-flannel-cfg
name: kube-flannel-cfg
已保存差異