Cleaning up cilium values
This commit is contained in:
parent
5000f8889a
commit
1fad218deb
1 changed files with 65 additions and 218 deletions
|
|
@ -1,241 +1,88 @@
|
||||||
---
|
|
||||||
# -- Enable installation of PodCIDR routes between worker
|
|
||||||
# nodes if worker nodes share a common L2 network segment.
|
|
||||||
autoDirectNodeRoutes: true
|
autoDirectNodeRoutes: true
|
||||||
|
bandwidthManager:
|
||||||
# -- Configure BGP
|
enabled: true
|
||||||
bgp:
|
bbr: true
|
||||||
# -- Enable BGP support inside Cilium; embeds a new ConfigMap for BGP inside
|
bpf:
|
||||||
# cilium-agent and cilium-operator
|
masquerade: true
|
||||||
enabled: false
|
bgp:
|
||||||
announce:
|
enabled: false
|
||||||
# -- Enable allocation and announcement of service LoadBalancer IPs
|
cluster:
|
||||||
loadbalancerIP: true
|
name: valinor
|
||||||
# -- Enable announcement of node pod CIDR
|
id: 1
|
||||||
podCIDR: false
|
containerRuntime:
|
||||||
|
integration: containerd
|
||||||
# -- Configure cgroup related configuration
|
endpointRoutes:
|
||||||
cgroup:
|
|
||||||
autoMount:
|
|
||||||
# -- Enable auto mount of cgroup2 filesystem.
|
|
||||||
# When `autoMount` is enabled, cgroup2 filesystem is mounted at
|
|
||||||
# `cgroup.hostRoot` path on the underlying host and inside the cilium agent pod.
|
|
||||||
# If users disable `autoMount`, it's expected that users have mounted
|
|
||||||
# cgroup2 filesystem at the specified `cgroup.hostRoot` volume, and then the
|
|
||||||
# volume will be mounted inside the cilium agent pod at the same path.
|
|
||||||
enabled: false
|
|
||||||
# -- Configure cgroup root where cgroup2 filesystem is mounted on the host (see also: `cgroup.autoMount`)
|
|
||||||
hostRoot: /sys/fs/cgroup
|
|
||||||
|
|
||||||
cluster:
|
|
||||||
# -- Name of the cluster. Only required for Cluster Mesh.
|
|
||||||
name: valinor
|
|
||||||
# -- (int) Unique ID of the cluster. Must be unique across all connected
|
|
||||||
# clusters and in the range of 1 to 255. Only required for Cluster Mesh,
|
|
||||||
# may be 0 if Cluster Mesh is not used.
|
|
||||||
id: 1
|
|
||||||
|
|
||||||
# -- Configure container runtime specific integration.
|
|
||||||
containerRuntime:
|
|
||||||
# -- Enables specific integrations for container runtimes.
|
|
||||||
# Supported values:
|
|
||||||
# - containerd
|
|
||||||
# - crio
|
|
||||||
# - docker
|
|
||||||
# - none
|
|
||||||
# - auto (automatically detect the container runtime)
|
|
||||||
integration: containerd
|
|
||||||
|
|
||||||
endpointRoutes:
|
|
||||||
# -- Enable use of per endpoint routes instead of routing via
|
|
||||||
# the cilium_host interface.
|
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
hubble:
|
hubble:
|
||||||
# -- Enable Hubble (true by default).
|
|
||||||
enabled: true
|
enabled: true
|
||||||
metrics:
|
metrics:
|
||||||
# -- Configures the list of metrics to collect. If empty or null, metrics
|
|
||||||
# are disabled.
|
|
||||||
# Example:
|
|
||||||
#
|
|
||||||
# enabled:
|
|
||||||
# - dns:query;ignoreAAAA
|
|
||||||
# - drop
|
|
||||||
# - tcp
|
|
||||||
# - flow
|
|
||||||
# - icmp
|
|
||||||
# - http
|
|
||||||
#
|
|
||||||
# You can specify the list of metrics from the helm CLI:
|
|
||||||
#
|
|
||||||
# --set metrics.enabled="{dns:query;ignoreAAAA,drop,tcp,flow,icmp,http}"
|
|
||||||
#
|
|
||||||
enabled:
|
enabled:
|
||||||
- dns:query;ignoreAAAA,
|
- dns:query
|
||||||
- drop
|
- drop
|
||||||
- tcp
|
- tcp
|
||||||
- flow
|
- flow
|
||||||
- http
|
|
||||||
- icmp
|
|
||||||
- port-distribution
|
- port-distribution
|
||||||
|
- icmp
|
||||||
|
- http
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
dashboards:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
grafana_folder: Cilium
|
||||||
relay:
|
relay:
|
||||||
# -- Enable Hubble Relay (requires hubble.enabled=true)
|
|
||||||
enabled: true
|
enabled: true
|
||||||
# -- Roll out Hubble Relay pods automatically when configmap is updated.
|
|
||||||
rollOutPods: true
|
rollOutPods: true
|
||||||
|
prometheus:
|
||||||
# serviceMonitor:
|
serviceMonitor:
|
||||||
# # -- Create ServiceMonitor resources for Prometheus Operator.
|
enabled: true
|
||||||
# # This requires the prometheus CRDs to be available.
|
|
||||||
# # ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml)
|
|
||||||
# enabled: false
|
|
||||||
|
|
||||||
ui:
|
ui:
|
||||||
# -- Whether to enable the Hubble UI.
|
|
||||||
enabled: true
|
enabled: true
|
||||||
|
rollOutPods: true
|
||||||
# -- hubble-ui ingress configuration.
|
|
||||||
ingress:
|
ingress:
|
||||||
enabled: false
|
|
||||||
|
|
||||||
# -- Roll out Hubble-ui pods automatically when configmap is updated.
|
|
||||||
rollOutPods: true
|
|
||||||
|
|
||||||
ipam:
|
|
||||||
# -- Configure IP Address Management mode.
|
|
||||||
# ref: https://docs.cilium.io/en/stable/concepts/networking/ipam/
|
|
||||||
mode: kubernetes
|
|
||||||
|
|
||||||
# -- (string) Allows to explicitly specify the IPv4 CIDR for native routing.
|
|
||||||
# When specified, Cilium assumes networking for this CIDR is preconfigured and
|
|
||||||
# hands traffic destined for that range to the Linux network stack without
|
|
||||||
# applying any SNAT.
|
|
||||||
# Generally speaking, specifying a native routing CIDR implies that Cilium can
|
|
||||||
# depend on the underlying networking stack to route packets to their
|
|
||||||
# destination. To offer a concrete example, if Cilium is configured to use
|
|
||||||
# direct routing and the Kubernetes CIDR is included in the native routing CIDR,
|
|
||||||
# the user must configure the routes to reach pods, either manually or by
|
|
||||||
# setting the auto-direct-node-routes flag.
|
|
||||||
ipv4NativeRoutingCIDR: 10.244.0.0/16
|
|
||||||
|
|
||||||
# -- (string) Kubernetes service host
|
|
||||||
k8sServiceHost: valinor.hsn.dev
|
|
||||||
# -- (string) Kubernetes service port
|
|
||||||
k8sServicePort: 6443
|
|
||||||
|
|
||||||
# -- Configure the kube-proxy replacement in Cilium BPF datapath
|
|
||||||
# Valid options are "disabled", "partial", "strict".
|
|
||||||
# ref: https://docs.cilium.io/en/stable/gettingstarted/kubeproxy-free/
|
|
||||||
kubeProxyReplacement: strict
|
|
||||||
|
|
||||||
# -- healthz server bind address for the kube-proxy replacement.
|
|
||||||
# To enable set the value to '0.0.0.0:10256' for all ipv4
|
|
||||||
# addresses and this '[::]:10256' for all ipv6 addresses.
|
|
||||||
# By default it is disabled.
|
|
||||||
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
|
||||||
|
|
||||||
# -- Configure service load balancing
|
|
||||||
loadBalancer:
|
|
||||||
# -- algorithm is the name of the load balancing algorithm for backend
|
|
||||||
# selection e.g. random or maglev
|
|
||||||
algorithm: random
|
|
||||||
|
|
||||||
# -- mode is the operation mode of load balancing for remote backends
|
|
||||||
# e.g. snat, dsr, hybrid
|
|
||||||
mode: snat
|
|
||||||
|
|
||||||
# -- Enable Local Redirect Policy.
|
|
||||||
localRedirectPolicy: false
|
|
||||||
|
|
||||||
operator:
|
|
||||||
# -- Enable the cilium-operator component (required).
|
|
||||||
enabled: true
|
enabled: true
|
||||||
|
className: internal
|
||||||
# -- Roll out cilium-operator pods automatically when configmap is updated.
|
hosts:
|
||||||
|
- &host hubble.hsn.dev
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- *host
|
||||||
|
ipam:
|
||||||
|
mode: kubernetes
|
||||||
|
ipv4NativeRoutingCIDR: 10.32.0.0/16
|
||||||
|
k8sServiceHost: 10.2.0.6
|
||||||
|
k8sServicePort: 6443
|
||||||
|
kubeProxyReplacement: true
|
||||||
|
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
||||||
|
l2announcements:
|
||||||
|
enabled: true
|
||||||
|
leaseDuration: 120s
|
||||||
|
leaseRenewDeadline: 60s
|
||||||
|
leaseRetryPeriod: 1s
|
||||||
|
loadBalancer:
|
||||||
|
algorithm: maglev
|
||||||
|
mode: dsr
|
||||||
|
localRedirectPolicy: true
|
||||||
|
operator:
|
||||||
rollOutPods: true
|
rollOutPods: true
|
||||||
|
prometheus:
|
||||||
# -- Roll out cilium agent pods automatically when configmap is updated.
|
enabled: true
|
||||||
rollOutCiliumPods: false
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
dashboards:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
grafana_folder: Cilium
|
||||||
|
prometheus:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
trustCRDsExist: true
|
||||||
|
dashboards:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
grafana_folder: Cilium
|
||||||
|
rollOutCiliumPods: true
|
||||||
securityContext:
|
securityContext:
|
||||||
# -- Run the pod with elevated privileges
|
privileged: true
|
||||||
privileged: false
|
tunnel: disabled
|
||||||
|
|
||||||
capabilities:
|
|
||||||
# -- Capabilities for the `cilium-agent` container
|
|
||||||
ciliumAgent:
|
|
||||||
# Use to set socket permission
|
|
||||||
- CHOWN
|
|
||||||
# Used to terminate envoy child process
|
|
||||||
- KILL
|
|
||||||
# Used since cilium modifies routing tables, etc...
|
|
||||||
- NET_ADMIN
|
|
||||||
# Used since cilium creates raw sockets, etc...
|
|
||||||
- NET_RAW
|
|
||||||
# Used since cilium monitor uses mmap
|
|
||||||
- IPC_LOCK
|
|
||||||
# Used in iptables. Consider removing once we are iptables-free
|
|
||||||
# - SYS_MODULE
|
|
||||||
# We need it for now but might not need it for >= 5.11 specially
|
|
||||||
# for the 'SYS_RESOURCE'.
|
|
||||||
# In >= 5.8 there's already BPF and PERMON capabilities
|
|
||||||
- SYS_ADMIN
|
|
||||||
# Could be an alternative for the SYS_ADMIN for the RLIMIT_NPROC
|
|
||||||
- SYS_RESOURCE
|
|
||||||
# Both PERFMON and BPF requires kernel 5.8, container runtime
|
|
||||||
# cri-o >= v1.22.0 or containerd >= v1.5.0.
|
|
||||||
# If available, SYS_ADMIN can be removed.
|
|
||||||
#- PERFMON
|
|
||||||
#- BPF
|
|
||||||
# Allow discretionary access control (e.g. required for package installation)
|
|
||||||
- DAC_OVERRIDE
|
|
||||||
# Allow to set Access Control Lists (ACLs) on arbitrary files (e.g. required for package installation)
|
|
||||||
- FOWNER
|
|
||||||
# Allow to execute program that changes GID (e.g. required for package installation)
|
|
||||||
- SETGID
|
|
||||||
# Allow to execute program that changes UID (e.g. required for package installation)
|
|
||||||
- SETUID
|
|
||||||
# -- Capabilities for the `mount-cgroup` init container
|
|
||||||
mountCgroup:
|
|
||||||
# Only used for 'mount' cgroup
|
|
||||||
- SYS_ADMIN
|
|
||||||
# Used for nsenter
|
|
||||||
- SYS_CHROOT
|
|
||||||
- SYS_PTRACE
|
|
||||||
# -- capabilities for the `apply-sysctl-overwrites` init container
|
|
||||||
applySysctlOverwrites:
|
|
||||||
# Required in order to access host's /etc/sysctl.d dir
|
|
||||||
- SYS_ADMIN
|
|
||||||
# Used for nsenter
|
|
||||||
- SYS_CHROOT
|
|
||||||
- SYS_PTRACE
|
|
||||||
# -- Capabilities for the `clean-cilium-state` init container
|
|
||||||
cleanCiliumState:
|
|
||||||
# Most of the capabilities here are the same ones used in the
|
|
||||||
# cilium-agent's container because this container can be used to
|
|
||||||
# uninstall all Cilium resources, and therefore it is likely that
|
|
||||||
# will need the same capabilities.
|
|
||||||
# Used since cilium modifies routing tables, etc...
|
|
||||||
- NET_ADMIN
|
|
||||||
# Used in iptables. Consider removing once we are iptables-free
|
|
||||||
# - SYS_MODULE
|
|
||||||
# We need it for now but might not need it for >= 5.11 specially
|
|
||||||
# for the 'SYS_RESOURCE'.
|
|
||||||
# In >= 5.8 there's already BPF and PERMON capabilities
|
|
||||||
- SYS_ADMIN
|
|
||||||
# Could be an alternative for the SYS_ADMIN for the RLIMIT_NPROC
|
|
||||||
- SYS_RESOURCE
|
|
||||||
# Both PERFMON and BPF requires kernel 5.8, container runtime
|
|
||||||
# cri-o >= v1.22.0 or containerd >= v1.5.0.
|
|
||||||
# If available, SYS_ADMIN can be removed.
|
|
||||||
#- PERFMON
|
|
||||||
#- BPF
|
|
||||||
|
|
||||||
# -- Configure the encapsulation configuration for communication between nodes.
|
|
||||||
# Possible values:
|
|
||||||
# - disabled
|
|
||||||
# - vxlan (default)
|
|
||||||
# - geneve
|
|
||||||
tunnel: "disabled"
|
|
||||||
|
|
|
||||||
Reference in a new issue